Move RSA Key Container from Server A to Server B

Question

My project required key recovery features where the system admin can upload RSA Key container to restore it in the event for disaster recovery

Current implementation is when admin upload the backup RSA Key container file, the app will move it to RSA Key container folder located at C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys

I tried to recover the key container from server into my local machine

Key container from server :

a953858192ce652ca077837fd55e8ea2_06454689-ae14-440b-aa53-c2eaac321be6

the bold part is Server Machine ID

When the RSACryptoServiceProvider tried to access the container, it will create a new container because the key name is not contain my local machine ID, made the decryption of encrypted data from server doesn't work.

I tried to rename the machine ID to my local machine ID

a953858192ce652ca077837fd55e8ea2_fbf0b515-e8c9-450d-bc0c-4bcb55cbd342

and the RSACryptoService throw error :

"Key not valid for use in specified state."

Code implementation in C# :

try{
    // Create the CspParameters object and set the key container name used to store the RSA key pair.
    var parameters = new CspParameters {KeyContainerName = containerName, Flags = UseMachineKeyStore};

    // Create a new instance of RSACryptoServiceProvider that accesses
    // the key container Key Container Name.
    using var rsaCryptoServiceProvider = new RSACryptoServiceProvider(parameters); // error thrown "Key not valid for use in specified state."
    try
    {
        var keyContainerBlob = rsaCryptoServiceProvider.ExportCspBlob(true);
        using (var rsa = System.Security.Cryptography.RSA.Create())
        {
            rsa.KeySize = CryptoCommonHeap.RSAEncryptionKeySize;

            rsaCryptoServiceProvider.ImportCspBlob(keyContainerBlob);
            var privateKeyParameters = rsaCryptoServiceProvider.ExportParameters(true).ToPrivateKeyParameters();

            var privateKeyParametersJson = JsonConvert.SerializeObject(privateKeyParameters);

            PrivateKeyParametersJson = privateKeyParametersJson;
        }
     }
     finally
     {
        // Setting This If Do Not Want To Store The File Persistently
        //rsaCryptoServiceProvider.PersistKeyInCsp = false;
     }
}
catch (Exception exception)
{
    LogErrorToDatabase(ModuleName, "GenerateKeyAndSaveInKeyStore", exception);
}

I hope someone can enlighten me a correct way to restore RSA key container from another machine..

Adrian Van Oyen · Accepted Answer · 2021-08-21T20:17:10.257

I've figured out myself how to properly restore the key container. Instead of copy the key container directly from Server A to Server B, I export the private key from server A to server B in PEM format and do restoration programmatically.

Dependency : Org.Bouncycastle

First you need to export the private key of your existing key in the key container, you must ensure the RSACryptoServiceProvider is loaded with your intended key container info

//Create the CspParameters object and set the key container name used to store the RSA key pair.
var parameters = new CspParameters {KeyContainerName = containerName, Flags = UseMachineKeyStore};

// Create a new instance of RSACryptoServiceProvider that accesses
// the key container Key Container Name.
using var rsaCryptoServiceProvider = new RSACryptoServiceProvider(parameters);

Then export the key by using this :

private string ExportKey(RSACryptoServiceProvider rsa) {
   var writer = new StringWriter();
   var pemWriter = new PemWriter(writer);
   
   var rsaKeyPair = DotNetUtilities.GetRsaKeyPair(rsa);
   pemWriter.WriteObject(rsaKeyPair.Private);
   return writer.ToString();
}

now you'll have the PEM content and save it to appropriate location :

Then regenerate key container in Server B based on key information in PEM file

public bool PrivateKeyRecovery(string pem)
{
    try
    {
        //read key info
        PemReader pr = new PemReader(new StringReader(pem));
        var paramObject = pr.ReadObject();
        AsymmetricCipherKeyPair KeyPair = (AsymmetricCipherKeyPair)paramObject;
        RSAParameters rsaParams = DotNetUtilities.ToRSAParameters((RsaPrivateCrtKeyParameters)KeyPair.Private);

        //prepare key name and csp parameters
        var keyContainerName = "RestoredContainer" + DateTime.Now.ToString("yyyyMddhmm");
        var parameters = new CspParameters { KeyContainerName = keyContainerName, Flags = UseMachineKeyStore };

        //import csp parameters into new instance of RSACryptoServiceProvider
        RSACryptoServiceProvider csp = new RSACryptoServiceProvider(parameters);
        csp.ImportParameters(rsaParams);

        //exporting new key container
        var keyContainerBlob = csp.ExportCspBlob(true);
        csp.ImportCspBlob(keyContainerBlob);

        
    }
    catch (Exception exception)
    {
        //your error handling
    }

    return false;
}

now you can decrypt data from Server A in Server B by loading the newly generated key container into RSACryptoServiceProvider.

Move RSA Key Container from Server A to Server B

1 Answers1