RSACryptoServiceProvider CryptographicException System Cannot Find the File Specified under ASP.NET

I have an application which is making use of the RSACryptoServiceProvider to decrypt some data using a known private key (stored in a variable).

When the IIS Application Pool is configured to use Network Service, everything runs fine.

However, when we configure the IIS Application Pool to run the code under a different Identity, we get the following:

System.Security.Cryptography.CryptographicException: The system cannot find the file specified.

   at System.Security.Cryptography.Utils.CreateProvHandle(CspParameters parameters, Boolean randomKeyContainer)
   at System.Security.Cryptography.RSACryptoServiceProvider.ImportParameters(RSAParameters parameters)
   at System.Security.Cryptography.RSA.FromXmlString(String xmlString)

The code is something like this:

byte[] input; 
byte[] output; 
string private_key_xml; 

var provider = new System.Cryptography.RSACryptoServiceProvider(this.m_key.Key_Size);
provider.FromXmlString(private_key_xml); // Fails Here when Application Pool Identity != Network Service

ouput = provider.Decrypt(input, false); // False = Use PKCS#1 v1.5 Padding

There are resources which attempt to answer it by stating that you should give the user read access to the machine key store – however there is no definitive answer to solve this issue.

Environment: IIS 6.0, Windows Server 2003 R2, .NET 3.5 SP1

Answers:

Thank you for visiting the Q&A section on Magenaut. Please note that all the answers may not help you solve the issue immediately. So please treat them as advisements. If you found the post helpful (or not), leave a comment & I’ll get back to you as soon as possible.

Method 1

I fixed this by setting “Load User Profile” to True (was False) in the Application Pool’s Advanced Settings / Process Model section.

The application had been working perfectly on Server 2003 R2 / IIS 6 and the problem appeared as I was configuring it on our new 2008 R2 server.

Got the idea to try it at:

http://social.msdn.microsoft.com/forums/en-US/clr/thread/7ea48fd0-8d6b-43ed-b272-1a0249ae490f/

YMMV

Method 2

Indeed you need to work a code like this

CspParameters _cpsParameter;
RSACryptoServiceProvider RSAProvider;

_cpsParameter = new CspParameters();
_cpsParameter.Flags = CspProviderFlags.UseMachineKeyStore;

RSAProvider = new RSACryptoServiceProvider(1024, _cpsParameter);

The following users need access to the folder: C:Documents and SettingsAll UsersApplication dataMicrosoftCryptoRSAMachineKeys
  1. IIS user account (anonymmous)
  2. The user account you use to impersonate your application in the web.config settings.

So now it is working fine for me.

Method 3

Try setting

System.Security.Cryptography.RSACryptoServiceProvider.UseMachineKeyStore = true;

EDIT:
Then try using
var provider = new System.Security.Cryptography.RSACryptoServiceProvider();

instead of the constructor with the integer-parameter. That constructor tries to generate a key with the specified key-length, and you might not be able to do that with your permissions.

Method 4

I just wanted to comment that Rasmus Faber’s solution worked for me (with one minor edit):

System.Cryptography.RSACryptoServiceProvider.UseMachineKeyStore = true;
RSACryptoServiceProvider provider = new System.Cryptography.RSACryptoServiceProvider();

I was trying to get MailBee.net to sign an outgoing message using DKIM and got the same message that the OP received. Of course everything was fine on my dev machine, but when uploading to my clients webhost, I ran into this problem. Like I said, the solution above worked for me while others that I found online (including the msdn forum link above) didn’t.

(I’d upvote and comment, but I don’t have enough rep to do so. 😛 )

Thanks Rasmus Faber!

Method 5

Only when i add

Flags = CspProviderFlags.UseMachineKeyStore

Problem solved for me.

{
    string keyName = "Secret***";
    CspParameters parameters = new CspParameters()
    {
        KeyContainerName = keyName,
        Flags = CspProviderFlags.UseMachineKeyStore
    };
}


All methods was sourced from stackoverflow.com or stackexchange.com, is licensed under cc by-sa 2.5, cc by-sa 3.0 and cc by-sa 4.0

0 0 votes
Article Rating
Subscribe
Notify of
guest

0 Comments
Inline Feedbacks
View all comments
0
Would love your thoughts, please comment.x
()
x