c# - input too large for RSA cipher with BouncyCastle

Collectives™ on Stack Overflow

Find centralized, trusted content and collaborate around the technologies you use most.

Learn more about Collectives

Teams

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

Learn more about Teams

I'm trying to write a service to SFTP to a server on a given interval, download all files in a directory, and then decrypt them for processing.

The decrypt method was working at one point, and I have no modified it since. I am still using the same keys as when it did successfully work.

I am using the PGPEncrypt, PGPDecrypt, and PGPEncryptionKeys classes for BouncyCastle found here: https://github.com/sledwith/PGP-Decryption-With-C-Sharp

Additionally, I have modified the code as shown here: Exception on decrypting file using BouncyCastle PGP

If you noticed, I commented on how that fixed my code and the decryption worked.

Now, it isn't.

Does anyone have some insight why this might have happened, or how I could go about fixing it?

No. Sorry for the lack of input. So, I found that it worked for my local tests after I removed the modifications from the last link in my post, but am still waiting on a new set of test data to try to see what happened there, because it worked when I tried it on my first set of test data. – Corwin01 Oct 9, 2013 at 17:02

I am going to make a guess that you are using a 1024 bit RSA public/private key and trying to encrypt 128 bytes of something with it? If I am right, use a larger RSA key (RSA 4096 will allow you to encrypt up to ~500 bytes).

I note in the linked post you say this is sporadic. Some googling indicates that if you have leading zeros in the to-be-encrypted bytes it may be able to handle a full 128 bytes.

Also - if you are just encrypting "data" with the keypair, you need to be certain it will not overrun these limitations (240 or so bytes for RSA 2048 and 500 or so for RSA 4096 accounting for padding). Good practice and future proofing would be to implement a symmetric key encryption of all your data and just use the RSA key to encrypt / decrypt your keys.

I don't understand your statements about key sizes. 1024-bit RSA public keys can encrypt data up to 1024-bits in length. Now, padding is normally used, but still.. one can expect a good 900+ bits of data to be encrypted. – Duncan Jones Oct 2, 2013 at 13:24 I'm struggling to imagine 128 byte symmetric keys. AES keys are no larger than 256 bits . Triple DES keys are 192 bits... – Duncan Jones Oct 2, 2013 at 14:48 @DuncanJones meant to remove all reference to the symmetric keys at all, and am guessing he is encrypting 128 bytes of something which would account for both his error and the sporadic functioning of it when it doesn't have to pad. – Matthew Oct 2, 2013 at 14:53 @DuncanJones Or 256+ to a 2048 RSA key, etc. The error is pretty clear, and I have seen the exact error message before with bouncycastle when one of my developers was encrypting a field directly with the public/private key pair instead of the symmetric key used to encrypt the data, which eventually someone stuck more than 500 or so bytes in. – Matthew Oct 2, 2013 at 15:01

If you're not dead-set on using the PGP process explicitly, you might use my library here:

https://github.com/zenith-nz/ObscurCore

Its "banner feature" is not yet fully active (creating encrypted archives of a kind), but it does everything that you want it for, it appears - it does key derivation with a ECDHC scheme, UM1, and implements a large variety of block and stream ciphers. It's built on top of BouncyCastle.

I think I resolved this problem; please try this code.

public string StringToDecrypt(string text)
    byte[] toDecrypt = Convert.FromBase64String(text);
    AsymmetricCipherKeyPair keyPair;
    using (var reader = File.OpenText(@"Private Key File Path"))
        keyPair = (AsymmetricCipherKeyPair) new PemReader(reader).ReadObject();   
    var engine = new RsaEngine();
    engine.Init(false, keyPair.Private);
    return Encoding.UTF8.GetString(engine.ProcessBlock(toDecrypt, 0, toDecrypt.Length));
                Hi Obaid, welcome to the site.  You may want to provide a bit more context for your answer and consider its formatting.  Please read How to Answer and consider reviewing your answer before posting to check the formatting is correct. Thanks.
– RichieAHB
                Apr 21, 2015 at 8:23
        Thanks for contributing an answer to Stack Overflow!
Please be sure to answer the question. Provide details and share your research!
But avoid …
Asking for help, clarification, or responding to other answers.
Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.