Can EnvelopedCms be used to identify the encryption certificate? - encryption

Question

I'm working on a .NET system that receives encrypted files, and I'm decrypting them using an EnvelopedCms object.
The decryption process is working just fine but I would like to be able to determine the thumbprint of the certificate that the sender actually used when they encrypted.
The reason for this is that when a certificate is approaching its expiry date, and the sender has been asked to used a new certificate with a valid-from date that overlaps the valid-to of the expiring certificate, I would like to be able to identify which senders have made the switch and which ones haven't.
Until the old certificate actually expires, both private keys will be available so the file will successfully decrypt regardless of which one they use.
The code I have is currently:
Dim ecms As New EnvelopedCms()
Try
ecms.Decode(data)
Catch ex As Exception
DecryptError = True
DecryptErrorMessage = ex.Message
End Try
Try
ecms.Decrypt()
Catch ex As Exception
DecryptError = True
DecryptErrorMessage = ex.Message
End Try
If DecryptError = False Then
ActualEncryptionCertificate = MyCertificate
If UCase(MyCertificate) <> UCase(ActualEncryptionCertificate) Then
DecryptError = True
DecryptErrorMessage = "Unexpected encryption certificate used."
End If
MessageData = ecms.Encode()
End If
"data" contains the cyphertext, "MyCertificate" contains the thumbprint of the cert we want them to use and the intention is for "ActualEncrpytionCertificate" to contain the thumbprint of the cert they actually used but as you can see, this is just a placeholder at the moment.
I've looked through the properties of the EnvelopedCms object hoping to find a certificates collection, but this does not exist. There is a RecipientInfos collection, but this doesn't seem to contain any information about the encryption certificate.
Am I on a hiding to nothing or is there some other way to identify the certificate from the EnvelopedCms object?

Answer 1

The API won't emit the matched certificate, and the Decrypt overloads which accept certificates will still always search in the Windows Certificate stores, so the only real viable option is to do a match based on the RecipientInfo values.
Note that there are two different implementations for the IssuerAndSerialNumber match. The first one is more efficient because it doesn't throw extra data at the garbage collector. The second one is so lifetime management is symmetric across the the SubjectKeyIdentifier and IssuerAndSerialNumber variants. If you don't need to return the certificates to anyone after calling FindRecipientCerts then you probably want the first one (since you won't need to be concerned with who does/doesn't call Dispose).
private static X509Certificate2Collection FindRecipientCerts(
X509Certificate2Collection haystack,
RecipientInfo recipient)
{
SubjectIdentifier identifier = recipient.RecipientIdentifier;
if (identifier.Type == SubjectIdentifierType.IssuerAndSerialNumber)
{
X509Certificate2Collection coll = new X509Certificate2Collection();
X509IssuerSerial issuerSerial = (X509IssuerSerial)identifier.Value;
#if !CLONE_REQUIRED
foreach (X509Certificate2 cert in haystack)
{
if (cert.SerialNumber == issuerSerial.SerialNumber &&
cert.Issuer == issuerSerial.IssuerName)
{
coll.Add(cert);
}
}
return coll;
#else
// To reduce the number of clones generated, do a local filter on IssuerName, then
// use the cloning Find method for SerialNumber.
foreach (X509Certificate2 cert in haystack)
{
if (cert.Issuer == issuerSerial.IssuerName)
{
coll.Add(cert);
}
}
return coll.Find(
X509FindType.FindBySerialNumber,
issuerSerial.SerialNumber,
false);
#endif
}
else if (identifier.Type == SubjectIdentifierType.SubjectKeyIdentifier)
{
return haystack.Find(
X509FindType.FindBySubjectKeyIdentifier,
identifier.Value,
false);
}
else
{
throw new InvalidOperationException();
}
}
Apologies for answering your VB question with C#.