RSACryptoServiceProvider CryptographicException System Cannot Find the File Specified under ASP.NET

Question

I have an application which is making use of the RSACryptoServiceProvider to decrypt some data using a known private key (stored in a variable).

When the IIS Application Pool is configured to use Network Service, everything runs fine.

However, when we configure the IIS Application Pool to run the code under a different Identity, we get the following:

System.Security.Cryptography.CryptographicException: The system cannot find the file specified.

   at System.Security.Cryptography.Utils.CreateProvHandle(CspParameters parameters, Boolean randomKeyContainer)
   at System.Security.Cryptography.RSACryptoServiceProvider.ImportParameters(RSAParameters parameters)
   at System.Security.Cryptography.RSA.FromXmlString(String xmlString)

The code is something like this:

byte[] input; 
byte[] output; 
string private_key_xml; 

var provider = new System.Cryptography.RSACryptoServiceProvider(this.m_key.Key_Size);
provider.FromXmlString(private_key_xml); // Fails Here when Application Pool Identity != Network Service

ouput = provider.Decrypt(input, false); // False = Use PKCS#1 v1.5 Padding

There are resources which attempt to answer it by stating that you should give the user read access to the machine key store - however there is no definitive answer to solve this issue.

Environment: IIS 6.0, Windows Server 2003 R2, .NET 3.5 SP1

Answer 1

Try setting

System.Cryptography.RSACryptoServiceProvider.UseMachineKeyStore = true;

EDIT: Then try using

var provider = new System.Cryptography.RSACryptoServiceProvider();

instead of the constructor with the integer-parameter. That constructor tries to generate a key with the specified key-length, and you might not be able to do that with your permissions.

Answer 2

Indeed you need to work a code like this

CspParameters _cpsParameter;
RSACryptoServiceProvider RSAProvider;

_cpsParameter = new CspParameters();
_cpsParameter.Flags = CspProviderFlags.UseMachineKeyStore;

RSAProvider = new RSACryptoServiceProvider(1024, _cpsParameter);

The following users need access to the folder: C:\Documents and Settings\All Users\Application data\Microsoft\Crypto\RSA\MachineKeys

1. IIS user account (anonymmous)
2. The user account you use to impersonate your application in the web.config settings.

So now it is working fine for me.

Answer 3

I fixed this by setting "Load User Profile" to True (was False) in the Application Pool's Advanced Settings / Process Model section.

The application had been working perfectly on Server 2003 R2 / IIS 6 and the problem appeared as I was configuring it on our new 2008 R2 server.

Got the idea to try it at:

http://social.msdn.microsoft.com/forums/en-US/clr/thread/7ea48fd0-8d6b-43ed-b272-1a0249ae490f/

YMMV

Answer 4

set "Load User Profile" to true! That worked for me on Windows Server 2008. Thank you Tim Erickson

Answer 5

I just wanted to comment that Rasmus Faber's solution worked for me (with one minor edit):

System.Cryptography.RSACryptoServiceProvider.UseMachineKeyStore = true;
RSACryptoServiceProvider provider = new System.Cryptography.RSACryptoServiceProvider();

I was trying to get MailBee.net to sign an outgoing message using DKIM and got the same message that the OP received. Of course everything was fine on my dev machine, but when uploading to my clients webhost, I ran into this problem. Like I said, the solution above worked for me while others that I found online (including the msdn forum link above) didn't.

(I'd upvote and comment, but I don't have enough rep to do so. :P )

Thanks Rasmus Faber!