How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc

Question

Is anyone aware of a C# code sample to interact with smartcard, hardware security module, TPM chips (etc), that will allow me to encrypt and decrypt data?

My goal is to allow my application to support a variety of key stores, and should the administrator decide they want the Private key to reside on those devices, I want to be able to support that.

Is there a consistent, or universal way to access these devices? Is there a way through C#?

Answer 1

In the Windows world, cryptography with special hardware goes through the "Cryptographic Service Providers" (CSP). A CSP is a module registered in the OS, which offers access to such a kind of hardware.

From C#, you can look at RSACryptoServiceProvider, which can be created with some parameters which designate a specific CSP.

The non-Windows world tends to use PKCS#11 for that. Google finds some software packages which can apparently use a PKCS#11 DLL (i.e. the driver for the crypto hardware) from C#; e.g. pkcs11.net and NCryptoki (the former seems to be open source, not the latter).