How to: Decrypt XML Elements with X.509 Certificates

Article
11/03/2006

You can use the classes in the System.Security.Cryptography.Xml namespace to encrypt and decrypt an element within an XML document. XML Encryption is a standard way to exchange or store encrypted XML data, without worrying about the data being easily read. For more information about the XML Encryption standard, see the World Wide Web Consortium (W3C) specification for XML Encryption located at http://www.w3.org/TR/xmldsig-core/.

This example decrypts an XML element that was encrypted using the methods described in: How to: Encrypt XML Elements with X.509 Certificates. It finds an <EncryptedData> element, decrypts the element, and then replaces the element with the original plaintext XML element.

The code example in this procedure decrypts an XML element using an X.509 certificate from the local certificate store of the current user account. The example uses the DecryptDocument method to automatically retrieve the X.509 certificate and decrypt a session key stored in the <EncryptedKey> element of the <EncryptedData> element. The DecryptDocument method then automatically uses the session key to decrypt the XML element.

This example is appropriate for situations where multiple applications need to share encrypted data or where an application needs to save encrypted data between the times that it runs.

To decrypt an XML element with an X.509 certificate

Create an XmlDocument object by loading an XML file from disk. The XmlDocument object contains the XML element to decrypt.
```
Dim xmlDoc As New XmlDocument()
```
```
XmlDocument xmlDoc = new XmlDocument();
```
Create a new EncryptedXml object by passing the XmlDocument object to the constructor.
```
Dim exml As New EncryptedXml(Doc)
```
```
EncryptedXml exml = new EncryptedXml(Doc);
```
Decrypt the XML document using the DecryptDocument method.
```
exml.DecryptDocument()
```
```
exml.DecryptDocument();
```

Save the XmlDocument object.

xmlDoc.Save("test.xml")

xmlDoc.Save("test.xml");

Example

Imports System
Imports System.Xml
Imports System.Security.Cryptography
Imports System.Security.Cryptography.Xml
Imports System.Security.Cryptography.X509Certificates



Module Program

    Sub Main(ByVal args() As String)
        Try
            ' Create an XmlDocument object.
            Dim xmlDoc As New XmlDocument()
            ' Load an XML file into the XmlDocument object.
            xmlDoc.PreserveWhitespace = True
            xmlDoc.Load("test.xml")

            ' Decrypt the document.
            Decrypt(xmlDoc)

            ' Save the XML document.
            xmlDoc.Save("test.xml")
            ' Display the decrypted XML to the console.
            Console.WriteLine("Decrypted XML:")
            Console.WriteLine()
            Console.WriteLine(xmlDoc.OuterXml)

        Catch e As Exception
            Console.WriteLine(e.Message)
        End Try

    End Sub


    Sub Decrypt(ByVal Doc As XmlDocument)
        ' Check the arguments.  
        If Doc Is Nothing Then
            Throw New ArgumentNullException("Doc")
        End If

        ' Create a new EncryptedXml object.
        Dim exml As New EncryptedXml(Doc)
        ' Decrypt the XML document.
        exml.DecryptDocument()
    End Sub
End Module

using System;
using System.Xml;
using System.Security.Cryptography;
using System.Security.Cryptography.Xml;
using System.Security.Cryptography.X509Certificates;

class Program
{
    static void Main(string[] args)
    {
        try
        {
            // Create an XmlDocument object.
            XmlDocument xmlDoc = new XmlDocument();

            // Load an XML file into the XmlDocument object.
            xmlDoc.PreserveWhitespace = true;
            xmlDoc.Load("test.xml");

            // Decrypt the document.
            Decrypt(xmlDoc);

            // Save the XML document.
            xmlDoc.Save("test.xml");

            // Display the decrypted XML to the console.
            Console.WriteLine("Decrypted XML:");
            Console.WriteLine();
            Console.WriteLine(xmlDoc.OuterXml);

        }
        catch (Exception e)
        {
            Console.WriteLine(e.Message);
        }

    }

    public static void Decrypt(XmlDocument Doc)
    {
        // Check the arguments.  
        if (Doc == null)
            throw new ArgumentNullException("Doc");

        
        // Create a new EncryptedXml object.
        EncryptedXml exml = new EncryptedXml(Doc);

        // Decrypt the XML document.
        exml.DecryptDocument();

    }
}

This example assumes that a file named "test.xml" exists in the same directory as the compiled program. It also assumes that "test.xml" contains a "creditcard" element. You can place the following XML into a file called test.xml and use it with this example.

<root>
    <creditcard>
        <number>19834209</number>
        <expiry>02/02/2002</expiry>
    </creditcard>
</root>

Compiling the Code

To compile this example, you need to include a reference to System.Security.dll.
Include the following namespaces: System.Xml, System.Security.Cryptography, and System.Security.Cryptography.Xml.

Security

The X.509 certificate used in this example is for test purposes only. Applications should use an X.509 certificate generated by a trusted certificate authority or use a certificate generated by the Microsoft Windows Certificate Server.

How to: Decrypt XML Elements with X.509 Certificates

To decrypt an XML element with an X.509 certificate

Example

Compiling the Code

Security

See Also

Tasks

Reference

Other Resources

Additional resources