title: How to decrypt a PKCS7 message
body: <p>I'm failing at decrypting some XML files in C#.</p>
  <p>I know very little of cryptography, but from what I understand, I have a password protected certificate, containing both a private and a public key.</p>
  <p>By applying the password to the certificate, I get the private key needed to decrypt files that I receive.</p>
  <p>The messages I want to decrypt resides in a PKCS7 (CMS?) formatted file. I believe I need to parse the files, decrypt them, and then un-sign them.</p>
  <p>I have little idea on how to do this. I have tried the tooling that I found was obvious candidates to help me get this task done, but I can't get it to work.</p>
  <p>At this point, I really want to know; Is there something I'm not understanding? Or am I using the wrong tools for the job?</p>
  <p>Here's some of my attempts in one bunch of code:</p>
  <pre><code>public string DecryptFailingExample()
  {
      var content = File.ReadAllBytes(&quot;encryptedFileWithDataThatIWant.xml.enc&quot;);
      var cert = new X509Certificate2(&quot;certificateFile.pfx&quot;, &quot;PasswordForFile&quot;);
  
      //This code didn't work. rsa.Decrypt would throw: &quot;The length of the data to decrypt is not valid for the size of this key.&quot;
      //using RSA rsa = cert.GetRSAPrivateKey();
      //var decryptedBytes = rsa.Decrypt(content, RSAEncryptionPadding.OaepSHA1); //I tried all possible paddings - Nothing worked
  
  
      //So I tried this instead:
      SignedCms signedCms = new SignedCms();
      signedCms.Decode(content); //Crash: ASN1 corrupted data; The provided data is tagged with 'Universal' class value '13', but it should have been 'Universal' class value '16'.
      var ecms = new EnvelopedCms();
      
      //If I try to skip SignedCms and pass &quot;content&quot; directly to EnvelopedCms, I will get: &quot;ASN1 bad tag value met.&quot;
      ecms.Decode(signedCms.ContentInfo.Content); //Crash: 
      ecms.Decrypt(new X509Certificate2Collection(cert));
  }
  </code></pre>
  <p>This is what my message looks like, that I want to decrypt:</p>
  <blockquote>
  <p>-----BEGIN PKCS7-----</p>
  <p>MIAGCSqGSIb3DQEHA6BAMIACAQAxggGEMIIBgAIBADBoMFExCzAJBgNVBAYTAkRF
  MSQwIgYDVQQKExtFdXJvcGVhbiBFbmVyZ3kgRXhjaGFuZ2UgQUcxHDAaBgNVB4MT</p>
  <p>etc</p>
  <p>3nPyd3c9iGyKhWdQPPr/SRWB/l9bCjkla81MgTcj1rRGQyPJXpkyxpc9U4YYZnxt
  eHkcJMVWDw9ErThok8nh/7bkE4KbWBaLZAac+9occ4deDrlu0wAAAAAAAAAAAAA=</p>
  <p>-----END PKCS7-----</p>
  </blockquote>
  <p><strong>EDIT:</strong>
  Here's another minimal example that doesn't work.</p>
  <pre><code>//Step 1: Load PKCS7 message from disk
  var content = File.ReadAllBytes(&quot;encryptedFileWithDataThatIWant.xml.enc&quot;);
  
  //Step 2: Load .pfx certificate from disk 
  var cert = new X509Certificate2(&quot;certificateFile.pfx&quot;, &quot;Password&quot;);
  
  //Step 3: Create instance of EnvelopedCms
  var ecms = new EnvelopedCms();
  
  //Step 4: Add certificate for decoding
  ecms.Certificates.Add(cert);
  
  //Step 5: Decode the PKCS7 message
  ecms.Decode(content); //Internal.Cryptography.CryptoThrowHelper.WindowsCryptographicException: 'ASN1 bad tag value met.'
  </code></pre>
  <p>Apart from the .PFX file, I also do have a PEM file with the private certificate. It looks like this:</p>
  <blockquote>
  <p>-----BEGIN RSA PRIVATE KEY-----</p>
  <p>Proc-Type: 4,ENCRYPTED
  DEK-Info: AES-256-CBC,915538553FEFBA6A98930E4BFFDA1E68</p>
  <p>Pk0FHxXNHukA62FSmuzzE+gqHgeauZr6z+lqTcbf55cakrQzHQOQUnR0w5kCFPPg</p>
  <p>etc</p>
  <p>L7U2cWJpbNsRNmBcTyH1WWJ4hYoCqdl9G6Zey4y/EQbZl1DKXtmIiLZSneF0VU9u</p>
  <p>-----END RSA PRIVATE KEY-----</p>
  </blockquote>
  <p>I tried importing the key like this, but that doesn't seem to work:</p>
  <pre><code>var pem = File.ReadAllBytes(&quot;pemFile.pem&quot;);
  var pemChars = Encoding.UTF8.GetString(pem);
  var rsa = RSA.Create();
  rsa.ImportFromEncryptedPem(pemChars, &quot;Password&quot;); //System.ArgumentException: 'No supported key formats were found. Check that the input represents the contents of a PEM-encoded key file, not the path to such a file. (Parameter 'input')'
  </code></pre>