InvalidCastException: Unable to cast object of type 'System.Security.Cryptography.RSACng'

In Windows there are two generations of encryption APIs:

• The old generation ( link ), which includes Cryptographic Service Providers (CSP), which is the technology used by the class RSACryptoServiceProvider ;
• And the new generation ( link ), Cryptography API : Next Generation (CNG), which is the technology used by the class RSACng .

The X509Certificate2.PrivateKey property returns a object of type AsymmetricAlgorithm , which can be of type RSA or DSA . From the .NET Framework 4.6 you can use the extension method X509Certificate2.GetRSAPrivateKey , which returns an object directly RSA .

A certificate key can implement the two cryptographic generations, or just one of them. In the case of your certificate, it seems that only the new cryptographic generation is implemented, so the X509Certificate2.PrivateKey property is returning an object of type RSACng , which can not be directly converted to type RSACryptoServiceProvider , since they are totally different.

Only the routine you have to enter the PIN of your hardware certificate only works with type RSACryptoServiceProvider , so you will have to adapt it to RSACng type. I do not have a hardware certificate here to test, but I wrote a routine for you to test.

First the LerDispositivo() function (keep the name you used, but now you pass the X509Certificate2 certificate directly to it) to see what type of RSA is received from the certificate, if it is CNG ( Cryptography API: Next Generation ) or CSP Cryptographic Service Provider ), and then redirects to the function that knows how deal with each case:

using System.Security;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Text;

public static RSA LerDispositivo(X509Certificate2 cert, string pin)
{
   // Obtém a chave privada RSA do certificado.
   RSA rsa = cert.GetRSAPrivateKey();

   // Se a chave for do tipo CNG chama a função que trata desse tipo.
   RSACng rsaCng = rsa as RSACng;
   if (rsaCng != null)
   {
      return LerDispositivoCng(rsaCng, pin);
   }

   // Se a chave for do tipo CSP chama a função que trata desse tipo.
   RSACryptoServiceProvider rsaCsp = rsa as RSACryptoServiceProvider;
   if (rsaCsp != null)
   {
      return LerDispositivoCsp(rsaCsp, pin);
   }

   // A chave não era nem CNG nem CSP.
   return null;
}

private static RSA LerDispositivoCng(RSACng rsaCng, string pin)
{
   byte[] propValue;

   // O valor da propriedade deve ser informado como um array de bytes em
   // formato Unicode, e deve contar um caractere nulo como terminador.
   if (pin[pin.Length - 1] == '
using System.Security;
using System.Security.Cryptography;
using System.Security.Cryptography.X509Certificates;
using System.Text;

public static RSA LerDispositivo(X509Certificate2 cert, string pin)
{
   // Obtém a chave privada RSA do certificado.
   RSA rsa = cert.GetRSAPrivateKey();

   // Se a chave for do tipo CNG chama a função que trata desse tipo.
   RSACng rsaCng = rsa as RSACng;
   if (rsaCng != null)
   {
      return LerDispositivoCng(rsaCng, pin);
   }

   // Se a chave for do tipo CSP chama a função que trata desse tipo.
   RSACryptoServiceProvider rsaCsp = rsa as RSACryptoServiceProvider;
   if (rsaCsp != null)
   {
      return LerDispositivoCsp(rsaCsp, pin);
   }

   // A chave não era nem CNG nem CSP.
   return null;
}

private static RSA LerDispositivoCng(RSACng rsaCng, string pin)
{
   byte[] propValue;

   // O valor da propriedade deve ser informado como um array de bytes em
   // formato Unicode, e deve contar um caractere nulo como terminador.
   if (pin[pin.Length - 1] == '%pre%')
   {
      propValue = Encoding.Unicode.GetBytes(pin);
   }
   else
   {
      propValue = new byte[Encoding.Unicode.GetByteCount(pin) + 2];
      Encoding.Unicode.GetBytes(pin, 0, pin.Length, propValue, 0);
   }

   const string NCRYPT_PIN_PROPERTY = "SmartCardPin";

   CngProperty prop = new CngProperty(NCRYPT_PIN_PROPERTY,
                                      propValue,
                                      CngPropertyOptions.None);
   rsaCng.Key.SetProperty(prop);

   return rsaCng;
}

private static RSA LerDispositivoCsp(RSACryptoServiceProvider rsaCsp, string pin)
{
   var securePin = new SecureString();
   foreach (char c in pin)
   {
      securePin.AppendChar(c);
   }

   var cspParams = new CspParameters(
                           rsaCsp.CspKeyContainerInfo.ProviderType,
                           rsaCsp.CspKeyContainerInfo.ProviderName,
                           rsaCsp.CspKeyContainerInfo.KeyContainerName,
                           null,
                           securePin);
   cspParams.KeyNumber = (int) KeyNumber.Signature;
   cspParams.Flags = CspProviderFlags.NoPrompt |
                     CspProviderFlags.UseDefaultKeyContainer;

   return new RSACryptoServiceProvider(cspParams);
}
')
   {
      propValue = Encoding.Unicode.GetBytes(pin);
   }
   else
   {
      propValue = new byte[Encoding.Unicode.GetByteCount(pin) + 2];
      Encoding.Unicode.GetBytes(pin, 0, pin.Length, propValue, 0);
   }

   const string NCRYPT_PIN_PROPERTY = "SmartCardPin";

   CngProperty prop = new CngProperty(NCRYPT_PIN_PROPERTY,
                                      propValue,
                                      CngPropertyOptions.None);
   rsaCng.Key.SetProperty(prop);

   return rsaCng;
}

private static RSA LerDispositivoCsp(RSACryptoServiceProvider rsaCsp, string pin)
{
   var securePin = new SecureString();
   foreach (char c in pin)
   {
      securePin.AppendChar(c);
   }

   var cspParams = new CspParameters(
                           rsaCsp.CspKeyContainerInfo.ProviderType,
                           rsaCsp.CspKeyContainerInfo.ProviderName,
                           rsaCsp.CspKeyContainerInfo.KeyContainerName,
                           null,
                           securePin);
   cspParams.KeyNumber = (int) KeyNumber.Signature;
   cspParams.Flags = CspProviderFlags.NoPrompt |
                     CspProviderFlags.UseDefaultKeyContainer;

   return new RSACryptoServiceProvider(cspParams);
}

References:

  

• EncryptedXml DecryptDocument method error after .Net framework update - Stack Overflow
  
• Verify Private Key Protection before signing with RSACryptoServiceProvider - Stack Overflow
  
• CngKey Assign permission to machine key - Stack Overflow
  
• CngKey.SetProperty - Reference Source
  
• NCryptSetProperty function | Microsoft Docs
  
• Key Storage Property Identifiers | Microsoft Docs
  
• How can I set PIN for X509Certificate2 programmatically? - Stack Overflow