Skip to content

Fix ManagedAuthenticatedEncryptor calculations - #65890

Merged
BrennanConroy merged 1 commit into
mainfrom
brecon/iv
Mar 23, 2026
Merged

Fix ManagedAuthenticatedEncryptor calculations#65890
BrennanConroy merged 1 commit into
mainfrom
brecon/iv

Conversation

@BrennanConroy

Copy link
Copy Markdown
Member

Fixes #65889

Also, adds netfx to the main DataProtection tests so we get the missing coverage that would have caught this. (7 or 8 tests failed before fixing the bug after adding netfx to the test project).

Copilot AI review requested due to automatic review settings March 20, 2026 17:34
@github-actions github-actions Bot added the area-dataprotection Includes: DataProtection label Mar 20, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes a .NET Framework-specific integrity-check bug in ManagedAuthenticatedEncryptor by correcting the MAC computation range and comparison, and expands DataProtection test coverage by adding a .NET Framework target to the main test project (with accompanying test adjustments for cross-TFM compatibility).

Changes:

  • Fix ManagedAuthenticatedEncryptor (non-NET TFM path) to compute and validate the MAC over the correct payload segment and compare against the actual computed hash.
  • Multi-target Microsoft.AspNetCore.DataProtection.Tests for both $(DefaultNetCoreTargetFramework) and $(DefaultNetFxTargetFramework).
  • Adjust tests for NETFX compatibility (explicit using directives, some #if NET guards, and Span-based assertions converted where necessary).

Reviewed changes

Copilot reviewed 55 out of 55 changed files in this pull request and generated no comments.

Show a summary per file
File Description
src/DataProtection/DataProtection/src/Managed/ManagedAuthenticatedEncryptor.cs Fixes MAC calculation/validation logic for non-NET TFMs and aligns buffer nullability usage.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Microsoft.AspNetCore.DataProtection.Tests.csproj Adds NETFX target and conditions framework-specific references.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Managed/ManagedAuthenticatedEncryptorTests.cs Updates assertions/guards to run under NETFX and keep Span-only tests under #if NET.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/KeyManagement/KeyRingBasedDataProtectorTests.cs Updates Span-based assertions and gates Span-only helper usage under #if NET.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Internal/RoundtripEncryptionHelpers.cs Restricts Span-based helper to #if NET to avoid NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Internal/KeyManagementOptionsPostSetupTest.cs Replaces Directory.CreateTempSubdirectory() usage for broader TFM compatibility.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Repositories/FileSystemXmlRepositoryTests.cs Gates UnixFileMode test under #if NET and adjusts Guid parsing / usings for NETFX builds.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Repositories/RegistryXmlRepositoryTests.cs Removes culture-based Guid.Parse overload usage for broader TFM compatibility.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Aes/AesAuthenticatedEncryptorTests.cs Limits Span/TryEncryptDecrypt tests to #if NET.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Cng/CbcAuthenticatedEncryptorTests.cs Adjusts Span assertions and Base64 conversion to avoid Span overloads not available on NETFX.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Cng/GcmAuthenticatedEncryptorTests.cs Adjusts Span assertions and gates Span-only tests under #if NET.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/HostingTests.cs Wraps file in #if NET to avoid NETFX-incompatible hosting test surface.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/ActivatorTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/ContainerUtilsTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/DataProtectionUtilityExtensionsTests.cs Adds/reorders usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/EphemeralDataProtectionProviderTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/RegistryPolicyResolverTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/SP800_108/SP800_108Tests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/SecretAssert.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/SecretTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/ServiceCollectionTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/StringLoggerFactory.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/TypeForwardingActivatorTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/XmlAssert.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/AuthenticatedEncryption/CngCbcAuthenticatedEncryptorFactoryTest.cs Normalizes header encoding and adds explicit Xunit using.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/AuthenticatedEncryption/CngGcmAuthenticatedEncryptorFactoryTest.cs Normalizes header encoding and adds explicit Xunit using.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/AuthenticatedEncryption/ManagedAuthenticatedEncryptorFactoryTest.cs Normalizes header encoding and adds explicit Xunit using.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/AuthenticatedEncryption/ConfigurationModel/AuthenticatedEncryptorDescriptorDeserializerTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/AuthenticatedEncryption/ConfigurationModel/AuthenticatedEncryptorDescriptorTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/AuthenticatedEncryption/ConfigurationModel/CngCbcAuthenticatedEncryptorConfigurationTests.cs Adds explicit Xunit using for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/AuthenticatedEncryption/ConfigurationModel/CngCbcAuthenticatedEncryptorDescriptorDeserializerTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/AuthenticatedEncryption/ConfigurationModel/CngCbcAuthenticatedEncryptorDescriptorTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/AuthenticatedEncryption/ConfigurationModel/CngGcmAuthenticatedEncryptorConfigurationTests.cs Adds explicit Xunit using for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/AuthenticatedEncryption/ConfigurationModel/CngGcmAuthenticatedEncryptorDescriptorDeserializerTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/AuthenticatedEncryption/ConfigurationModel/CngGcmAuthenticatedEncryptorDescriptorTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/AuthenticatedEncryption/ConfigurationModel/ManagedAuthenticatedEncryptorConfigurationTests.cs Adds explicit Xunit using for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/AuthenticatedEncryption/ConfigurationModel/ManagedAuthenticatedEncryptorDescriptorDeserializerTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/AuthenticatedEncryption/ConfigurationModel/ManagedAuthenticatedEncryptorDescriptorTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/KeyManagement/AdditionalAuthenticatedDataTemplateTests.cs Adds explicit Xunit using for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/KeyManagement/CacheableKeyRingTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/KeyManagement/DefaultKeyResolverTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/KeyManagement/DeferredKeyTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/KeyManagement/KeyEscrowServiceProviderExtensionsTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/KeyManagement/KeyRingProviderTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/KeyManagement/KeyRingTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/KeyManagement/KeyTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/KeyManagement/XmlKeyManagerTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Repositories/EphemeralXmlRepositoryTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/XmlEncryption/CertificateXmlEncryptionTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/XmlEncryption/DpapiNGXmlEncryptionTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/XmlEncryption/DpapiXmlEncryptionTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/XmlEncryption/EncryptedXmlDecryptorTests.cs Normalizes header encoding and adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/XmlEncryption/NullXmlEncryptionTests.cs Adds explicit Xunit using for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/XmlEncryption/XmlEncryptionExtensionsTests.cs Adds explicit usings for NETFX compilation.
src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Internal/KeyManagementOptionsSetupTest.cs Normalizes header encoding and adds explicit usings for NETFX compilation.

Span<byte> correctHash = hashSize <= 128
? stackalloc byte[128].Slice(0, hashSize)
: (correctHashArray = new byte[hashSize]);
// if validationSubkey is stackalloc'ed, there is no way we avoid an alloc here

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Main change is here.

@DeagleGross DeagleGross left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for fixing this Brennan! I guess we need to backport to net10?

@BrennanConroy
BrennanConroy merged commit 3741588 into main Mar 23, 2026
31 checks passed
@BrennanConroy
BrennanConroy deleted the brecon/iv branch March 23, 2026 17:12
@BrennanConroy

Copy link
Copy Markdown
Member Author

/backport to release/10.0

@github-actions

Copy link
Copy Markdown
Contributor

Started backporting to release/10.0 (link to workflow run)

@github-actions

Copy link
Copy Markdown
Contributor

@BrennanConroy backporting to release/10.0 failed, the patch most likely resulted in conflicts. Please backport manually!

git am output
$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Applying: Fix ManagedAuthenticatedEncryptor calculations
Using index info to reconstruct a base tree...
M	src/DataProtection/DataProtection/src/Managed/ManagedAuthenticatedEncryptor.cs
A	src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Aes/AesAuthenticatedEncryptorTests.cs
M	src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/AuthenticatedEncryption/ConfigurationModel/AuthenticatedEncryptorDescriptorTests.cs
M	src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Cng/CbcAuthenticatedEncryptorTests.cs
M	src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Cng/GcmAuthenticatedEncryptorTests.cs
A	src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Internal/RoundtripEncryptionHelpers.cs
M	src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/KeyManagement/KeyRingBasedDataProtectorTests.cs
M	src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Managed/ManagedAuthenticatedEncryptorTests.cs
M	src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Microsoft.AspNetCore.DataProtection.Tests.csproj
M	src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/SP800_108/SP800_108Tests.cs
Falling back to patching base and 3-way merge...
Auto-merging src/DataProtection/DataProtection/src/Managed/ManagedAuthenticatedEncryptor.cs
CONFLICT (content): Merge conflict in src/DataProtection/DataProtection/src/Managed/ManagedAuthenticatedEncryptor.cs
CONFLICT (modify/delete): src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Aes/AesAuthenticatedEncryptorTests.cs deleted in HEAD and modified in Fix ManagedAuthenticatedEncryptor calculations.  Version Fix ManagedAuthenticatedEncryptor calculations of src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Aes/AesAuthenticatedEncryptorTests.cs left in tree.
Auto-merging src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/AuthenticatedEncryption/ConfigurationModel/AuthenticatedEncryptorDescriptorTests.cs
Auto-merging src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Cng/CbcAuthenticatedEncryptorTests.cs
CONFLICT (content): Merge conflict in src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Cng/CbcAuthenticatedEncryptorTests.cs
Auto-merging src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Cng/GcmAuthenticatedEncryptorTests.cs
CONFLICT (content): Merge conflict in src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Cng/GcmAuthenticatedEncryptorTests.cs
CONFLICT (modify/delete): src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Internal/RoundtripEncryptionHelpers.cs deleted in HEAD and modified in Fix ManagedAuthenticatedEncryptor calculations.  Version Fix ManagedAuthenticatedEncryptor calculations of src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Internal/RoundtripEncryptionHelpers.cs left in tree.
Auto-merging src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/KeyManagement/KeyRingBasedDataProtectorTests.cs
CONFLICT (content): Merge conflict in src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/KeyManagement/KeyRingBasedDataProtectorTests.cs
Auto-merging src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Managed/ManagedAuthenticatedEncryptorTests.cs
CONFLICT (content): Merge conflict in src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Managed/ManagedAuthenticatedEncryptorTests.cs
Auto-merging src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Microsoft.AspNetCore.DataProtection.Tests.csproj
CONFLICT (content): Merge conflict in src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/Microsoft.AspNetCore.DataProtection.Tests.csproj
Auto-merging src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/SP800_108/SP800_108Tests.cs
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 Fix ManagedAuthenticatedEncryptor calculations
Error: The process '/usr/bin/git' failed with exit code 128

Link to workflow output

@dotnet-policy-service dotnet-policy-service Bot added this to the 11.0-preview3 milestone Mar 23, 2026
wtgodbe added a commit that referenced this pull request Mar 24, 2026
#65934)

* Fix ManagedAuthenticatedEncryptor calculations (#65890)

* Run Helix tests on VS2026 (#65162)

* Update Helix queue

* Update SkipOnHelix queues for StartupTests

* Update SkipOnHelix queue for Http2Tests

* Apply suggestion from @Copilot

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Apply suggestion from @Copilot

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Apply suggestion from @Copilot

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: William Godbe <wigodbe@microsoft.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@MaceWindu

Copy link
Copy Markdown
Contributor

any idea why it fails now after this change?

.UseCustomCryptographicAlgorithms(new ManagedAuthenticatedEncryptorConfiguration()
{
    EncryptionAlgorithmKeySize = 256,
    ValidationAlgorithmType = typeof(HMACSHA384),
    EncryptionAlgorithmType = typeof(Aes)
})
[aspnetcorev2_inprocess.dll] Event Log: 'Application '/LM/W3SVC/1/ROOT/xxx' with physical root 'xxx' hit unexpected managed exception, exception code = '0xe0434352'. First 30KB characters of captured stdout and stderr logs:
Unhandled exception. System.Security.Cryptography.CryptographicException: The payload was invalid. For more information go to https://aka.ms/aspnet/dataprotectionwarning
   at Microsoft.AspNetCore.DataProtection.Managed.ManagedAuthenticatedEncryptor.CalculateAndValidateMac(Byte[] payloadArray, Int32 ivOffset, Int32 macOffset, Int32 eofOffset, ReadOnlySpan`1 validationSubkey, Byte[] validationSubkeyArray)
   at Microsoft.AspNetCore.DataProtection.Managed.ManagedAuthenticatedEncryptor.Decrypt(ArraySegment`1 protectedPayload, ArraySegment`1 additionalAuthenticatedData)
   at Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.AuthenticatedEncryptorExtensions.PerformSelfTest(IAuthenticatedEncryptor encryptor)
   at Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.ConfigurationModel.ManagedAuthenticatedEncryptorConfiguration.Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.ConfigurationModel.IInternalAlgorithmConfiguration.Validate()
   at Microsoft.AspNetCore.DataProtection.DataProtectionBuilderExtensions.UseCryptographicAlgorithmsCore(IDataProtectionBuilder builder, AlgorithmConfiguration configuration)

@MaceWindu

Copy link
Copy Markdown
Contributor

Nevermind, I see this was targeting 10.0.7, so probably something else broke in 10.0.6

@IanKemp

IanKemp commented Apr 16, 2026

Copy link
Copy Markdown

@MaceWindu it's looking like this may also be a fix for the break in 10.0.6, that is presumably what you're experiencing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area-dataprotection Includes: DataProtection

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ManagedAuthenticatedEncryptor is broken on NETFX

5 participants