[Breaking change]: SafeEvpPKeyHandle.DuplicateHandle up-refs the handle #42034
Labels
breaking-change
Indicates a .NET Core breaking change
in-pr
This issue will be closed (fixed) by an active pull request.
📌 seQUESTered
Identifies that an issue has been imported into Quest.
Description
With the work to enable OpenSSL providers support, a change was made to the
System.Security.Cryptography.SafeEvpPKeyHandle.DuplicateHandle
method, impacting theSystem.Security.Cryptography.ECDsaOpenSsl
andSystem.Security.Cryptography.RSAOpenSsl
constructors that have overloads withSystem.Security.Cryptography.SafeEvpPKeyHandle
causing that external modifications of the passed-in handle will also affect handle stored in the instances of those classes.Version
.NET 9 Preview 7
Previous behavior
System.Security.Cryptography.SafeEvpPKeyHandle.DuplicateHandle
created a newEVP_PKEY
instanceSafeEvpPKeyHandle.DuplicateHandle
is called by the constructors ofECDsaOpenSsl
andRSAOpenSsl
takingSafeEvpPKeyHandle
New behavior
DuplicateHandle
increments the reference count of the existingEVP_PKEY
and returns a handle to the same key, causing that external calls to OpenSSL APIs which modifyEVP_PKEY
will also affect instances of duplicatedSafeEvpPKeyHandle
which includeECDsaOpenSsl
andRSAOpenSsl
instances created from such handles.Type of breaking change
Reason for change
DuplicateHandle
simplification were also following performance improvements:Recommended action
Avoid modifications of
EVP_PKEY
passed in to .NET APIs. If modifications toEVP_PKEY
can't be avoided user should create a copy ofEVP_PKEY
on their own (i.e. copy parameters into the newEVP_PKEY
instance).Feature area
Cryptography
Affected APIs
System.Security.Cryptography.SafeEvpPKeyHandle.DuplicateHandle
DuplicateHandle
is called by following public .NET APIs making them also affected:System.Security.Cryptography.ECDsaOpenSsl..ctor(System.Security.Cryptography.SafeEvpPKeyHandle)
System.Security.Cryptography.RSAOpenSsl..ctor(System.Security.Cryptography.SafeEvpPKeyHandle)
Everything taking
RSA
orECDsa
instances originating fromSafeEvpPKeyHandle
will also be affected.Associated WorkItem - 294097
The text was updated successfully, but these errors were encountered: