Conversation
|
Azure Pipelines: Successfully started running 3 pipeline(s). 13 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
|
Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security |
Contributor
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
No unresolved blocking issues were identified.
Review tier: Lite
Findings: None
What changed in this PR
Fixes EC public-key export for OpenSSL provider-backed keys.
Changes:
- Adds a fallback using encoded public-point extraction.
- Decodes EC coordinates from exported points.
- Adds required OpenSSL shim declarations and bindings.
| File | Description |
|---|---|
src/native/libs/System.Security.Cryptography.Native/pal_ecc_import_export.c |
Implements provider-key public coordinate fallback. |
src/native/libs/System.Security.Cryptography.Native/osslcompat_30.h |
Declares required OpenSSL 3 APIs. |
src/native/libs/System.Security.Cryptography.Native/opensslshim.h |
Adds dynamic OpenSSL API bindings. |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
This was referenced Sep 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a re-implementation of the fix that was made in #133254. Due to significant changes in the OpenSSL native shim in .NET 11, backporting it to .NET 10 mostly amounts to "implement it again".
The approach is largely the same though. If the
EVP_PKEY_get_bn_paramfails forOSSL_PKEY_PARAM_EC_PUB_X/Ythen we attempt the new way. This means, at worst, we are only doing the new way in an error path./cc @vcsjones @bartonjs
Customer Impact
Customer reported in #133171. This bug prevents using ECDSA keys from OpenSSL Providers such as the PKCS#11 Provider. The bug affected exporting public keys, which produced an error. Other APIs like
X509Certificate2.CopyWithPrivateKey(ECDsa)depend on public key exportably.Regression
Testing
This fix was verified on a local development machine using the customer reported reproduction case. The customer's sample clearly demonstrated the error and desired results. The nature of OpenSSL providers make writing new tests difficult. There is substantial test coverage for existing non-custom providers ensuring those scenarios continue to work for ECDSA.
Risk
Low. The fix is to attempt processing the key a different way in an existing error path. The worst case scenario is we produce an error in a path that was previously guaranteed to produce an error.