Skip to content

[release/10.0]: Fix EC public key export for provider keys - #133956

Open
vcsjones wants to merge 1 commit into
dotnet:release/10.0from
vcsjones:ossl-provider-export-fix-release-10.0
Open

vcsjones wants to merge 1 commit into
dotnet:release/10.0from
vcsjones:ossl-provider-export-fix-release-10.0

Conversation

@vcsjones

Copy link
Copy Markdown
Member

This is a re-implementation of the fix that was made in #133254. Due to significant changes in the OpenSSL native shim in .NET 11, backporting it to .NET 10 mostly amounts to "implement it again".

The approach is largely the same though. If the EVP_PKEY_get_bn_param fails for OSSL_PKEY_PARAM_EC_PUB_X/Y then we attempt the new way. This means, at worst, we are only doing the new way in an error path.

/cc @vcsjones @bartonjs

Customer Impact

  • Customer reported
  • Found internally

Customer reported in #133171. This bug prevents using ECDSA keys from OpenSSL Providers such as the PKCS#11 Provider. The bug affected exporting public keys, which produced an error. Other APIs like X509Certificate2.CopyWithPrivateKey(ECDsa) depend on public key exportably.

Regression

  • Yes
  • No

Testing

This fix was verified on a local development machine using the customer reported reproduction case. The customer's sample clearly demonstrated the error and desired results. The nature of OpenSSL providers make writing new tests difficult. There is substantial test coverage for existing non-custom providers ensuring those scenarios continue to work for ECDSA.

Risk

Low. The fix is to attempt processing the key a different way in an existing error path. The worst case scenario is we produce an error in a path that was previously guaranteed to produce an error.

@vcsjones vcsjones added this to the 10.0.x milestone Sep 15, 2026
@vcsjones
vcsjones requested a review from bartonjs September 15, 2026 15:15
@vcsjones vcsjones self-assigned this Sep 15, 2026
Copilot AI lite review requested due to automatic review settings September 15, 2026 15:15
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

@dotnet-policy-service

Copy link
Copy Markdown
Contributor

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

No unresolved blocking issues were identified.

Review tier: Lite
Findings: None

What changed in this PR

Fixes EC public-key export for OpenSSL provider-backed keys.

Changes:

  • Adds a fallback using encoded public-point extraction.
  • Decodes EC coordinates from exported points.
  • Adds required OpenSSL shim declarations and bindings.
File Description
src/​native/​libs/​System.Security.Cryptography.Native/​pal_ecc_import_export.c Implements provider-key public coordinate fallback.
src/​native/​libs/​System.Security.Cryptography.Native/​osslcompat_30.h Declares required OpenSSL 3 APIs.
src/​native/​libs/​System.Security.Cryptography.Native/​opensslshim.h Adds dynamic OpenSSL API bindings.

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants