Improve DSA digest handling on macOS#35712

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
vcsjones wants to merge 4 commits into from
Closed

Improve DSA digest handling on macOS #35712

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
db6c106
Improve DSA digest handling on macOS
vcsjones May 1, 2020
6d61a70
Fix build.
vcsjones May 1, 2020
4d8b2a0
Fix exception message; Linux appears capable of FIPS-186-3.
vcsjones May 1, 2020
3a7b190
Move hash size check for Unix DSA CSP
vcsjones May 1, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion src/libraries/Common/src/System/Security/Cryptography/DSASecurityTransforms.cs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -261,9 +261,16 @@ public override unsafe void ImportSubjectPublicKeyInfo(

public override byte[] CreateSignature(byte[] rgbHash)
{
const int Sha1DigestSizeBytes = 20;

if (rgbHash == null)
throw new ArgumentNullException(nameof(rgbHash));

// MacOS only supports FIPS-186-2, which only defines SHA1
// as a supported algorithm.
if (rgbHash.Length != Sha1DigestSizeBytes)
Comment thread
vcsjones marked this conversation as resolved.
throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", Sha1DigestSizeBytes));

SecKeyPair keys = GetKeys();

if (keys.PrivateKey == null)
Expand All@@ -277,7 +284,7 @@ public override byte[] CreateSignature(byte[] rgbHash)
// are always 160 bits / 20 bytes (the size of SHA-1, and the only legal length for Q).
byte[] ieeeFormatSignature = AsymmetricAlgorithmHelpers.ConvertDerToIeee1363(
derFormatSignature.AsSpan(0, derFormatSignature.Length),
fieldSizeBits: 160);
fieldSizeBits: Sha1DigestSizeBytes * 8);

return ieeeFormatSignature;
}
Expand Down
20 changes: 20 additions & 0 deletions ...s/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSASignVerify.cs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -374,6 +374,25 @@ public void Verify2048WithSha1()
}
}

[ConditionalTheory(nameof(DoesNotSupportFips186_3))]
[InlineData(128)]
[InlineData(256)]
[InlineData(384)]
[InlineData(512)]
public void SignHash_DigestAlgorithmUnsupported(int hashSizeBits)
{
byte[] hash = new byte[hashSizeBits / 8];
RandomNumberGenerator.Fill(hash);

using (DSA dsa = DSAFactory.Create())
{
DSATestData.GetDSA1024_186_2(out DSAParameters parameters, out _, out _);
dsa.ImportParameters(parameters);
CryptographicException ce = Assert.Throws<CryptographicException>(() => dsa.CreateSignature(hash));
Assert.Equal("SHA1 algorithm hash size is 20 bytes.", ce.Message);
}
}

private void SignAndVerify(byte[] data, string hashAlgorithmName, DSAParameters dsaParameters, int expectedSignatureLength)
{
using (DSA dsa = DSAFactory.Create())
Expand All@@ -394,5 +413,6 @@ internal static bool SupportsFips186_3
}
}
public static bool SupportsKeyGeneration => DSAFactory.SupportsKeyGeneration;
public static bool DoesNotSupportFips186_3 => !SupportsFips186_3;
}
}
3 changes: 3 additions & 0 deletions src/libraries/System.Security.Cryptography.Algorithms/src/Resources/Strings.resx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -162,6 +162,9 @@
<data name="Cryptography_HashAlgorithmNameNullOrEmpty" xml:space="preserve">
<value>The hash algorithm name cannot be null or empty.</value>
</data>
<data name="Cryptography_InvalidHashSize" xml:space="preserve">
<value>{0} algorithm hash size is {1} bytes.</value>
</data>
<data name="Cryptography_InvalidOID" xml:space="preserve">
<value>Object identifier (OID) is unknown.</value>
</data>
Expand Down
13 changes: 10 additions & 3 deletions ...curity.Cryptography.Csp/src/System/Security/Cryptography/DSACryptoServiceProvider.Unix.cs
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -49,7 +49,16 @@ public DSACryptoServiceProvider(CspParameters parameters)
}

[System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Security", "CA5351", Justification = "This is the implementation of DSACryptoServiceProvider")]
public override byte[] CreateSignature(byte[] rgbHash) => _impl.CreateSignature(rgbHash);
public override byte[] CreateSignature(byte[] rgbHash)
{
if (rgbHash == null)
throw new ArgumentNullException(nameof(rgbHash));

if (rgbHash.Length != SHA1_HASHSIZE)

@vcsjonesvcsjonesMay 1, 2020

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also a breaking change; but it makes DSACryptoServiceProvider consistent across all platforms.

throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", SHA1_HASHSIZE));

return _impl.CreateSignature(rgbHash);
}

public override bool TryCreateSignature(ReadOnlySpan<byte> hash, Span<byte> destination, out int bytesWritten) =>
_impl.TryCreateSignature(hash, destination, out bytesWritten);
Expand DownExpand Up@@ -212,8 +221,6 @@ public byte[] SignHash(byte[] rgbHash, string str)
throw new ArgumentNullException(nameof(rgbHash));
if (PublicOnly)
throw new CryptographicException(SR.Cryptography_CSP_NoPrivateKey);
if (rgbHash.Length != SHA1_HASHSIZE)
throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", SHA1_HASHSIZE));

// Only SHA1 allowed; the default value is SHA1
if (str != null && !string.Equals(str, "SHA1", StringComparison.OrdinalIgnoreCase))
Expand Down
5 changes: 4 additions & 1 deletion src/libraries/System.Security.Cryptography.X509Certificates/src/Resources/Strings.resx
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -74,7 +74,7 @@
</data>
<data name="Arg_InvalidType" xml:space="preserve">
<value>Invalid type.</value>
</data>
</data>
<data name="Arg_OutOfRange_NeedNonNegNum" xml:space="preserve">
<value>Non-negative number required.</value>
</data>
Expand DownExpand Up@@ -345,6 +345,9 @@
<data name="Cryptography_X509Store_WouldModifyAdminTrust" xml:space="preserve">
<value>Removing the requested certificate would modify admin trust settings, and has been denied.</value>
</data>
<data name="Cryptography_InvalidHashSize" xml:space="preserve">
<value>{0} algorithm hash size is {1} bytes.</value>
</data>
<data name="Cryptography_InvalidKeySize" xml:space="preserve">
<value>Specified key is not a valid size for this algorithm.</value>
</data>
Expand Down
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Improve DSA digest handling on macOS#35712

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

vcsjones
wants to merge
4
commits into

from

 Closed


Improve DSA digest handling on macOS
#35712
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


4 commits


Select commit
Hold shift + click to select a range
db6c106

Improve DSA digest handling on macOS


vcsjones May 1, 2020
6d61a70

Fix build.


vcsjones May 1, 2020
4d8b2a0

Fix exception message; Linux appears capable of FIPS-186-3.


vcsjones May 1, 2020
3a7b190

Move hash size check for Unix DSA CSP


vcsjones May 1, 2020

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


9 changes: 8 additions & 1 deletion
src/libraries/Common/src/System/Security/Cryptography/DSASecurityTransforms.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -261,9 +261,16 @@ public override unsafe void ImportSubjectPublicKeyInfo(

 public override byte[] CreateSignature(byte[] rgbHash)
 {
 const int Sha1DigestSizeBytes = 20;

 if (rgbHash == null)
 throw new ArgumentNullException(nameof(rgbHash));

 // MacOS only supports FIPS-186-2, which only defines SHA1
 // as a supported algorithm.
 if (rgbHash.Length != Sha1DigestSizeBytes)
Comment thread
vcsjones marked this conversation as resolved.

 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", Sha1DigestSizeBytes));

 SecKeyPair keys = GetKeys();

 if (keys.PrivateKey == null)
Expand All@@ -277,7 +284,7 @@ public override byte[] CreateSignature(byte[] rgbHash)
 // are always 160 bits / 20 bytes (the size of SHA-1, and the only legal length for Q).
 byte[] ieeeFormatSignature = AsymmetricAlgorithmHelpers.ConvertDerToIeee1363(
 derFormatSignature.AsSpan(0, derFormatSignature.Length),
 fieldSizeBits: 160);
 fieldSizeBits: Sha1DigestSizeBytes * 8);

 return ieeeFormatSignature;
 }
Expand Down

20 changes: 20 additions & 0 deletions
...s/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSASignVerify.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -374,6 +374,25 @@ public void Verify2048WithSha1()
 }
 }

 [ConditionalTheory(nameof(DoesNotSupportFips186_3))]
 [InlineData(128)]
 [InlineData(256)]
 [InlineData(384)]
 [InlineData(512)]
 public void SignHash_DigestAlgorithmUnsupported(int hashSizeBits)
 {
 byte[] hash = new byte[hashSizeBits / 8];
 RandomNumberGenerator.Fill(hash);

 using (DSA dsa = DSAFactory.Create())
 {
 DSATestData.GetDSA1024_186_2(out DSAParameters parameters, out _, out _);
 dsa.ImportParameters(parameters);
 CryptographicException ce = Assert.Throws<CryptographicException>(() => dsa.CreateSignature(hash));
 Assert.Equal("SHA1 algorithm hash size is 20 bytes.", ce.Message);
 }
 }

 private void SignAndVerify(byte[] data, string hashAlgorithmName, DSAParameters dsaParameters, int expectedSignatureLength)
 {
 using (DSA dsa = DSAFactory.Create())
Expand All@@ -394,5 +413,6 @@ internal static bool SupportsFips186_3
 }
 }
 public static bool SupportsKeyGeneration => DSAFactory.SupportsKeyGeneration;
 public static bool DoesNotSupportFips186_3 => !SupportsFips186_3;
 }
}

3 changes: 3 additions & 0 deletions
src/libraries/System.Security.Cryptography.Algorithms/src/Resources/Strings.resx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -162,6 +162,9 @@
 <data name="Cryptography_HashAlgorithmNameNullOrEmpty" xml:space="preserve">
 <value>The hash algorithm name cannot be null or empty.</value>
 </data>
 <data name="Cryptography_InvalidHashSize" xml:space="preserve">
 <value>{0} algorithm hash size is {1} bytes.</value>
 </data>
 <data name="Cryptography_InvalidOID" xml:space="preserve">
 <value>Object identifier (OID) is unknown.</value>
 </data>
Expand Down

13 changes: 10 additions & 3 deletions
...curity.Cryptography.Csp/src/System/Security/Cryptography/DSACryptoServiceProvider.Unix.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -49,7 +49,16 @@ public DSACryptoServiceProvider(CspParameters parameters)
 }

 [System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Security", "CA5351", Justification = "This is the implementation of DSACryptoServiceProvider")]
 public override byte[] CreateSignature(byte[] rgbHash) => _impl.CreateSignature(rgbHash);
 public override byte[] CreateSignature(byte[] rgbHash)
 {
 if (rgbHash == null)
 throw new ArgumentNullException(nameof(rgbHash));

 if (rgbHash.Length != SHA1_HASHSIZE)
@vcsjonesvcsjonesMay 1, 2020

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also a breaking change; but it makes DSACryptoServiceProvider consistent across all platforms.
 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", SHA1_HASHSIZE));

 return _impl.CreateSignature(rgbHash);
 }

 public override bool TryCreateSignature(ReadOnlySpan<byte> hash, Span<byte> destination, out int bytesWritten) =>
 _impl.TryCreateSignature(hash, destination, out bytesWritten);
Expand DownExpand Up@@ -212,8 +221,6 @@ public byte[] SignHash(byte[] rgbHash, string str)
 throw new ArgumentNullException(nameof(rgbHash));
 if (PublicOnly)
 throw new CryptographicException(SR.Cryptography_CSP_NoPrivateKey);
 if (rgbHash.Length != SHA1_HASHSIZE)
 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", SHA1_HASHSIZE));

 // Only SHA1 allowed; the default value is SHA1
 if (str != null && !string.Equals(str, "SHA1", StringComparison.OrdinalIgnoreCase))
Expand Down

5 changes: 4 additions & 1 deletion
src/libraries/System.Security.Cryptography.X509Certificates/src/Resources/Strings.resx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -74,7 +74,7 @@
 </data>
 <data name="Arg_InvalidType" xml:space="preserve">
 <value>Invalid type.</value>
 </data>
 </data>
 <data name="Arg_OutOfRange_NeedNonNegNum" xml:space="preserve">
 <value>Non-negative number required.</value>
 </data>
Expand DownExpand Up@@ -345,6 +345,9 @@
 <data name="Cryptography_X509Store_WouldModifyAdminTrust" xml:space="preserve">
 <value>Removing the requested certificate would modify admin trust settings, and has been denied.</value>
 </data>
 <data name="Cryptography_InvalidHashSize" xml:space="preserve">
 <value>{0} algorithm hash size is {1} bytes.</value>
 </data>
 <data name="Cryptography_InvalidKeySize" xml:space="preserve">
 <value>Specified key is not a valid size for this algorithm.</value>
 </data>
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Improve DSA digest handling on macOS#35712

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

vcsjones
wants to merge
4
commits into

from

 Closed


Improve DSA digest handling on macOS
#35712
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


4 commits


Select commit
Hold shift + click to select a range
db6c106

Improve DSA digest handling on macOS


vcsjones May 1, 2020
6d61a70

Fix build.


vcsjones May 1, 2020
4d8b2a0

Fix exception message; Linux appears capable of FIPS-186-3.


vcsjones May 1, 2020
3a7b190

Move hash size check for Unix DSA CSP


vcsjones May 1, 2020

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


9 changes: 8 additions & 1 deletion
src/libraries/Common/src/System/Security/Cryptography/DSASecurityTransforms.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -261,9 +261,16 @@ public override unsafe void ImportSubjectPublicKeyInfo(

 public override byte[] CreateSignature(byte[] rgbHash)
 {
 const int Sha1DigestSizeBytes = 20;

 if (rgbHash == null)
 throw new ArgumentNullException(nameof(rgbHash));

 // MacOS only supports FIPS-186-2, which only defines SHA1
 // as a supported algorithm.
 if (rgbHash.Length != Sha1DigestSizeBytes)
Comment thread
vcsjones marked this conversation as resolved.

 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", Sha1DigestSizeBytes));

 SecKeyPair keys = GetKeys();

 if (keys.PrivateKey == null)
Expand All@@ -277,7 +284,7 @@ public override byte[] CreateSignature(byte[] rgbHash)
 // are always 160 bits / 20 bytes (the size of SHA-1, and the only legal length for Q).
 byte[] ieeeFormatSignature = AsymmetricAlgorithmHelpers.ConvertDerToIeee1363(
 derFormatSignature.AsSpan(0, derFormatSignature.Length),
 fieldSizeBits: 160);
 fieldSizeBits: Sha1DigestSizeBytes * 8);

 return ieeeFormatSignature;
 }
Expand Down

20 changes: 20 additions & 0 deletions
...s/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSASignVerify.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -374,6 +374,25 @@ public void Verify2048WithSha1()
 }
 }

 [ConditionalTheory(nameof(DoesNotSupportFips186_3))]
 [InlineData(128)]
 [InlineData(256)]
 [InlineData(384)]
 [InlineData(512)]
 public void SignHash_DigestAlgorithmUnsupported(int hashSizeBits)
 {
 byte[] hash = new byte[hashSizeBits / 8];
 RandomNumberGenerator.Fill(hash);

 using (DSA dsa = DSAFactory.Create())
 {
 DSATestData.GetDSA1024_186_2(out DSAParameters parameters, out _, out _);
 dsa.ImportParameters(parameters);
 CryptographicException ce = Assert.Throws<CryptographicException>(() => dsa.CreateSignature(hash));
 Assert.Equal("SHA1 algorithm hash size is 20 bytes.", ce.Message);
 }
 }

 private void SignAndVerify(byte[] data, string hashAlgorithmName, DSAParameters dsaParameters, int expectedSignatureLength)
 {
 using (DSA dsa = DSAFactory.Create())
Expand All@@ -394,5 +413,6 @@ internal static bool SupportsFips186_3
 }
 }
 public static bool SupportsKeyGeneration => DSAFactory.SupportsKeyGeneration;
 public static bool DoesNotSupportFips186_3 => !SupportsFips186_3;
 }
}

3 changes: 3 additions & 0 deletions
src/libraries/System.Security.Cryptography.Algorithms/src/Resources/Strings.resx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -162,6 +162,9 @@
 <data name="Cryptography_HashAlgorithmNameNullOrEmpty" xml:space="preserve">
 <value>The hash algorithm name cannot be null or empty.</value>
 </data>
 <data name="Cryptography_InvalidHashSize" xml:space="preserve">
 <value>{0} algorithm hash size is {1} bytes.</value>
 </data>
 <data name="Cryptography_InvalidOID" xml:space="preserve">
 <value>Object identifier (OID) is unknown.</value>
 </data>
Expand Down

13 changes: 10 additions & 3 deletions
...curity.Cryptography.Csp/src/System/Security/Cryptography/DSACryptoServiceProvider.Unix.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -49,7 +49,16 @@ public DSACryptoServiceProvider(CspParameters parameters)
 }

 [System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Security", "CA5351", Justification = "This is the implementation of DSACryptoServiceProvider")]
 public override byte[] CreateSignature(byte[] rgbHash) => _impl.CreateSignature(rgbHash);
 public override byte[] CreateSignature(byte[] rgbHash)
 {
 if (rgbHash == null)
 throw new ArgumentNullException(nameof(rgbHash));

 if (rgbHash.Length != SHA1_HASHSIZE)
@vcsjonesvcsjonesMay 1, 2020

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also a breaking change; but it makes DSACryptoServiceProvider consistent across all platforms.
 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", SHA1_HASHSIZE));

 return _impl.CreateSignature(rgbHash);
 }

 public override bool TryCreateSignature(ReadOnlySpan<byte> hash, Span<byte> destination, out int bytesWritten) =>
 _impl.TryCreateSignature(hash, destination, out bytesWritten);
Expand DownExpand Up@@ -212,8 +221,6 @@ public byte[] SignHash(byte[] rgbHash, string str)
 throw new ArgumentNullException(nameof(rgbHash));
 if (PublicOnly)
 throw new CryptographicException(SR.Cryptography_CSP_NoPrivateKey);
 if (rgbHash.Length != SHA1_HASHSIZE)
 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", SHA1_HASHSIZE));

 // Only SHA1 allowed; the default value is SHA1
 if (str != null && !string.Equals(str, "SHA1", StringComparison.OrdinalIgnoreCase))
Expand Down

5 changes: 4 additions & 1 deletion
src/libraries/System.Security.Cryptography.X509Certificates/src/Resources/Strings.resx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -74,7 +74,7 @@
 </data>
 <data name="Arg_InvalidType" xml:space="preserve">
 <value>Invalid type.</value>
 </data>
 </data>
 <data name="Arg_OutOfRange_NeedNonNegNum" xml:space="preserve">
 <value>Non-negative number required.</value>
 </data>
Expand DownExpand Up@@ -345,6 +345,9 @@
 <data name="Cryptography_X509Store_WouldModifyAdminTrust" xml:space="preserve">
 <value>Removing the requested certificate would modify admin trust settings, and has been denied.</value>
 </data>
 <data name="Cryptography_InvalidHashSize" xml:space="preserve">
 <value>{0} algorithm hash size is {1} bytes.</value>
 </data>
 <data name="Cryptography_InvalidKeySize" xml:space="preserve">
 <value>Specified key is not a valid size for this algorithm.</value>
 </data>
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Improve DSA digest handling on macOS#35712

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

vcsjones
wants to merge
4
commits into

from

 Closed


Improve DSA digest handling on macOS
#35712
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


4 commits


Select commit
Hold shift + click to select a range
db6c106

Improve DSA digest handling on macOS


vcsjones May 1, 2020
6d61a70

Fix build.


vcsjones May 1, 2020
4d8b2a0

Fix exception message; Linux appears capable of FIPS-186-3.


vcsjones May 1, 2020
3a7b190

Move hash size check for Unix DSA CSP


vcsjones May 1, 2020

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


9 changes: 8 additions & 1 deletion
src/libraries/Common/src/System/Security/Cryptography/DSASecurityTransforms.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -261,9 +261,16 @@ public override unsafe void ImportSubjectPublicKeyInfo(

 public override byte[] CreateSignature(byte[] rgbHash)
 {
 const int Sha1DigestSizeBytes = 20;

 if (rgbHash == null)
 throw new ArgumentNullException(nameof(rgbHash));

 // MacOS only supports FIPS-186-2, which only defines SHA1
 // as a supported algorithm.
 if (rgbHash.Length != Sha1DigestSizeBytes)
Comment thread
vcsjones marked this conversation as resolved.

 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", Sha1DigestSizeBytes));

 SecKeyPair keys = GetKeys();

 if (keys.PrivateKey == null)
Expand All@@ -277,7 +284,7 @@ public override byte[] CreateSignature(byte[] rgbHash)
 // are always 160 bits / 20 bytes (the size of SHA-1, and the only legal length for Q).
 byte[] ieeeFormatSignature = AsymmetricAlgorithmHelpers.ConvertDerToIeee1363(
 derFormatSignature.AsSpan(0, derFormatSignature.Length),
 fieldSizeBits: 160);
 fieldSizeBits: Sha1DigestSizeBytes * 8);

 return ieeeFormatSignature;
 }
Expand Down

20 changes: 20 additions & 0 deletions
...s/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSASignVerify.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -374,6 +374,25 @@ public void Verify2048WithSha1()
 }
 }

 [ConditionalTheory(nameof(DoesNotSupportFips186_3))]
 [InlineData(128)]
 [InlineData(256)]
 [InlineData(384)]
 [InlineData(512)]
 public void SignHash_DigestAlgorithmUnsupported(int hashSizeBits)
 {
 byte[] hash = new byte[hashSizeBits / 8];
 RandomNumberGenerator.Fill(hash);

 using (DSA dsa = DSAFactory.Create())
 {
 DSATestData.GetDSA1024_186_2(out DSAParameters parameters, out _, out _);
 dsa.ImportParameters(parameters);
 CryptographicException ce = Assert.Throws<CryptographicException>(() => dsa.CreateSignature(hash));
 Assert.Equal("SHA1 algorithm hash size is 20 bytes.", ce.Message);
 }
 }

 private void SignAndVerify(byte[] data, string hashAlgorithmName, DSAParameters dsaParameters, int expectedSignatureLength)
 {
 using (DSA dsa = DSAFactory.Create())
Expand All@@ -394,5 +413,6 @@ internal static bool SupportsFips186_3
 }
 }
 public static bool SupportsKeyGeneration => DSAFactory.SupportsKeyGeneration;
 public static bool DoesNotSupportFips186_3 => !SupportsFips186_3;
 }
}

3 changes: 3 additions & 0 deletions
src/libraries/System.Security.Cryptography.Algorithms/src/Resources/Strings.resx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -162,6 +162,9 @@
 <data name="Cryptography_HashAlgorithmNameNullOrEmpty" xml:space="preserve">
 <value>The hash algorithm name cannot be null or empty.</value>
 </data>
 <data name="Cryptography_InvalidHashSize" xml:space="preserve">
 <value>{0} algorithm hash size is {1} bytes.</value>
 </data>
 <data name="Cryptography_InvalidOID" xml:space="preserve">
 <value>Object identifier (OID) is unknown.</value>
 </data>
Expand Down

13 changes: 10 additions & 3 deletions
...curity.Cryptography.Csp/src/System/Security/Cryptography/DSACryptoServiceProvider.Unix.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -49,7 +49,16 @@ public DSACryptoServiceProvider(CspParameters parameters)
 }

 [System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Security", "CA5351", Justification = "This is the implementation of DSACryptoServiceProvider")]
 public override byte[] CreateSignature(byte[] rgbHash) => _impl.CreateSignature(rgbHash);
 public override byte[] CreateSignature(byte[] rgbHash)
 {
 if (rgbHash == null)
 throw new ArgumentNullException(nameof(rgbHash));

 if (rgbHash.Length != SHA1_HASHSIZE)
@vcsjonesvcsjonesMay 1, 2020

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also a breaking change; but it makes DSACryptoServiceProvider consistent across all platforms.
 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", SHA1_HASHSIZE));

 return _impl.CreateSignature(rgbHash);
 }

 public override bool TryCreateSignature(ReadOnlySpan<byte> hash, Span<byte> destination, out int bytesWritten) =>
 _impl.TryCreateSignature(hash, destination, out bytesWritten);
Expand DownExpand Up@@ -212,8 +221,6 @@ public byte[] SignHash(byte[] rgbHash, string str)
 throw new ArgumentNullException(nameof(rgbHash));
 if (PublicOnly)
 throw new CryptographicException(SR.Cryptography_CSP_NoPrivateKey);
 if (rgbHash.Length != SHA1_HASHSIZE)
 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", SHA1_HASHSIZE));

 // Only SHA1 allowed; the default value is SHA1
 if (str != null && !string.Equals(str, "SHA1", StringComparison.OrdinalIgnoreCase))
Expand Down

5 changes: 4 additions & 1 deletion
src/libraries/System.Security.Cryptography.X509Certificates/src/Resources/Strings.resx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -74,7 +74,7 @@
 </data>
 <data name="Arg_InvalidType" xml:space="preserve">
 <value>Invalid type.</value>
 </data>
 </data>
 <data name="Arg_OutOfRange_NeedNonNegNum" xml:space="preserve">
 <value>Non-negative number required.</value>
 </data>
Expand DownExpand Up@@ -345,6 +345,9 @@
 <data name="Cryptography_X509Store_WouldModifyAdminTrust" xml:space="preserve">
 <value>Removing the requested certificate would modify admin trust settings, and has been denied.</value>
 </data>
 <data name="Cryptography_InvalidHashSize" xml:space="preserve">
 <value>{0} algorithm hash size is {1} bytes.</value>
 </data>
 <data name="Cryptography_InvalidKeySize" xml:space="preserve">
 <value>Specified key is not a valid size for this algorithm.</value>
 </data>
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Improve DSA digest handling on macOS#35712

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

vcsjones
wants to merge
4
commits into

from

 Closed


Improve DSA digest handling on macOS
#35712
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


4 commits


Select commit
Hold shift + click to select a range
db6c106

Improve DSA digest handling on macOS


vcsjones May 1, 2020
6d61a70

Fix build.


vcsjones May 1, 2020
4d8b2a0

Fix exception message; Linux appears capable of FIPS-186-3.


vcsjones May 1, 2020
3a7b190

Move hash size check for Unix DSA CSP


vcsjones May 1, 2020

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


9 changes: 8 additions & 1 deletion
src/libraries/Common/src/System/Security/Cryptography/DSASecurityTransforms.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -261,9 +261,16 @@ public override unsafe void ImportSubjectPublicKeyInfo(

 public override byte[] CreateSignature(byte[] rgbHash)
 {
 const int Sha1DigestSizeBytes = 20;

 if (rgbHash == null)
 throw new ArgumentNullException(nameof(rgbHash));

 // MacOS only supports FIPS-186-2, which only defines SHA1
 // as a supported algorithm.
 if (rgbHash.Length != Sha1DigestSizeBytes)
Comment thread
vcsjones marked this conversation as resolved.

 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", Sha1DigestSizeBytes));

 SecKeyPair keys = GetKeys();

 if (keys.PrivateKey == null)
Expand All@@ -277,7 +284,7 @@ public override byte[] CreateSignature(byte[] rgbHash)
 // are always 160 bits / 20 bytes (the size of SHA-1, and the only legal length for Q).
 byte[] ieeeFormatSignature = AsymmetricAlgorithmHelpers.ConvertDerToIeee1363(
 derFormatSignature.AsSpan(0, derFormatSignature.Length),
 fieldSizeBits: 160);
 fieldSizeBits: Sha1DigestSizeBytes * 8);

 return ieeeFormatSignature;
 }
Expand Down

20 changes: 20 additions & 0 deletions
...s/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSASignVerify.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -374,6 +374,25 @@ public void Verify2048WithSha1()
 }
 }

 [ConditionalTheory(nameof(DoesNotSupportFips186_3))]
 [InlineData(128)]
 [InlineData(256)]
 [InlineData(384)]
 [InlineData(512)]
 public void SignHash_DigestAlgorithmUnsupported(int hashSizeBits)
 {
 byte[] hash = new byte[hashSizeBits / 8];
 RandomNumberGenerator.Fill(hash);

 using (DSA dsa = DSAFactory.Create())
 {
 DSATestData.GetDSA1024_186_2(out DSAParameters parameters, out _, out _);
 dsa.ImportParameters(parameters);
 CryptographicException ce = Assert.Throws<CryptographicException>(() => dsa.CreateSignature(hash));
 Assert.Equal("SHA1 algorithm hash size is 20 bytes.", ce.Message);
 }
 }

 private void SignAndVerify(byte[] data, string hashAlgorithmName, DSAParameters dsaParameters, int expectedSignatureLength)
 {
 using (DSA dsa = DSAFactory.Create())
Expand All@@ -394,5 +413,6 @@ internal static bool SupportsFips186_3
 }
 }
 public static bool SupportsKeyGeneration => DSAFactory.SupportsKeyGeneration;
 public static bool DoesNotSupportFips186_3 => !SupportsFips186_3;
 }
}

3 changes: 3 additions & 0 deletions
src/libraries/System.Security.Cryptography.Algorithms/src/Resources/Strings.resx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -162,6 +162,9 @@
 <data name="Cryptography_HashAlgorithmNameNullOrEmpty" xml:space="preserve">
 <value>The hash algorithm name cannot be null or empty.</value>
 </data>
 <data name="Cryptography_InvalidHashSize" xml:space="preserve">
 <value>{0} algorithm hash size is {1} bytes.</value>
 </data>
 <data name="Cryptography_InvalidOID" xml:space="preserve">
 <value>Object identifier (OID) is unknown.</value>
 </data>
Expand Down

13 changes: 10 additions & 3 deletions
...curity.Cryptography.Csp/src/System/Security/Cryptography/DSACryptoServiceProvider.Unix.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -49,7 +49,16 @@ public DSACryptoServiceProvider(CspParameters parameters)
 }

 [System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Security", "CA5351", Justification = "This is the implementation of DSACryptoServiceProvider")]
 public override byte[] CreateSignature(byte[] rgbHash) => _impl.CreateSignature(rgbHash);
 public override byte[] CreateSignature(byte[] rgbHash)
 {
 if (rgbHash == null)
 throw new ArgumentNullException(nameof(rgbHash));

 if (rgbHash.Length != SHA1_HASHSIZE)
@vcsjonesvcsjonesMay 1, 2020

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also a breaking change; but it makes DSACryptoServiceProvider consistent across all platforms.
 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", SHA1_HASHSIZE));

 return _impl.CreateSignature(rgbHash);
 }

 public override bool TryCreateSignature(ReadOnlySpan<byte> hash, Span<byte> destination, out int bytesWritten) =>
 _impl.TryCreateSignature(hash, destination, out bytesWritten);
Expand DownExpand Up@@ -212,8 +221,6 @@ public byte[] SignHash(byte[] rgbHash, string str)
 throw new ArgumentNullException(nameof(rgbHash));
 if (PublicOnly)
 throw new CryptographicException(SR.Cryptography_CSP_NoPrivateKey);
 if (rgbHash.Length != SHA1_HASHSIZE)
 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", SHA1_HASHSIZE));

 // Only SHA1 allowed; the default value is SHA1
 if (str != null && !string.Equals(str, "SHA1", StringComparison.OrdinalIgnoreCase))
Expand Down

5 changes: 4 additions & 1 deletion
src/libraries/System.Security.Cryptography.X509Certificates/src/Resources/Strings.resx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -74,7 +74,7 @@
 </data>
 <data name="Arg_InvalidType" xml:space="preserve">
 <value>Invalid type.</value>
 </data>
 </data>
 <data name="Arg_OutOfRange_NeedNonNegNum" xml:space="preserve">
 <value>Non-negative number required.</value>
 </data>
Expand DownExpand Up@@ -345,6 +345,9 @@
 <data name="Cryptography_X509Store_WouldModifyAdminTrust" xml:space="preserve">
 <value>Removing the requested certificate would modify admin trust settings, and has been denied.</value>
 </data>
 <data name="Cryptography_InvalidHashSize" xml:space="preserve">
 <value>{0} algorithm hash size is {1} bytes.</value>
 </data>
 <data name="Cryptography_InvalidKeySize" xml:space="preserve">
 <value>Specified key is not a valid size for this algorithm.</value>
 </data>
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Improve DSA digest handling on macOS#35712

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

vcsjones
wants to merge
4
commits into

from

 Closed


Improve DSA digest handling on macOS
#35712
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


4 commits


Select commit
Hold shift + click to select a range
db6c106

Improve DSA digest handling on macOS


vcsjones May 1, 2020
6d61a70

Fix build.


vcsjones May 1, 2020
4d8b2a0

Fix exception message; Linux appears capable of FIPS-186-3.


vcsjones May 1, 2020
3a7b190

Move hash size check for Unix DSA CSP


vcsjones May 1, 2020

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


9 changes: 8 additions & 1 deletion
src/libraries/Common/src/System/Security/Cryptography/DSASecurityTransforms.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -261,9 +261,16 @@ public override unsafe void ImportSubjectPublicKeyInfo(

 public override byte[] CreateSignature(byte[] rgbHash)
 {
 const int Sha1DigestSizeBytes = 20;

 if (rgbHash == null)
 throw new ArgumentNullException(nameof(rgbHash));

 // MacOS only supports FIPS-186-2, which only defines SHA1
 // as a supported algorithm.
 if (rgbHash.Length != Sha1DigestSizeBytes)
Comment thread
vcsjones marked this conversation as resolved.

 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", Sha1DigestSizeBytes));

 SecKeyPair keys = GetKeys();

 if (keys.PrivateKey == null)
Expand All@@ -277,7 +284,7 @@ public override byte[] CreateSignature(byte[] rgbHash)
 // are always 160 bits / 20 bytes (the size of SHA-1, and the only legal length for Q).
 byte[] ieeeFormatSignature = AsymmetricAlgorithmHelpers.ConvertDerToIeee1363(
 derFormatSignature.AsSpan(0, derFormatSignature.Length),
 fieldSizeBits: 160);
 fieldSizeBits: Sha1DigestSizeBytes * 8);

 return ieeeFormatSignature;
 }
Expand Down

20 changes: 20 additions & 0 deletions
...s/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSASignVerify.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -374,6 +374,25 @@ public void Verify2048WithSha1()
 }
 }

 [ConditionalTheory(nameof(DoesNotSupportFips186_3))]
 [InlineData(128)]
 [InlineData(256)]
 [InlineData(384)]
 [InlineData(512)]
 public void SignHash_DigestAlgorithmUnsupported(int hashSizeBits)
 {
 byte[] hash = new byte[hashSizeBits / 8];
 RandomNumberGenerator.Fill(hash);

 using (DSA dsa = DSAFactory.Create())
 {
 DSATestData.GetDSA1024_186_2(out DSAParameters parameters, out _, out _);
 dsa.ImportParameters(parameters);
 CryptographicException ce = Assert.Throws<CryptographicException>(() => dsa.CreateSignature(hash));
 Assert.Equal("SHA1 algorithm hash size is 20 bytes.", ce.Message);
 }
 }

 private void SignAndVerify(byte[] data, string hashAlgorithmName, DSAParameters dsaParameters, int expectedSignatureLength)
 {
 using (DSA dsa = DSAFactory.Create())
Expand All@@ -394,5 +413,6 @@ internal static bool SupportsFips186_3
 }
 }
 public static bool SupportsKeyGeneration => DSAFactory.SupportsKeyGeneration;
 public static bool DoesNotSupportFips186_3 => !SupportsFips186_3;
 }
}

3 changes: 3 additions & 0 deletions
src/libraries/System.Security.Cryptography.Algorithms/src/Resources/Strings.resx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -162,6 +162,9 @@
 <data name="Cryptography_HashAlgorithmNameNullOrEmpty" xml:space="preserve">
 <value>The hash algorithm name cannot be null or empty.</value>
 </data>
 <data name="Cryptography_InvalidHashSize" xml:space="preserve">
 <value>{0} algorithm hash size is {1} bytes.</value>
 </data>
 <data name="Cryptography_InvalidOID" xml:space="preserve">
 <value>Object identifier (OID) is unknown.</value>
 </data>
Expand Down

13 changes: 10 additions & 3 deletions
...curity.Cryptography.Csp/src/System/Security/Cryptography/DSACryptoServiceProvider.Unix.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -49,7 +49,16 @@ public DSACryptoServiceProvider(CspParameters parameters)
 }

 [System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Security", "CA5351", Justification = "This is the implementation of DSACryptoServiceProvider")]
 public override byte[] CreateSignature(byte[] rgbHash) => _impl.CreateSignature(rgbHash);
 public override byte[] CreateSignature(byte[] rgbHash)
 {
 if (rgbHash == null)
 throw new ArgumentNullException(nameof(rgbHash));

 if (rgbHash.Length != SHA1_HASHSIZE)
@vcsjonesvcsjonesMay 1, 2020

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also a breaking change; but it makes DSACryptoServiceProvider consistent across all platforms.
 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", SHA1_HASHSIZE));

 return _impl.CreateSignature(rgbHash);
 }

 public override bool TryCreateSignature(ReadOnlySpan<byte> hash, Span<byte> destination, out int bytesWritten) =>
 _impl.TryCreateSignature(hash, destination, out bytesWritten);
Expand DownExpand Up@@ -212,8 +221,6 @@ public byte[] SignHash(byte[] rgbHash, string str)
 throw new ArgumentNullException(nameof(rgbHash));
 if (PublicOnly)
 throw new CryptographicException(SR.Cryptography_CSP_NoPrivateKey);
 if (rgbHash.Length != SHA1_HASHSIZE)
 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", SHA1_HASHSIZE));

 // Only SHA1 allowed; the default value is SHA1
 if (str != null && !string.Equals(str, "SHA1", StringComparison.OrdinalIgnoreCase))
Expand Down

5 changes: 4 additions & 1 deletion
src/libraries/System.Security.Cryptography.X509Certificates/src/Resources/Strings.resx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -74,7 +74,7 @@
 </data>
 <data name="Arg_InvalidType" xml:space="preserve">
 <value>Invalid type.</value>
 </data>
 </data>
 <data name="Arg_OutOfRange_NeedNonNegNum" xml:space="preserve">
 <value>Non-negative number required.</value>
 </data>
Expand DownExpand Up@@ -345,6 +345,9 @@
 <data name="Cryptography_X509Store_WouldModifyAdminTrust" xml:space="preserve">
 <value>Removing the requested certificate would modify admin trust settings, and has been denied.</value>
 </data>
 <data name="Cryptography_InvalidHashSize" xml:space="preserve">
 <value>{0} algorithm hash size is {1} bytes.</value>
 </data>
 <data name="Cryptography_InvalidKeySize" xml:space="preserve">
 <value>Specified key is not a valid size for this algorithm.</value>
 </data>
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Improve DSA digest handling on macOS#35712

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

vcsjones
wants to merge
4
commits into

from

 Closed


Improve DSA digest handling on macOS
#35712
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


4 commits


Select commit
Hold shift + click to select a range
db6c106

Improve DSA digest handling on macOS


vcsjones May 1, 2020
6d61a70

Fix build.


vcsjones May 1, 2020
4d8b2a0

Fix exception message; Linux appears capable of FIPS-186-3.


vcsjones May 1, 2020
3a7b190

Move hash size check for Unix DSA CSP


vcsjones May 1, 2020

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


9 changes: 8 additions & 1 deletion
src/libraries/Common/src/System/Security/Cryptography/DSASecurityTransforms.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -261,9 +261,16 @@ public override unsafe void ImportSubjectPublicKeyInfo(

 public override byte[] CreateSignature(byte[] rgbHash)
 {
 const int Sha1DigestSizeBytes = 20;

 if (rgbHash == null)
 throw new ArgumentNullException(nameof(rgbHash));

 // MacOS only supports FIPS-186-2, which only defines SHA1
 // as a supported algorithm.
 if (rgbHash.Length != Sha1DigestSizeBytes)
Comment thread
vcsjones marked this conversation as resolved.

 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", Sha1DigestSizeBytes));

 SecKeyPair keys = GetKeys();

 if (keys.PrivateKey == null)
Expand All@@ -277,7 +284,7 @@ public override byte[] CreateSignature(byte[] rgbHash)
 // are always 160 bits / 20 bytes (the size of SHA-1, and the only legal length for Q).
 byte[] ieeeFormatSignature = AsymmetricAlgorithmHelpers.ConvertDerToIeee1363(
 derFormatSignature.AsSpan(0, derFormatSignature.Length),
 fieldSizeBits: 160);
 fieldSizeBits: Sha1DigestSizeBytes * 8);

 return ieeeFormatSignature;
 }
Expand Down

20 changes: 20 additions & 0 deletions
...s/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSASignVerify.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -374,6 +374,25 @@ public void Verify2048WithSha1()
 }
 }

 [ConditionalTheory(nameof(DoesNotSupportFips186_3))]
 [InlineData(128)]
 [InlineData(256)]
 [InlineData(384)]
 [InlineData(512)]
 public void SignHash_DigestAlgorithmUnsupported(int hashSizeBits)
 {
 byte[] hash = new byte[hashSizeBits / 8];
 RandomNumberGenerator.Fill(hash);

 using (DSA dsa = DSAFactory.Create())
 {
 DSATestData.GetDSA1024_186_2(out DSAParameters parameters, out _, out _);
 dsa.ImportParameters(parameters);
 CryptographicException ce = Assert.Throws<CryptographicException>(() => dsa.CreateSignature(hash));
 Assert.Equal("SHA1 algorithm hash size is 20 bytes.", ce.Message);
 }
 }

 private void SignAndVerify(byte[] data, string hashAlgorithmName, DSAParameters dsaParameters, int expectedSignatureLength)
 {
 using (DSA dsa = DSAFactory.Create())
Expand All@@ -394,5 +413,6 @@ internal static bool SupportsFips186_3
 }
 }
 public static bool SupportsKeyGeneration => DSAFactory.SupportsKeyGeneration;
 public static bool DoesNotSupportFips186_3 => !SupportsFips186_3;
 }
}

3 changes: 3 additions & 0 deletions
src/libraries/System.Security.Cryptography.Algorithms/src/Resources/Strings.resx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -162,6 +162,9 @@
 <data name="Cryptography_HashAlgorithmNameNullOrEmpty" xml:space="preserve">
 <value>The hash algorithm name cannot be null or empty.</value>
 </data>
 <data name="Cryptography_InvalidHashSize" xml:space="preserve">
 <value>{0} algorithm hash size is {1} bytes.</value>
 </data>
 <data name="Cryptography_InvalidOID" xml:space="preserve">
 <value>Object identifier (OID) is unknown.</value>
 </data>
Expand Down

13 changes: 10 additions & 3 deletions
...curity.Cryptography.Csp/src/System/Security/Cryptography/DSACryptoServiceProvider.Unix.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -49,7 +49,16 @@ public DSACryptoServiceProvider(CspParameters parameters)
 }

 [System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Security", "CA5351", Justification = "This is the implementation of DSACryptoServiceProvider")]
 public override byte[] CreateSignature(byte[] rgbHash) => _impl.CreateSignature(rgbHash);
 public override byte[] CreateSignature(byte[] rgbHash)
 {
 if (rgbHash == null)
 throw new ArgumentNullException(nameof(rgbHash));

 if (rgbHash.Length != SHA1_HASHSIZE)
@vcsjonesvcsjonesMay 1, 2020

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also a breaking change; but it makes DSACryptoServiceProvider consistent across all platforms.
 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", SHA1_HASHSIZE));

 return _impl.CreateSignature(rgbHash);
 }

 public override bool TryCreateSignature(ReadOnlySpan<byte> hash, Span<byte> destination, out int bytesWritten) =>
 _impl.TryCreateSignature(hash, destination, out bytesWritten);
Expand DownExpand Up@@ -212,8 +221,6 @@ public byte[] SignHash(byte[] rgbHash, string str)
 throw new ArgumentNullException(nameof(rgbHash));
 if (PublicOnly)
 throw new CryptographicException(SR.Cryptography_CSP_NoPrivateKey);
 if (rgbHash.Length != SHA1_HASHSIZE)
 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", SHA1_HASHSIZE));

 // Only SHA1 allowed; the default value is SHA1
 if (str != null && !string.Equals(str, "SHA1", StringComparison.OrdinalIgnoreCase))
Expand Down

5 changes: 4 additions & 1 deletion
src/libraries/System.Security.Cryptography.X509Certificates/src/Resources/Strings.resx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -74,7 +74,7 @@
 </data>
 <data name="Arg_InvalidType" xml:space="preserve">
 <value>Invalid type.</value>
 </data>
 </data>
 <data name="Arg_OutOfRange_NeedNonNegNum" xml:space="preserve">
 <value>Non-negative number required.</value>
 </data>
Expand DownExpand Up@@ -345,6 +345,9 @@
 <data name="Cryptography_X509Store_WouldModifyAdminTrust" xml:space="preserve">
 <value>Removing the requested certificate would modify admin trust settings, and has been denied.</value>
 </data>
 <data name="Cryptography_InvalidHashSize" xml:space="preserve">
 <value>{0} algorithm hash size is {1} bytes.</value>
 </data>
 <data name="Cryptography_InvalidKeySize" xml:space="preserve">
 <value>Specified key is not a valid size for this algorithm.</value>
 </data>
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Universal Dark Mode - works on any site
(function() {
var enabled = true;
function applyDarkMode() {
if (!enabled) return;
// Create style element if it doesn't exist
var style = document.getElementById('universal-dark-mode-style');
if (!style) {
style = document.createElement('style');
style.id = 'universal-dark-mode-style';
document.head.appendChild(style);
}
// Dark mode CSS - inverts colors but preserves images/video
style.textContent = '
/* Invert everything except media */
html {
filter: invert(1) hue-rotate(180deg) !important;
background: #1a1a2e !important;
}
/* Restore images, videos, iframes, canvas */
img, video, iframe, canvas, svg, picture, [style*="background-image"] {
filter: invert(1) hue-rotate(180deg) !important;
}
/* Preserve specific elements that should not be inverted */
.no-dark-mode, .no-dark-mode *,
[data-theme="light"], [data-theme="light"],
.ace_editor, .ace_editor *,
.CodeMirror, .CodeMirror *,
.monaco-editor, .monaco-editor *,
.markdown-body pre, .markdown-body pre *,
.highlight, .highlight *,
pre code, pre code * {
filter: none !important;
}
/* Fix common UI elements */
.modal, .popup, .dropdown-menu, .tooltip, .popover {
filter: invert(1) hue-rotate(180deg) !important;
background: #2d2d44 !important;
border-color: #444 !important;
}
/* Scrollbars */
::-webkit-scrollbar { background: #1a1a2e !important; }
::-webkit-scrollbar-thumb { background: #444 !important; }
::-webkit-scrollbar-thumb:hover { background: #555 !important; }
/* Selection */
::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }
';
}
function removeDarkMode() {
var style = document.getElementById('universal-dark-mode-style');
if (style) style.remove();
}
// Toggle with Alt+Shift+D
document.addEventListener('keydown', function(e) {
if (e.altKey && e.shiftKey && e.key === 'D') {
e.preventDefault();
enabled = !enabled;
if (enabled) {
applyDarkMode();
console.log('[Universal Dark Mode] Enabled');
} else {
removeDarkMode();
console.log('[Universal Dark Mode] Disabled');
}
}
});
// Apply on load
applyDarkMode();
// Re-apply on dynamic content
var observer = new MutationObserver(function(mutations) {
if (enabled && !document.getElementById('universal-dark-mode-style')) {
applyDarkMode();
}
});
observer.observe(document.head, { childList: true });
console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');
})();
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Improve DSA digest handling on macOS#35712

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

vcsjones
wants to merge
4
commits into

from

 Closed


Improve DSA digest handling on macOS
#35712
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


4 commits


Select commit
Hold shift + click to select a range
db6c106

Improve DSA digest handling on macOS


vcsjones May 1, 2020
6d61a70

Fix build.


vcsjones May 1, 2020
4d8b2a0

Fix exception message; Linux appears capable of FIPS-186-3.


vcsjones May 1, 2020
3a7b190

Move hash size check for Unix DSA CSP


vcsjones May 1, 2020

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


9 changes: 8 additions & 1 deletion
src/libraries/Common/src/System/Security/Cryptography/DSASecurityTransforms.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -261,9 +261,16 @@ public override unsafe void ImportSubjectPublicKeyInfo(

 public override byte[] CreateSignature(byte[] rgbHash)
 {
 const int Sha1DigestSizeBytes = 20;

 if (rgbHash == null)
 throw new ArgumentNullException(nameof(rgbHash));

 // MacOS only supports FIPS-186-2, which only defines SHA1
 // as a supported algorithm.
 if (rgbHash.Length != Sha1DigestSizeBytes)
Comment thread
vcsjones marked this conversation as resolved.

 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", Sha1DigestSizeBytes));

 SecKeyPair keys = GetKeys();

 if (keys.PrivateKey == null)
Expand All@@ -277,7 +284,7 @@ public override byte[] CreateSignature(byte[] rgbHash)
 // are always 160 bits / 20 bytes (the size of SHA-1, and the only legal length for Q).
 byte[] ieeeFormatSignature = AsymmetricAlgorithmHelpers.ConvertDerToIeee1363(
 derFormatSignature.AsSpan(0, derFormatSignature.Length),
 fieldSizeBits: 160);
 fieldSizeBits: Sha1DigestSizeBytes * 8);

 return ieeeFormatSignature;
 }
Expand Down

20 changes: 20 additions & 0 deletions
...s/Common/tests/System/Security/Cryptography/AlgorithmImplementations/DSA/DSASignVerify.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -374,6 +374,25 @@ public void Verify2048WithSha1()
 }
 }

 [ConditionalTheory(nameof(DoesNotSupportFips186_3))]
 [InlineData(128)]
 [InlineData(256)]
 [InlineData(384)]
 [InlineData(512)]
 public void SignHash_DigestAlgorithmUnsupported(int hashSizeBits)
 {
 byte[] hash = new byte[hashSizeBits / 8];
 RandomNumberGenerator.Fill(hash);

 using (DSA dsa = DSAFactory.Create())
 {
 DSATestData.GetDSA1024_186_2(out DSAParameters parameters, out _, out _);
 dsa.ImportParameters(parameters);
 CryptographicException ce = Assert.Throws<CryptographicException>(() => dsa.CreateSignature(hash));
 Assert.Equal("SHA1 algorithm hash size is 20 bytes.", ce.Message);
 }
 }

 private void SignAndVerify(byte[] data, string hashAlgorithmName, DSAParameters dsaParameters, int expectedSignatureLength)
 {
 using (DSA dsa = DSAFactory.Create())
Expand All@@ -394,5 +413,6 @@ internal static bool SupportsFips186_3
 }
 }
 public static bool SupportsKeyGeneration => DSAFactory.SupportsKeyGeneration;
 public static bool DoesNotSupportFips186_3 => !SupportsFips186_3;
 }
}

3 changes: 3 additions & 0 deletions
src/libraries/System.Security.Cryptography.Algorithms/src/Resources/Strings.resx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -162,6 +162,9 @@
 <data name="Cryptography_HashAlgorithmNameNullOrEmpty" xml:space="preserve">
 <value>The hash algorithm name cannot be null or empty.</value>
 </data>
 <data name="Cryptography_InvalidHashSize" xml:space="preserve">
 <value>{0} algorithm hash size is {1} bytes.</value>
 </data>
 <data name="Cryptography_InvalidOID" xml:space="preserve">
 <value>Object identifier (OID) is unknown.</value>
 </data>
Expand Down

13 changes: 10 additions & 3 deletions
...curity.Cryptography.Csp/src/System/Security/Cryptography/DSACryptoServiceProvider.Unix.cs

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -49,7 +49,16 @@ public DSACryptoServiceProvider(CspParameters parameters)
 }

 [System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Security", "CA5351", Justification = "This is the implementation of DSACryptoServiceProvider")]
 public override byte[] CreateSignature(byte[] rgbHash) => _impl.CreateSignature(rgbHash);
 public override byte[] CreateSignature(byte[] rgbHash)
 {
 if (rgbHash == null)
 throw new ArgumentNullException(nameof(rgbHash));

 if (rgbHash.Length != SHA1_HASHSIZE)
@vcsjonesvcsjonesMay 1, 2020

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is also a breaking change; but it makes DSACryptoServiceProvider consistent across all platforms.
 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", SHA1_HASHSIZE));

 return _impl.CreateSignature(rgbHash);
 }

 public override bool TryCreateSignature(ReadOnlySpan<byte> hash, Span<byte> destination, out int bytesWritten) =>
 _impl.TryCreateSignature(hash, destination, out bytesWritten);
Expand DownExpand Up@@ -212,8 +221,6 @@ public byte[] SignHash(byte[] rgbHash, string str)
 throw new ArgumentNullException(nameof(rgbHash));
 if (PublicOnly)
 throw new CryptographicException(SR.Cryptography_CSP_NoPrivateKey);
 if (rgbHash.Length != SHA1_HASHSIZE)
 throw new CryptographicException(SR.Format(SR.Cryptography_InvalidHashSize, "SHA1", SHA1_HASHSIZE));

 // Only SHA1 allowed; the default value is SHA1
 if (str != null && !string.Equals(str, "SHA1", StringComparison.OrdinalIgnoreCase))
Expand Down

5 changes: 4 additions & 1 deletion
src/libraries/System.Security.Cryptography.X509Certificates/src/Resources/Strings.resx

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -74,7 +74,7 @@
 </data>
 <data name="Arg_InvalidType" xml:space="preserve">
 <value>Invalid type.</value>
 </data>
 </data>
 <data name="Arg_OutOfRange_NeedNonNegNum" xml:space="preserve">
 <value>Non-negative number required.</value>
 </data>
Expand DownExpand Up@@ -345,6 +345,9 @@
 <data name="Cryptography_X509Store_WouldModifyAdminTrust" xml:space="preserve">
 <value>Removing the requested certificate would modify admin trust settings, and has been denied.</value>
 </data>
 <data name="Cryptography_InvalidHashSize" xml:space="preserve">
 <value>{0} algorithm hash size is {1} bytes.</value>
 </data>
 <data name="Cryptography_InvalidKeySize" xml:space="preserve">
 <value>Specified key is not a valid size for this algorithm.</value>
 </data>
Expand Down