Unnecessary cryptographic derived types obsoletions by annchous · Pull Request #52303 · dotnet/runtime

annchous · 2021-05-05T14:45:58Z

I have questions that I need your help to resolve:

Building libraries fails with the following errors:

...\src\libraries\System.Security.Cryptography.Algorithms\src\System\Security\Cryptography\CryptoConfig.cs(123,46): error SYSLIB0021: "AesManaged" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Algorithms\src\System.Security.Cryptography.Algorithms.csproj]
...\src\libraries\System.Security.Cryptography.Algorithms\src\System\Security\Cryptography\CryptoConfig.cs(124,49): error SYSLIB0021: "SHA256Managed" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Algorithms\src\System.Security.Cryptography.Algorithms.csproj]
...\src\libraries\System.Security.Cryptography.Algorithms\src\System\Security\Cryptography\CryptoConfig.cs(125,49): error SYSLIB0021: "SHA384Managed" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Algorithms\src\System.Security.Cryptography.Algorithms.csproj]
...\src\libraries\System.Security.Cryptography.Algorithms\src\System\Security\Cryptography\CryptoConfig.cs(126,49): error SYSLIB0021: "SHA512Managed" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Algorithms\src\System.Security.Cryptography.Algorithms.csproj]
...\src\libraries\System.Security.Cryptography.Csp\src\System\Security\Cryptography\PasswordDeriveBytes.cs(45,98): error SYSLIB0021: "SHA1CryptoServiceProvider" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Csp\src\System.Security.Cryptography.Csp.csproj]
...\src\libraries\System.Security.Cryptography.Csp\src\System\Security\Cryptography\PasswordDeriveBytes.cs(50,98): error SYSLIB0021: "SHA1CryptoServiceProvider" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Csp\src\System.Security.Cryptography.Csp.csproj]

So, what should I do with obsolete classes here

runtime/src/libraries/System.Security.Cryptography.Csp/src/System/Security/Cryptography/PasswordDeriveBytes.cs

Line 45 in 94e4e3f

[DynamicDependency(DynamicallyAccessedMemberTypes.PublicParameterlessConstructor,typeof(SHA1CryptoServiceProvider))]

runtime/src/libraries/System.Security.Cryptography.Csp/src/System/Security/Cryptography/PasswordDeriveBytes.cs

Line 50 in 94e4e3f

[DynamicDependency(DynamicallyAccessedMemberTypes.PublicParameterlessConstructor,typeof(SHA1CryptoServiceProvider))]

and here?

Tests fail. I suppose it can be fixed by marking with

#pragma warning disable SYSLIB0021
#pragma warning restore SYSLIB0021

content in test files for classes now marked as obsolete.
But for System.Security.Cryptography.Csp there is a CreateTransformCompat class which also uses the classes now marked as obsolete.
The same problem exists in System.Security.Cryptography.Algorithms for individual tests and for CryptoConfigTests.

Refresh repository

ghost · 2021-05-05T14:46:03Z

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, to please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

ghost · 2021-05-05T14:46:05Z

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @GrabYourPitchforks
See info in area-owners.md if you want to be subscribed.

Issue Details

Close #46934

I have questions that I need your help to resolve:

Building libraries fails with the following errors:

...\src\libraries\System.Security.Cryptography.Algorithms\src\System\Security\Cryptography\CryptoConfig.cs(123,46): error SYSLIB0021: "AesManaged" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Algorithms\src\System.Security.Cryptography.Algorithms.csproj]
...\src\libraries\System.Security.Cryptography.Algorithms\src\System\Security\Cryptography\CryptoConfig.cs(124,49): error SYSLIB0021: "SHA256Managed" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Algorithms\src\System.Security.Cryptography.Algorithms.csproj]
...\src\libraries\System.Security.Cryptography.Algorithms\src\System\Security\Cryptography\CryptoConfig.cs(125,49): error SYSLIB0021: "SHA384Managed" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Algorithms\src\System.Security.Cryptography.Algorithms.csproj]
...\src\libraries\System.Security.Cryptography.Algorithms\src\System\Security\Cryptography\CryptoConfig.cs(126,49): error SYSLIB0021: "SHA512Managed" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Algorithms\src\System.Security.Cryptography.Algorithms.csproj]
...\src\libraries\System.Security.Cryptography.Csp\src\System\Security\Cryptography\PasswordDeriveBytes.cs(45,98): error SYSLIB0021: "SHA1CryptoServiceProvider" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Csp\src\System.Security.Cryptography.Csp.csproj]
...\src\libraries\System.Security.Cryptography.Csp\src\System\Security\Cryptography\PasswordDeriveBytes.cs(50,98): error SYSLIB0021: "SHA1CryptoServiceProvider" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Csp\src\System.Security.Cryptography.Csp.csproj]

So, what should I do with obsolete classes here

runtime/src/libraries/System.Security.Cryptography.Csp/src/System/Security/Cryptography/PasswordDeriveBytes.cs

Line 45 in 94e4e3f

[DynamicDependency(DynamicallyAccessedMemberTypes.PublicParameterlessConstructor,typeof(SHA1CryptoServiceProvider))]

runtime/src/libraries/System.Security.Cryptography.Csp/src/System/Security/Cryptography/PasswordDeriveBytes.cs

Line 50 in 94e4e3f

[DynamicDependency(DynamicallyAccessedMemberTypes.PublicParameterlessConstructor,typeof(SHA1CryptoServiceProvider))]

and here?

Tests fail. I suppose it can be fixed by marking with

#pragma warning disable SYSLIB0021
#pragma warning restore SYSLIB0021

content in test files for classes now marked as obsolete.
But for System.Security.Cryptography.Csp there is a CreateTransformCompat class which also uses the classes now marked as obsolete.
The same problem exists in System.Security.Cryptography.Algorithms for individual tests and for CryptoConfigTests.

Author:	annchous
Assignees:	-
Labels:	`area-System.Security`, `new-api-needs-documentation`
Milestone:	-

bartonjs · 2021-05-05T15:32:22Z

For PasswordDeriveBytes and CryptoConfig, just pragma suppress around their usages.

For the System.Security.Cryptography.Algorithms.Tests and System.Security.Cryptography.Csp.Tests libraries, NoWarn in the csproj.

annchous · 2021-05-05T16:14:12Z

For PasswordDeriveBytes and CryptoConfig, just pragma suppress around their usages.
For the System.Security.Cryptography.Algorithms.Tests and System.Security.Cryptography.Csp.Tests libraries, NoWarn in the csproj.

@bartonjs thanks for the instructions, it helped. I also added documentation for the new obsoletion :)

bartonjs · 2021-05-05T17:44:04Z

 <Project Sdk="Microsoft.NET.Sdk">
 <PropertyGroup>
 <TargetFrameworks>$(NetCoreAppCurrent)</TargetFrameworks>
+ <NoWarn>$(NoWarn);SYSLIB0021</NoWarn>


I can't think of a reason why System.Runtime.Serialization.Xml.Tests would need the NoWarn.
If it's explicitly testing serialization for one of the obsoleted types, a pragma around that/those test(s) is more appropriate. Otherwise, it would probably be a place that's doing the old/wrong pattern that should be updated to better code.

The problem was here.
According to the errors the problematic lines are
staticMD5CryptoServiceProvidermd5=null;// <--- line 211
and
if(md5==null)md5=newMD5CryptoServiceProvider();// <--- line 270
The method using this type:
runtime/src/libraries/System.Runtime.Serialization.Xml/tests/SerializationTestTypes/DataContract.cs
Line 267 in 1b30c00
privatestaticstringGetNamespacesDigest(stringnamespaces)

What then needs to be done?

Well, this code is just an example of the bad pattern. So we should fix it 😄
Change the field type from MD5CryptoServiceProvider to MD5
Change the ctor call to MD5.Create()

I see, thanks for the instructions 🙂 Just fixed!

jeffhandley

Thanks for working on this @annchous! 💯

jeffhandley · 2021-05-06T04:10:28Z

 | __`SYSLIB0018`__ | ReflectionOnly loading is not supported and throws PlatformNotSupportedException. |
 | __`SYSLIB0019`__ | RuntimeEnvironment members SystemConfigurationFile, GetRuntimeInterfaceAsIntPtr, and GetRuntimeInterfaceAsObject are no longer supported and throw PlatformNotSupportedException. |
 | __`SYSLIB0020`__ | JsonSerializerOptions.IgnoreNullValues is obsolete. To ignore null values when serializing, set DefaultIgnoreCondition to JsonIgnoreCondition.WhenWritingNull. |
+| __`SYSLIB0021`__ | Derived cryptographic types are obsolete. |


When possible, the message should also indicate what should be done to resolve the warning. Is the following accurate, @bartonjs?
Suggested change
|__`SYSLIB0021`__| Derived cryptographic types are obsolete. |
|__`SYSLIB0021`__| Derived cryptographic types are obsolete. Use the Create method on the underlying type instead. |
When this is changed, it will need to be updated in Obsoletions.cs and the ref sources too.

It's technically correct. I don't know if "underlying type" is the best wording, but I can't come up with an obviously better one.
"algorithm's abstract class"
"abstract class representing the algorithm"
"base type"

@gewarren do you have a suggestion for a message better than this?
Derived cryptographic types are obsolete. Use the Create method on the underlying type instead.

I'd suggest "...Use the Create method on the base type instead."

I'd suggest "...Use the Create method on the base type instead."
@jeffhandley apply this?

Yes please. Thanks!
Side note -- I'm sorry about the trouble with the project file; I hope you didn't mind that I pushed commits to fix it. Since that was an existing issue unrelated to your changes, I didn't want to burden you with fixing that up. I'm glad this PR uncovered it though!

Side note -- I'm sorry about the trouble with the project file; I hope you didn't mind that I pushed commits to fix it. Since that was an existing issue unrelated to your changes, I didn't want to burden you with fixing that up. I'm glad this PR uncovered it though!
It's okay, of course I was not against helping with the resolution of problems in the project file! Finished with the documentation :)

jeffhandley · 2021-05-06T17:39:37Z

My PR (#52366) caused merge conflicts. I'll resolve them and push to your branch.

jeffhandley

Looks good to me, pending @gewarren's feedback on the message.

jeffhandley · 2021-05-06T19:20:28Z

Commit f8067e9 is causing an error because of Obsoletions not being defined for the browser build. This seems to have been a result of the csproj file having a bunch of duplication between <ItemGroup Condition="'$(TargetsBrowser)' != 'true'"> and <ItemGroup Condition=" '$(TargetsBrowser)' == 'true'">, which was an existing problem.

I'm going to push another commit that de-dupes the contents from those item groups to make this file more maintainable.

…onfigs. Ensure Obsoletions.cs is included in all configs.

jeffhandley · 2021-05-07T00:24:19Z

I need to mark this as no-merge for a little bit. We want to get out ahead of some upstream breaks this is going to cause in https://github.com/dotnet/aspnetcore. I'll merge this PR once we have aspnetcore fixed to use the new recommendations.

jeffhandley · 2021-05-10T22:10:10Z

dotnet/aspnetcore#32511 was merged, clearing the way for this PR to get merged. Thank you for this contribution, @annchous! I'm going to set the PR to auto-merge once the CI passes with the latest changes from main merged in.

ghost · 2021-05-10T22:10:28Z

Hello @jeffhandley!

Because this pull request has the auto-merge label, I will be glad to assist with helping to merge this pull request once all check-in policies pass.

p.s. you can customize the way I help with merging this pull request, such as holding this pull request until a specific person approves. Simply @mention me (`@msftbot`) and give me an instruction to get started! Learn more here.

jeffhandley · 2021-05-10T22:43:06Z

It looks like my merge from main (done using the GitHub UI) brought back duplicate Obsoletions.cs inclusions. I'll fix it up shortly.

jeffhandley · 2021-05-11T04:27:01Z

One of the "Libraries Test Run release mono Linux x64 Debug" test failures was #44689. Rerunning since others looked to be connectivity-related.

annchousand others added 15 commits May 5, 2021 01:25

Merge pull request#1from dotnet/main
3d01d78
Refresh repository

add new obsoletion ID
ae7b109

nowarn for new obsoletion
232775b

add obsoletions to csproj
f7005f8

AesCryptoServiceProvider obsoletion
bc94bc7

DESCryptoServiceProvider obsoletion
adddf44

MD5CryptoServiceProvider obsoletion
56775ea

RC2CryptoServiceProvider obsoletion
4fdff53

SHA1CryptoServiceProvider obsoletion
89ecc58

SHA256CryptoServiceProvider obsoletion
76ce957

SHA384CryptoServiceProvider obsoletion
acf6002

SHA512CryptoServiceProvider obsoletion
7724dc9

TripleDESCryptoServiceProvider obsoletion
1294d03

add obsoletions to csproj
eef5db8

*Managed obsoletions
4fea03a

ghost added area-System.Security new-api-needs-documentation labels May 5, 2021

Annchous added 3 commits May 5, 2021 19:07

add pragma suppress for types usages
875a7ce

add nowarn in tests csproj
9bbaddd

add documentation
f160484

Annchous added 2 commits May 5, 2021 19:59

add nowarn to new identified tests csproj
ef88b0c

add pragma suppress for types usages#2
06f3e78

bartonjs reviewed May 5, 2021
View reviewed changes

jeffhandley reviewed May 6, 2021
View reviewed changes

jeffhandley mentioned this pull request May 6, 2021
Developers should be guided away from more obsolete APIs in .NET 6 #46767
Closed
14 tasks

jeffhandley added the breaking-change Issue or PR that represents a breaking API or functional change over a previous release. label May 6, 2021

filipnavara mentioned this pull request May 6, 2021
Obsolete the Rijndael and RijndaelManaged classes #52366
Merged

Annchous added 2 commits May 6, 2021 13:25

update documentation
7afc9d5

fix md5 usage
665f37d

jeffhandley reviewed May 6, 2021
View reviewed changes

Comment threadsrc/libraries/System.Security.Cryptography.Csp/src/System.Security.Cryptography.Csp.csproj Outdated

Merge branch 'main' into 46934-cryptographic-obsoletions
b364451

jeffhandley reviewed May 6, 2021
View reviewed changes

Comment threadsrc/libraries/Directory.Build.targets Outdated

jeffhandleyand others added 3 commits May 6, 2021 10:44

Fix indentation
403413a

fix obsoletions inclusion in csproj
4e5bef6

remove extra obsoletions inclusion in csproj
f8067e9

jeffhandley approved these changes May 6, 2021
View reviewed changes

jeffhandleyand others added 3 commits May 6, 2021 12:42

De-dupe project items that were in both the browser and non-browser c…
4b0f491
…onfigs. Ensure Obsoletions.cs is included in all configs.

Remove duplicate RandomNumberGeneratorImplementation.cs reference
5a97ee0

Update documentation
f13b2b7

jeffhandley added the NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) label May 7, 2021

jeffhandley mentioned this pull request May 10, 2021
DataProtection: Move away from soon to be obsolete APIs dotnet/aspnetcore#32511
Merged

Merge branch 'main' into 46934-cryptographic-obsoletions
87225b9

jeffhandley added auto-merge and removed NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) labels May 10, 2021

Remove duplicate Obsoletions.cs from project file (introduced in merge)
0d5a153

ghost merged commit ebcd102 into dotnet:mainMay 11, 2021

jeffhandley mentioned this pull request May 11, 2021
On Browser DOM scenarios use the SubtleCrypto API #49511
Closed

karelz added this to the 6.0.0 milestone May 20, 2021

ghost locked as resolved and limited conversation to collaborators Jun 19, 2021

This pull request was closed.

	\|__`SYSLIB0021`__\| Derived cryptographic types are obsolete. \|
	\|__`SYSLIB0021`__\| Derived cryptographic types are obsolete. Use the Create method on the underlying type instead. \|

Uh oh!

Conversation

annchous commented May 5, 2021

Uh oh!

ghost commented May 5, 2021

Uh oh!

ghost commented May 5, 2021

Uh oh!

bartonjs commented May 5, 2021

Uh oh!

annchous commented May 5, 2021• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jeffhandley left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jeffhandley commented May 6, 2021

Uh oh!

Uh oh!

jeffhandley left a comment

Choose a reason for hiding this comment

Uh oh!

jeffhandley commented May 6, 2021

Uh oh!

jeffhandley commented May 7, 2021

Uh oh!

jeffhandley commented May 10, 2021

Uh oh!

ghost commented May 10, 2021

p.s. you can customize the way I help with merging this pull request, such as holding this pull request until a specific person approves. Simply @mention me (@msftbot) and give me an instruction to get started! Learn more here.

Uh oh!

jeffhandley commented May 10, 2021

Uh oh!

jeffhandley commented May 11, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

annchous commented May 5, 2021•
edited
Loading

p.s. you can customize the way I help with merging this pull request, such as holding this pull request until a specific person approves. Simply @mention me (`@msftbot`) and give me an instruction to get started! Learn more here.