Unnecessary cryptographic derived types obsoletions #52303

annchous · 2021-05-05T14:45:58Z

I have questions that I need your help to resolve:

Building libraries fails with the following errors:

...\src\libraries\System.Security.Cryptography.Algorithms\src\System\Security\Cryptography\CryptoConfig.cs(123,46): error SYSLIB0021: "AesManaged" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Algorithms\src\System.Security.Cryptography.Algorithms.csproj]
...\src\libraries\System.Security.Cryptography.Algorithms\src\System\Security\Cryptography\CryptoConfig.cs(124,49): error SYSLIB0021: "SHA256Managed" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Algorithms\src\System.Security.Cryptography.Algorithms.csproj]
...\src\libraries\System.Security.Cryptography.Algorithms\src\System\Security\Cryptography\CryptoConfig.cs(125,49): error SYSLIB0021: "SHA384Managed" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Algorithms\src\System.Security.Cryptography.Algorithms.csproj]
...\src\libraries\System.Security.Cryptography.Algorithms\src\System\Security\Cryptography\CryptoConfig.cs(126,49): error SYSLIB0021: "SHA512Managed" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Algorithms\src\System.Security.Cryptography.Algorithms.csproj]
...\src\libraries\System.Security.Cryptography.Csp\src\System\Security\Cryptography\PasswordDeriveBytes.cs(45,98): error SYSLIB0021: "SHA1CryptoServiceProvider" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Csp\src\System.Security.Cryptography.Csp.csproj]
...\src\libraries\System.Security.Cryptography.Csp\src\System\Security\Cryptography\PasswordDeriveBytes.cs(50,98): error SYSLIB0021: "SHA1CryptoServiceProvider" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Csp\src\System.Security.Cryptography.Csp.csproj]

So, what should I do with obsolete classes here

runtime/src/libraries/System.Security.Cryptography.Csp/src/System/Security/Cryptography/PasswordDeriveBytes.cs

Line 45 in 94e4e3f

    
           [DynamicDependency(DynamicallyAccessedMemberTypes.PublicParameterlessConstructor, typeof(SHA1CryptoServiceProvider))]

runtime/src/libraries/System.Security.Cryptography.Csp/src/System/Security/Cryptography/PasswordDeriveBytes.cs

Line 50 in 94e4e3f

    
           [DynamicDependency(DynamicallyAccessedMemberTypes.PublicParameterlessConstructor, typeof(SHA1CryptoServiceProvider))]

and here?

Tests fail. I suppose it can be fixed by marking with

#pragma warning disable SYSLIB0021
#pragma warning restore SYSLIB0021

content in test files for classes now marked as obsolete.
But for System.Security.Cryptography.Csp there is a CreateTransformCompat class which also uses the classes now marked as obsolete.
The same problem exists in System.Security.Cryptography.Algorithms for individual tests and for CryptoConfigTests.

Refresh repository

dotnet-issue-labeler · 2021-05-05T14:46:03Z

Note regarding the new-api-needs-documentation label:

This serves as a reminder for when your PR is modifying a ref *.cs file and adding/modifying public APIs, to please make sure the API implementation in the src *.cs file is documented with triple slash comments, so the PR reviewers can sign off that change.

ghost · 2021-05-05T14:46:05Z

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @GrabYourPitchforks
See info in area-owners.md if you want to be subscribed.

Issue Details

Close #46934

I have questions that I need your help to resolve:

Building libraries fails with the following errors:

...\src\libraries\System.Security.Cryptography.Algorithms\src\System\Security\Cryptography\CryptoConfig.cs(123,46): error SYSLIB0021: "AesManaged" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Algorithms\src\System.Security.Cryptography.Algorithms.csproj]
...\src\libraries\System.Security.Cryptography.Algorithms\src\System\Security\Cryptography\CryptoConfig.cs(124,49): error SYSLIB0021: "SHA256Managed" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Algorithms\src\System.Security.Cryptography.Algorithms.csproj]
...\src\libraries\System.Security.Cryptography.Algorithms\src\System\Security\Cryptography\CryptoConfig.cs(125,49): error SYSLIB0021: "SHA384Managed" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Algorithms\src\System.Security.Cryptography.Algorithms.csproj]
...\src\libraries\System.Security.Cryptography.Algorithms\src\System\Security\Cryptography\CryptoConfig.cs(126,49): error SYSLIB0021: "SHA512Managed" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Algorithms\src\System.Security.Cryptography.Algorithms.csproj]
...\src\libraries\System.Security.Cryptography.Csp\src\System\Security\Cryptography\PasswordDeriveBytes.cs(45,98): error SYSLIB0021: "SHA1CryptoServiceProvider" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Csp\src\System.Security.Cryptography.Csp.csproj]
...\src\libraries\System.Security.Cryptography.Csp\src\System\Security\Cryptography\PasswordDeriveBytes.cs(50,98): error SYSLIB0021: "SHA1CryptoServiceProvider" is obsolete: 'Derived cryptographic types are obsolete.' [...\src\libraries\System.Security.Cryptography.Csp\src\System.Security.Cryptography.Csp.csproj]

So, what should I do with obsolete classes here

runtime/src/libraries/System.Security.Cryptography.Csp/src/System/Security/Cryptography/PasswordDeriveBytes.cs

Line 45 in 94e4e3f

    
           [DynamicDependency(DynamicallyAccessedMemberTypes.PublicParameterlessConstructor, typeof(SHA1CryptoServiceProvider))]

runtime/src/libraries/System.Security.Cryptography.Csp/src/System/Security/Cryptography/PasswordDeriveBytes.cs

Line 50 in 94e4e3f

    
           [DynamicDependency(DynamicallyAccessedMemberTypes.PublicParameterlessConstructor, typeof(SHA1CryptoServiceProvider))]

and here?

Tests fail. I suppose it can be fixed by marking with

#pragma warning disable SYSLIB0021
#pragma warning restore SYSLIB0021

content in test files for classes now marked as obsolete.
But for System.Security.Cryptography.Csp there is a CreateTransformCompat class which also uses the classes now marked as obsolete.
The same problem exists in System.Security.Cryptography.Algorithms for individual tests and for CryptoConfigTests.

Author:	annchous
Assignees:	-
Labels:	`area-System.Security`, `new-api-needs-documentation`
Milestone:	-

bartonjs · 2021-05-05T15:32:22Z

For PasswordDeriveBytes and CryptoConfig, just pragma suppress around their usages.

For the System.Security.Cryptography.Algorithms.Tests and System.Security.Cryptography.Csp.Tests libraries, NoWarn in the csproj.

annchous · 2021-05-05T16:14:12Z

For PasswordDeriveBytes and CryptoConfig, just pragma suppress around their usages.

For the System.Security.Cryptography.Algorithms.Tests and System.Security.Cryptography.Csp.Tests libraries, NoWarn in the csproj.

@bartonjs thanks for the instructions, it helped. I also added documentation for the new obsoletion :)

bartonjs · 2021-05-05T17:44:04Z

...braries/System.Runtime.Serialization.Xml/tests/System.Runtime.Serialization.Xml.Tests.csproj

@@ -1,6 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
  <PropertyGroup>
    <TargetFrameworks>$(NetCoreAppCurrent)</TargetFrameworks>
+    <NoWarn>$(NoWarn);SYSLIB0021</NoWarn>


I can't think of a reason why System.Runtime.Serialization.Xml.Tests would need the NoWarn.

If it's explicitly testing serialization for one of the obsoleted types, a pragma around that/those test(s) is more appropriate. Otherwise, it would probably be a place that's doing the old/wrong pattern that should be updated to better code.

The problem was here.
According to the errors the problematic lines are

static MD5CryptoServiceProvider md5 = null; // <--- line 211

and

if (md5 == null) md5 = new MD5CryptoServiceProvider(); // <--- line 270

The method using this type:

runtime/src/libraries/System.Runtime.Serialization.Xml/tests/SerializationTestTypes/DataContract.cs

Line 267 in 1b30c00

private static string GetNamespacesDigest(string namespaces)

What then needs to be done?

Well, this code is just an example of the bad pattern. So we should fix it 😄

Change the field type from MD5CryptoServiceProvider to MD5

Change the ctor call to MD5.Create()

I see, thanks for the instructions 🙂 Just fixed!

jeffhandley

Thanks for working on this @annchous! 💯

jeffhandley · 2021-05-06T04:10:28Z

docs/project/list-of-diagnostics.md

@@ -70,6 +70,7 @@ The PR that reveals the implementation of the `<IncludeInternalObsoleteAttribute
 |  __`SYSLIB0018`__ | ReflectionOnly loading is not supported and throws PlatformNotSupportedException. |
 |  __`SYSLIB0019`__ | RuntimeEnvironment members SystemConfigurationFile, GetRuntimeInterfaceAsIntPtr, and GetRuntimeInterfaceAsObject are no longer supported and throw PlatformNotSupportedException. |
 |  __`SYSLIB0020`__ | JsonSerializerOptions.IgnoreNullValues is obsolete. To ignore null values when serializing, set DefaultIgnoreCondition to JsonIgnoreCondition.WhenWritingNull. |
+|  __`SYSLIB0021`__ | Derived cryptographic types are obsolete. |


When possible, the message should also indicate what should be done to resolve the warning. Is the following accurate, @bartonjs?

Suggested change

| __`SYSLIB0021`__ | Derived cryptographic types are obsolete. |

| __`SYSLIB0021`__ | Derived cryptographic types are obsolete. Use the Create method on the underlying type instead. |

When this is changed, it will need to be updated in Obsoletions.cs and the ref sources too.

It's technically correct. I don't know if "underlying type" is the best wording, but I can't come up with an obviously better one.

"algorithm's abstract class"

"abstract class representing the algorithm"

"base type"

@gewarren do you have a suggestion for a message better than this?

Derived cryptographic types are obsolete. Use the Create method on the underlying type instead.

I'd suggest "...Use the Create method on the base type instead."

I'd suggest "...Use the Create method on the base type instead."

@jeffhandley apply this?

Yes please. Thanks!

Side note -- I'm sorry about the trouble with the project file; I hope you didn't mind that I pushed commits to fix it. Since that was an existing issue unrelated to your changes, I didn't want to burden you with fixing that up. I'm glad this PR uncovered it though!

Side note -- I'm sorry about the trouble with the project file; I hope you didn't mind that I pushed commits to fix it. Since that was an existing issue unrelated to your changes, I didn't want to burden you with fixing that up. I'm glad this PR uncovered it though!

It's okay, of course I was not against helping with the resolution of problems in the project file! Finished with the documentation :)

src/libraries/Directory.Build.targets

....Security.Cryptography.Algorithms/tests/System.Security.Cryptography.Algorithms.Tests.csproj

...braries/System.Security.Cryptography.Csp/tests/System.Security.Cryptography.Csp.Tests.csproj

src/libraries/System.Security.Cryptography.Csp/src/System.Security.Cryptography.Csp.csproj

jeffhandley · 2021-05-06T17:39:37Z

My PR (#52366) caused merge conflicts. I'll resolve them and push to your branch.

src/libraries/Directory.Build.targets

jeffhandley

Looks good to me, pending @gewarren's feedback on the message.

jeffhandley · 2021-05-06T19:20:28Z

Commit f8067e9 is causing an error because of Obsoletions not being defined for the browser build. This seems to have been a result of the csproj file having a bunch of duplication between <ItemGroup Condition="'$(TargetsBrowser)' != 'true'"> and <ItemGroup Condition=" '$(TargetsBrowser)' == 'true'">, which was an existing problem.

I'm going to push another commit that de-dupes the contents from those item groups to make this file more maintainable.

…onfigs. Ensure Obsoletions.cs is included in all configs.

jeffhandley · 2021-05-07T00:24:19Z

I need to mark this as no-merge for a little bit. We want to get out ahead of some upstream breaks this is going to cause in https://github.com/dotnet/aspnetcore. I'll merge this PR once we have aspnetcore fixed to use the new recommendations.

jeffhandley · 2021-05-10T22:10:10Z

dotnet/aspnetcore#32511 was merged, clearing the way for this PR to get merged. Thank you for this contribution, @annchous! I'm going to set the PR to auto-merge once the CI passes with the latest changes from main merged in.

ghost · 2021-05-10T22:10:28Z

Hello @jeffhandley!

Because this pull request has the auto-merge label, I will be glad to assist with helping to merge this pull request once all check-in policies pass.

p.s. you can customize the way I help with merging this pull request, such as holding this pull request until a specific person approves. Simply @mention me (`@msftbot`) and give me an instruction to get started! Learn more here.

jeffhandley · 2021-05-10T22:43:06Z

It looks like my merge from main (done using the GitHub UI) brought back duplicate Obsoletions.cs inclusions. I'll fix it up shortly.

jeffhandley · 2021-05-11T04:27:01Z

One of the "Libraries Test Run release mono Linux x64 Debug" test failures was #44689. Rerunning since others looked to be connectivity-related.

annchous and others added 15 commits May 5, 2021 01:25

Merge pull request #1 from dotnet/main

3d01d78

Refresh repository

add new obsoletion ID

ae7b109

nowarn for new obsoletion

232775b

add obsoletions to csproj

f7005f8

AesCryptoServiceProvider obsoletion

bc94bc7

DESCryptoServiceProvider obsoletion

adddf44

MD5CryptoServiceProvider obsoletion

56775ea

RC2CryptoServiceProvider obsoletion

4fdff53

SHA1CryptoServiceProvider obsoletion

89ecc58

SHA256CryptoServiceProvider obsoletion

76ce957

SHA384CryptoServiceProvider obsoletion

acf6002

SHA512CryptoServiceProvider obsoletion

7724dc9

TripleDESCryptoServiceProvider obsoletion

1294d03

add obsoletions to csproj

eef5db8

*Managed obsoletions

4fea03a

dotnet-issue-labeler bot added area-System.Security new-api-needs-documentation labels May 5, 2021

annchous added 3 commits May 5, 2021 19:07

add pragma suppress for types usages

875a7ce

add nowarn in tests csproj

9bbaddd

add documentation

f160484

annchous added 2 commits May 5, 2021 19:59

add nowarn to new identified tests csproj

ef88b0c

add pragma suppress for types usages #2

06f3e78

bartonjs reviewed May 5, 2021

View reviewed changes

jeffhandley reviewed May 6, 2021

View reviewed changes

jeffhandley mentioned this pull request May 6, 2021

Developers should be guided away from more obsolete APIs in .NET 6 #46767

Closed

14 tasks

jeffhandley added the breaking-change Issue or PR that represents a breaking API or functional change over a prerelease. label May 6, 2021

filipnavara mentioned this pull request May 6, 2021

Obsolete the Rijndael and RijndaelManaged classes #52366

Merged

annchous added 2 commits May 6, 2021 13:25

update documentation

7afc9d5

fix md5 usage

665f37d

jeffhandley reviewed May 6, 2021

View reviewed changes

src/libraries/System.Security.Cryptography.Csp/src/System.Security.Cryptography.Csp.csproj Outdated Show resolved Hide resolved

Merge branch 'main' into 46934-cryptographic-obsoletions

b364451

jeffhandley reviewed May 6, 2021

View reviewed changes

src/libraries/Directory.Build.targets Outdated Show resolved Hide resolved

jeffhandley and others added 3 commits May 6, 2021 10:44

Fix indentation

403413a

fix obsoletions inclusion in csproj

4e5bef6

remove extra obsoletions inclusion in csproj

f8067e9

jeffhandley approved these changes May 6, 2021

View reviewed changes

jeffhandley and others added 3 commits May 6, 2021 12:42

De-dupe project items that were in both the browser and non-browser c…

4b0f491

…onfigs. Ensure Obsoletions.cs is included in all configs.

Remove duplicate RandomNumberGeneratorImplementation.cs reference

5a97ee0

Update documentation

f13b2b7

jeffhandley added the NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) label May 7, 2021

jeffhandley mentioned this pull request May 10, 2021

DataProtection: Move away from soon to be obsolete APIs dotnet/aspnetcore#32511

Merged

Merge branch 'main' into 46934-cryptographic-obsoletions

87225b9

jeffhandley added auto-merge and removed NO-MERGE The PR is not ready for merge yet (see discussion for detailed reasons) labels May 10, 2021

Remove duplicate Obsoletions.cs from project file (introduced in merge)

0d5a153

ghost merged commit ebcd102 into dotnet:main May 11, 2021

jeffhandley mentioned this pull request May 11, 2021

On Browser DOM scenarios use the SubtleCrypto API #49511

Closed

karelz added this to the 6.0.0 milestone May 20, 2021

ghost locked as resolved and limited conversation to collaborators Jun 19, 2021

This pull request was closed.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Unnecessary cryptographic derived types obsoletions #52303

Unnecessary cryptographic derived types obsoletions #52303

annchous commented May 5, 2021

dotnet-issue-labeler bot commented May 5, 2021

ghost commented May 5, 2021

bartonjs commented May 5, 2021

annchous commented May 5, 2021 •

edited

Loading

bartonjs May 5, 2021

annchous May 5, 2021

bartonjs May 6, 2021

annchous May 6, 2021

jeffhandley left a comment

jeffhandley May 6, 2021

bartonjs May 6, 2021

jeffhandley May 6, 2021

gewarren May 6, 2021

annchous May 6, 2021

jeffhandley May 6, 2021

annchous May 6, 2021

jeffhandley commented May 6, 2021

jeffhandley left a comment

jeffhandley commented May 6, 2021

jeffhandley commented May 7, 2021

jeffhandley commented May 10, 2021

ghost commented May 10, 2021

jeffhandley commented May 10, 2021

jeffhandley commented May 11, 2021

	\| __`SYSLIB0021`__ \| Derived cryptographic types are obsolete. \|
	\| __`SYSLIB0021`__ \| Derived cryptographic types are obsolete. Use the Create method on the underlying type instead. \|

Unnecessary cryptographic derived types obsoletions #52303

Unnecessary cryptographic derived types obsoletions #52303

Conversation

annchous commented May 5, 2021

dotnet-issue-labeler bot commented May 5, 2021

ghost commented May 5, 2021

bartonjs commented May 5, 2021

annchous commented May 5, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jeffhandley left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jeffhandley commented May 6, 2021

jeffhandley left a comment

Choose a reason for hiding this comment

jeffhandley commented May 6, 2021

jeffhandley commented May 7, 2021

jeffhandley commented May 10, 2021

ghost commented May 10, 2021

p.s. you can customize the way I help with merging this pull request, such as holding this pull request until a specific person approves. Simply @mention me (@msftbot) and give me an instruction to get started! Learn more here.

jeffhandley commented May 10, 2021

jeffhandley commented May 11, 2021

annchous commented May 5, 2021 •

edited

Loading

p.s. you can customize the way I help with merging this pull request, such as holding this pull request until a specific person approves. Simply @mention me (`@msftbot`) and give me an instruction to get started! Learn more here.