fix FIPS enabled context header creation in ManagedAuthenticatedEncryptor#65186
Conversation
There was a problem hiding this comment.
Pull request overview
This PR fixes a FIPS compliance issue in ASP.NET Core 10's Data Protection APIs. The problem was introduced by performance optimizations in PR #59424, which started using HMACSHA512.TryHashData static method. This static method fails in FIPS mode when the key is less than 14 bytes (112 bits), as required by NIST SP 800-131A Rev. 2.
Changes:
- Added FIPS-compliant key length validation in
ManagedSP800_108_CTR_HMACSHA512.DeriveKeys - Falls back to instance-based HMAC for keys < 14 bytes to maintain FIPS compatibility
- Added regression tests for empty KDK scenario that triggered the original issue
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| src/DataProtection/DataProtection/src/SP800_108/ManagedSP800_108_CTR_HMACSHA512.cs | Implements FIPS-compliant key length check and fallback logic for short keys, along with conditional code path in the private DeriveKeys method |
| src/DataProtection/DataProtection/test/Microsoft.AspNetCore.DataProtection.Tests/SP800_108/SP800_108Tests.cs | Adds regression test covering the empty key scenario used by CreateContextHeader() |
src/DataProtection/DataProtection/src/SP800_108/ManagedSP800_108_CTR_HMACSHA512.cs
Show resolved
Hide resolved
src/DataProtection/DataProtection/src/SP800_108/ManagedSP800_108_CTR_HMACSHA512.cs
Outdated
Show resolved
Hide resolved
adityamandaleeka
left a comment
There was a problem hiding this comment.
LGTM modulo my comment and Copilot's
src/DataProtection/DataProtection/src/SP800_108/ManagedSP800_108_CTR_HMACSHA512.cs
Show resolved
Hide resolved
|
/azp run |
|
Azure Pipelines successfully started running 2 pipeline(s). |
|
/backport to release/10.0 |
|
Started backporting to |
|
@DeagleGross backporting to git am output$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch
Patch format detection failed.
Error: The process '/usr/bin/git' failed with exit code 128 |
When initializing
ManagedAuthenticatedEncryptorwe are callingCreateContextHeader()in the constructor, and during that call we invokeManagedSP800_108_CTR_HMACSHA512.DeriveKeys(kdk: EMPTY_ARRAY, ...)with the kdk of empty array value.In #59424 we improved the allocations in NET10 on this path by eventually calling
Unfortunately, for FIPS environment,
HMACSHA512.TryHashDatafails when kdk provided is less than 14 bytes. Current fix ensures, that if kdk is less than 14 bytes, then we will go with using prf and allocating the buffer. It is not on a hotpath, and for most cases kdk is bigger than 14 bytes (its 64 bytes), so it will not impact performance nearly anyhow.here is the sample app to prove that 14 bytes is the minimum for FIPS environment:
and i can see the change of results happening specifically around 14 bytes length. Also documented in this NIST SP 800-131A Rev 2.:
Fixes #64597