Skip to content

Commit bd2bf8e

Browse files
kllysngkllysng
authored
Rm SkipAuthenticationTagLengthValidation and UseShortNameForRsaOaepKey App Context Switches (#2644)
* rm app context switches * update tests * update changelog
1 parent 1517cdd commit bd2bf8e

File tree

9 files changed

+16
-147
lines changed

9 files changed

+16
-147
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ See the [releases](https://github.com/AzureAD/azure-activedirectory-identitymode
55
### Breaking changes:
66
- IdentityModel 8x no longer supports .net461, which has reached end of life and is no longer supported. See issue [#2544](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/2544) for details.
77
- Two IdentityModel extension dlls `Microsoft.IdentityModel.KeyVaultExtensions` and `Microsoft.IdentityModel.ManagedKeyVaultSecurityKey` were using ADAL, which is no longer supported . The affected packages have been removed, as the replacement is to use [Microsoft.Identity.Web](https://github.com/AzureAD/microsoft-identity-web/wiki/Certificates). See issue [#2454](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/2454) for details.
8-
- `AppContext.SetSwitch` which were included in IdentityModel 7x, have been removed and are the default in IdentityModel 8x. The result is a more performant IdentityModel by default. See issue [#2629](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/2629) for details.
8+
- `AppContext.SetSwitch` which were included in IdentityModel 7x, have been removed and are the default in IdentityModel 8x. The result is a more performant IdentityModel by default. See issue [#2629](https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/2629) and https://aka.ms/IdentityModel8x for details.
99

1010
7.6.1
1111
=====

‎src/Microsoft.IdentityModel.Tokens/Encryption/AuthenticatedEncryptionProvider.cs‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@ private struct AuthenticatedKeys
3333
private DecryptionDelegate DecryptFunction;
3434
private EncryptionDelegate EncryptFunction;
3535
private const string _className = "Microsoft.IdentityModel.Tokens.AuthenticatedEncryptionProvider";
36-
internal const string _skipValidationOfAuthenticationTagLength = "Switch.Microsoft.IdentityModel.SkipAuthenticationTagLengthValidation";
3736

3837
/// <summary>
3938
/// Initializes a new instance of the <see cref="AuthenticatedEncryptionProvider"/> class used for encryption and decryption.
@@ -167,8 +166,7 @@ private AuthenticatedEncryptionResult EncryptWithAesCbc(byte[] plaintext, byte[]
167166
private byte[] DecryptWithAesCbc(byte[] ciphertext, byte[] authenticatedData, byte[] iv, byte[] authenticationTag)
168167
{
169168
// Verify authentication Tag
170-
if (ShouldValidateAuthenticationTagLength()
171-
&& SymmetricSignatureProvider.ExpectedSignatureSizeInBytes.TryGetValue(Algorithm, out int expectedTagLength)
169+
if (SymmetricSignatureProvider.ExpectedSignatureSizeInBytes.TryGetValue(Algorithm, out int expectedTagLength)
172170
&& expectedTagLength != authenticationTag.Length)
173171
throw LogHelper.LogExceptionMessage(new SecurityTokenDecryptionFailedException(
174172
LogHelper.FormatInvariant(LogMessages.IDX10625, authenticationTag.Length, expectedTagLength, Base64UrlEncoder.Encode(authenticationTag), Algorithm)));
@@ -197,11 +195,6 @@ private byte[] DecryptWithAesCbc(byte[] ciphertext, byte[] authenticatedData, by
197195
}
198196
}
199197

200-
private static bool ShouldValidateAuthenticationTagLength()
201-
{
202-
return !(AppContext.TryGetSwitch(_skipValidationOfAuthenticationTagLength, out bool skipValidation) && skipValidation);
203-
}
204-
205198
private AuthenticatedKeys CreateAuthenticatedKeys()
206199
{
207200
ValidateKeySize(Key, Algorithm);

‎src/Microsoft.IdentityModel.Tokens/LogMessages.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ internal static class LogMessages
136136
// public const string IDX10622 = "IDX10622:";
137137
// public const string IDX10623 = "IDX10623:";
138138
// public const string IDX10624 = "IDX10624:";
139-
public const string IDX10625 = "IDX10625: Failed to verify the authenticationTag length, the actual tag length '{0}' does not match the expected tag length '{1}'. authenticationTag: '{2}', algorithm: '{3}' See: https://aka.ms/IdentityModel/SkipAuthenticationTagLengthValidation";
139+
public const string IDX10625 = "IDX10625: Failed to verify the authenticationTag length, the actual tag length '{0}' does not match the expected tag length '{1}'. authenticationTag: '{2}', algorithm: '{3}'.";
140140
// public const string IDX10627 = "IDX10627:";
141141
public const string IDX10628 = "IDX10628: Cannot set the MinimumSymmetricKeySizeInBits to less than '{0}'.";
142142
public const string IDX10630 = "IDX10630: The '{0}' for signing cannot be smaller than '{1}' bits. KeySize: '{2}'.";

‎src/Microsoft.IdentityModel.Tokens/X509EncryptingCredentials.cs‎

Lines changed: 1 addition & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,6 @@ namespace Microsoft.IdentityModel.Tokens
1111
/// </summary>
1212
public class X509EncryptingCredentials : EncryptingCredentials
1313
{
14-
internal const string _useShortNameForRsaOaepKey = "Switch.Microsoft.IdentityModel.UseShortNameForRsaOaepKey";
15-
1614
/// <summary>
1715
/// Designed to construct <see cref="EncryptingCredentials"/> based on a x509 certificate.
1816
/// </summary>
@@ -23,7 +21,7 @@ public class X509EncryptingCredentials : EncryptingCredentials
2321
/// </remarks>
2422
/// <exception cref="ArgumentNullException">if 'certificate' is null.</exception>
2523
public X509EncryptingCredentials(X509Certificate2 certificate)
26-
: this(certificate, GetEncryptionAlgorithm(), SecurityAlgorithms.DefaultSymmetricEncryptionAlgorithm)
24+
: this(certificate, SecurityAlgorithms.RsaOAEP, SecurityAlgorithms.DefaultSymmetricEncryptionAlgorithm)
2725
{
2826
}
2927

@@ -50,15 +48,5 @@ public X509Certificate2 Certificate
5048
get;
5149
private set;
5250
}
53-
54-
private static string GetEncryptionAlgorithm()
55-
{
56-
return ShouldUseShortNameForRsaOaepKey() ? SecurityAlgorithms.RsaOAEP : SecurityAlgorithms.DefaultAsymmetricKeyWrapAlgorithm;
57-
}
58-
59-
private static bool ShouldUseShortNameForRsaOaepKey()
60-
{
61-
return AppContext.TryGetSwitch(_useShortNameForRsaOaepKey, out var useKeyWrap) && useKeyWrap;
62-
}
6351
}
6452
}

‎test/Microsoft.IdentityModel.JsonWebTokens.Tests/JsonWebTokenHandlerTests.cs‎

Lines changed: 2 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -4190,10 +4190,9 @@ public static TheoryData<CreateTokenTheoryData> IncludeSecurityTokenOnFailureTes
41904190
}
41914191

41924192
[Theory, MemberData(nameof(ValidateAuthenticationTagLengthTheoryData))]
4193-
public void ValidateTokenAsync_ModifiedAuthNTag(CreateTokenTheoryData theoryData)
4193+
public async Task ValidateTokenAsync_ModifiedAuthNTag(CreateTokenTheoryData theoryData)
41944194
{
41954195
// arrange
4196-
AppContext.SetSwitch(AuthenticatedEncryptionProvider._skipValidationOfAuthenticationTagLength, theoryData.EnableAppContextSwitch);
41974196
var payload = new JObject()
41984197
{
41994198
{ JwtRegisteredClaimNames.Email, "[email protected]" },
@@ -4217,9 +4216,7 @@ public void ValidateTokenAsync_ModifiedAuthNTag(CreateTokenTheoryData theoryData
42174216
var jweWithExtraCharacters = jwe + "_cannoli_hunts_truffles_";
42184217

42194218
// act
4220-
// calling ValidateTokenAsync.Result to prevent tests from sharing app context switch property
4221-
// normally, we would want to await ValidateTokenAsync().ConfigureAwait(false)
4222-
var tokenValidationResult = jsonWebTokenHandler.ValidateTokenAsync(jweWithExtraCharacters, theoryData.ValidationParameters).Result;
4219+
var tokenValidationResult = await jsonWebTokenHandler.ValidateTokenAsync(jweWithExtraCharacters, theoryData.ValidationParameters).ConfigureAwait(false);
42234220

42244221
// assert
42254222
Assert.Equal(theoryData.IsValid, tokenValidationResult.IsValid);
@@ -4281,47 +4278,6 @@ public static TheoryData<CreateTokenTheoryData> ValidateAuthenticationTagLengthT
42814278
ValidIssuer = "http://Default.Issuer.com",
42824279
},
42834280
IsValid = false
4284-
},
4285-
new("A128CBC-HS256_SkipTagLengthValidationAppContextSwitchOn_IsValid")
4286-
{
4287-
EnableAppContextSwitch = true,
4288-
Algorithm = SecurityAlgorithms.Aes128CbcHmacSha256,
4289-
EncryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaPKCS1, SecurityAlgorithms.Aes128CbcHmacSha256),
4290-
ValidationParameters = new TokenValidationParameters
4291-
{
4292-
TokenDecryptionKey = KeyingMaterial.JsonWebKeyRsa256SigningCredentials.Key,
4293-
IssuerSigningKey = Default.SymmetricSigningKey256,
4294-
ValidAudience = "http://Default.Audience.com",
4295-
ValidIssuer = "http://Default.Issuer.com",
4296-
},
4297-
IsValid = true
4298-
},
4299-
new("A192CBC-HS384_SkipTagLengthValidationAppContextSwitchOn_IsValid")
4300-
{
4301-
EnableAppContextSwitch = true,
4302-
Algorithm = SecurityAlgorithms.Aes192CbcHmacSha384,
4303-
EncryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaPKCS1, SecurityAlgorithms.Aes192CbcHmacSha384),
4304-
ValidationParameters = new TokenValidationParameters
4305-
{
4306-
TokenDecryptionKey = KeyingMaterial.JsonWebKeyRsa256SigningCredentials.Key,
4307-
IssuerSigningKey = Default.SymmetricSigningKey256,
4308-
ValidAudience = "http://Default.Audience.com",
4309-
ValidIssuer = "http://Default.Issuer.com",
4310-
},
4311-
IsValid = true
4312-
},
4313-
new("A256CBC-HS512_SkipTagLengthValidationAppContextSwitchOn_IsValid")
4314-
{
4315-
EnableAppContextSwitch = true,
4316-
EncryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaPKCS1, SecurityAlgorithms.Aes256CbcHmacSha512),
4317-
ValidationParameters = new TokenValidationParameters
4318-
{
4319-
TokenDecryptionKey = signingCredentials512.Key,
4320-
IssuerSigningKey = Default.SymmetricSigningKey256,
4321-
ValidAudience = "http://Default.Audience.com",
4322-
ValidIssuer = "http://Default.Issuer.com",
4323-
},
4324-
IsValid = true
43254281
}
43264282
};
43274283
}
@@ -4370,8 +4326,6 @@ public CreateTokenTheoryData(string testId) : base(testId)
43704326
public IEnumerable<SecurityKey> ExpectedDecryptionKeys { get; set; }
43714327

43724328
public Dictionary<string, object> ExpectedClaims { get; set; }
4373-
4374-
public bool EnableAppContextSwitch { get; set; } = false;
43754329
}
43764330

43774331
// Overrides CryptoProviderFactory.CreateAuthenticatedEncryptionProvider to create AuthenticatedEncryptionProviderMock that provides AesGcm encryption.

‎test/Microsoft.IdentityModel.Tokens.Tests/EncryptingCredentialsTests.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ public static TheoryData<EncryptingCredentialsTheoryData> ConstructorATheoryData
5757
new EncryptingCredentialsTheoryData
5858
{
5959
Key = null,
60-
Alg = SecurityAlgorithms.RsaOaepKeyWrap,
60+
Alg = SecurityAlgorithms.RsaOAEP,
6161
Enc = SecurityAlgorithms.Aes128CbcHmacSha256,
6262
ExpectedException = ExpectedException.ArgumentNullException("IDX10000: The parameter 'key'"),
6363
TestId = "NullKey"
@@ -73,7 +73,7 @@ public static TheoryData<EncryptingCredentialsTheoryData> ConstructorATheoryData
7373
new EncryptingCredentialsTheoryData
7474
{
7575
Key = Default.AsymmetricEncryptionKeyPublic,
76-
Alg = SecurityAlgorithms.RsaOaepKeyWrap,
76+
Alg = SecurityAlgorithms.RsaOAEP,
7777
Enc = String.Empty,
7878
ExpectedException = ExpectedException.ArgumentNullException("IDX10000: The parameter 'enc'"),
7979
TestId = "EmptyEncString"
@@ -89,15 +89,15 @@ public static TheoryData<EncryptingCredentialsTheoryData> ConstructorATheoryData
8989
new EncryptingCredentialsTheoryData
9090
{
9191
Key = Default.AsymmetricEncryptionKeyPublic,
92-
Alg = SecurityAlgorithms.RsaOaepKeyWrap,
92+
Alg = SecurityAlgorithms.RsaOAEP,
9393
Enc = null,
9494
ExpectedException = ExpectedException.ArgumentNullException("IDX10000: The parameter 'enc'"),
9595
TestId = "NullEncString"
9696
},
9797
new EncryptingCredentialsTheoryData
9898
{
9999
Key = Default.AsymmetricEncryptionKeyPublic,
100-
Alg = SecurityAlgorithms.RsaOaepKeyWrap,
100+
Alg = SecurityAlgorithms.RsaOAEP,
101101
Enc = SecurityAlgorithms.Aes128CbcHmacSha256,
102102
TestId = "ValidTest"
103103
}

‎test/Microsoft.IdentityModel.Tokens.Tests/MultiThreadingTests.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ public static TheoryData<MultiThreadingTheoryData> MultiThreadingCreateAndVerify
121121
{
122122
Claims = Default.PayloadDictionary,
123123
SigningCredentials = new SigningCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaSha256, SecurityAlgorithms.Sha256),
124-
EncryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOaepKeyWrap, SecurityAlgorithms.Aes128CbcHmacSha256)
124+
EncryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKey_2048, SecurityAlgorithms.RsaOAEP, SecurityAlgorithms.Aes128CbcHmacSha256)
125125
};
126126

127127
var tokenValidationParametersEncryptedRsaKW = new TokenValidationParameters
@@ -174,7 +174,7 @@ public static TheoryData<MultiThreadingTheoryData> MultiThreadingCreateAndVerify
174174
{
175175
Claims = Default.PayloadDictionary,
176176
SigningCredentials = new SigningCredentials(KeyingMaterial.RsaSecurityKeyCng_2048, SecurityAlgorithms.RsaSha256, SecurityAlgorithms.Sha256),
177-
EncryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKeyCng_2048, SecurityAlgorithms.RsaOaepKeyWrap, SecurityAlgorithms.Aes128CbcHmacSha256)
177+
EncryptingCredentials = new EncryptingCredentials(KeyingMaterial.RsaSecurityKeyCng_2048, SecurityAlgorithms.RsaOAEP, SecurityAlgorithms.Aes128CbcHmacSha256)
178178
};
179179

180180
var tokenValidationParametersEncryptedRsaKWCng = new TokenValidationParameters

‎test/Microsoft.IdentityModel.Tokens.Tests/X509EncryptingCredentialsTests.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ public static TheoryData<X509EncryptingCredentialsTheoryData> ConstructorsTheory
4242
new X509EncryptingCredentialsTheoryData
4343
{
4444
Certificate = null,
45-
Alg = SecurityAlgorithms.RsaOaepKeyWrap,
45+
Alg = SecurityAlgorithms.RsaOAEP,
4646
Enc = SecurityAlgorithms.Aes128CbcHmacSha256,
4747
ExpectedException = ExpectedException.ArgumentNullException("IDX10000: The parameter 'certificate'"),
4848
TestId = "NullCertificate"
@@ -58,7 +58,7 @@ public static TheoryData<X509EncryptingCredentialsTheoryData> ConstructorsTheory
5858
new X509EncryptingCredentialsTheoryData
5959
{
6060
Certificate = Default.Certificate,
61-
Alg = SecurityAlgorithms.RsaOaepKeyWrap,
61+
Alg = SecurityAlgorithms.RsaOAEP,
6262
Enc = String.Empty,
6363
ExpectedException = ExpectedException.ArgumentNullException("IDX10000: The parameter 'enc'"),
6464
TestId = "EmptyEncString"
@@ -74,15 +74,15 @@ public static TheoryData<X509EncryptingCredentialsTheoryData> ConstructorsTheory
7474
new X509EncryptingCredentialsTheoryData
7575
{
7676
Certificate = Default.Certificate,
77-
Alg = SecurityAlgorithms.RsaOaepKeyWrap,
77+
Alg = SecurityAlgorithms.RsaOAEP,
7878
Enc = null,
7979
ExpectedException = ExpectedException.ArgumentNullException("IDX10000: The parameter 'enc'"),
8080
TestId = "NullEncString"
8181
},
8282
new X509EncryptingCredentialsTheoryData
8383
{
8484
Certificate = Default.Certificate,
85-
Alg = SecurityAlgorithms.RsaOaepKeyWrap,
85+
Alg = SecurityAlgorithms.RsaOAEP,
8686
Enc = SecurityAlgorithms.Aes128CbcHmacSha256,
8787
TestId = "ValidTest"
8888
}

‎test/System.IdentityModel.Tokens.Jwt.Tests/JwtSecurityTokenHandlerTests.WithContextSwitches.cs‎

Lines changed: 0 additions & 66 deletions
This file was deleted.

0 commit comments

Comments
 (0)