Document IV truncation for .NET Framework but not .NET Core for TripleDESCryptoServiceProvider #3272
Open
2 of 3 tasks
Labels
area-System.Security
Issues related to security practices for .NET developers.
doc-enhancement
Improve the current content
Pri3
Indicates issues/PRs that are low priority
Milestone
Issue description
👋 Hi docs folks! On Corefx an issue was filed because of a compatibility difference between .NET Framework and .NET Core for the
TripleDESCryptoServiceProvider
class that isn't documented anywhere except in the comments of the .NET Framework reference source.The gist is the initialization vector on
TripleDESCryptoServiceProvider
(either theIV
property or therbgIV
parameter onCreateEncryptor
andCreateDecryptor
methods) accepts a byte array. In .NET Core, that byte array for IV must be equal to a valid block size of the algorithm. For 3DES, that's 64-bits (8 bytes).In .NET Framework, it would silently just use the first 8 bytes, even if you gave it 9, or 20.
When migrating from the .NET Framework to .NET Core, users that were erroneously passing in more than 8 bytes started getting exceptions. The fix for this is to just change your code during the migration to pass in just the first 8 bytes.
I'm happy to try to submit a pull request for this, but I'm not sure the best way or place to communicate this. In the remarks section for the class?
Target framework
Check the .NET target framework(s) being used, and include the version number(s).
The text was updated successfully, but these errors were encountered: