.NET Core 2.0 Cryptography uses Apple Security Framework on macOS

# .NET Core 2.0 Cryptography uses Apple Security Framework on macOS

## Summary

As part of the .NET Core 2.0 release, .NET Core cryptography APIs were changed to use the [Apple Security Framework](https://developer.apple.com/documentation/Security) when running on macOS (10.12 and later versions). .NET Core 1.x uses [OpenSSL](https://www.openssl.org/) on macOS/OS X (10.11 and later versions).

There were two challenges with using OpenSSL on macOS that motivated this change:

* Apple [deprecated the use of OpenSSL on macOS](https://developer.apple.com/library/content/documentation/Security/Conceptual/cryptoservices/GeneralPurposeCrypto/GeneralPurposeCrypto.html#//apple_ref/doc/uid/TP40011172-CH9-SW9) (see the OpenSSL section).
* OpenSSL is not part of the macOS operating system and must be separately installed via [Homebrew](https://brew.sh/). This dependency, which was the only .NET Core dependency on macOS, added friction to using .NET Core on macOS.

.NET Core now uses the cryptography API that is offered for each operating system:

* [Apple Security Framework](https://developer.apple.com/documentation/Security) on macOS
* [OpenSSL](https://www.openssl.org/) on Linux
* [CNG](https://msdn.microsoft.com/library/windows/desktop/aa376210.aspx) on Windows

## Details

* [dotnet/corefx #9394](https://github.com/dotnet/corefx/issues/9394)
* [dotnet/corefx #17011](https://github.com/dotnet/corefx/pull/17011)
* [Cross-Platform Cryptography](https://github.com/dotnet/corefx/blob/master/Documentation/architecture/cross-platform-cryptography.md)

## Impact

All cryptography functionality is now provided by the [Apple Security Framework](https://developer.apple.com/documentation/Security). Only types whose name includes "OpenSsl", such as [RSAOpenSsl](https://docs.microsoft.com/dotnet/api/system.security.cryptography.rsaopenssl), will continue to use OpenSSL on macOS. When using these APIs, OpenSSL needs to be installed separately via [Homebrew](https://brew.sh/) since .NET Core doesn't install it.

The following types now use the Apple Security framework:

* [RSA](https://docs.microsoft.com/dotnet/api/system.security.cryptography.rsa?view=netcore-2.0), [DSA](https://docs.microsoft.com/dotnet/api/system.security.cryptography.dsa?view=netcore-2.0), and [ECDSA](https://docs.microsoft.com/dotnet/api/system.security.cryptography.ecdsa?view=netcore-2.0) use [SecKeyRef](https://developer.apple.com/documentation/security/seckeyref)
* No new public interop types were added with this change, they can come in the future.
* Apple doesn't allow new DSA keys to be generated. This is import/certs only.
* [X509Certificate](https://docs.microsoft.com/dotnet/api/system.security.cryptography.x509certificates.x509certificate?view=netcore-2.0) and [X509Certificate2](https://docs.microsoft.com/dotnet/api/system.security.cryptography.x509certificates.x509certificate2?view=netcore-2.0) use [SecCertificateRef](https://developer.apple.com/documentation/security/seccertificateref), and [SecIdentityRef](https://developer.apple.com/documentation/security/secidentityref)
* [X509Chain](https://docs.microsoft.com/dotnet/api/system.security.cryptography.x509certificates.x509chain?view=netcore-2.0) uses [SecTrustRef](https://developer.apple.com/documentation/security/sectrustref)
* [X509Store](https://docs.microsoft.com/dotnet/api/system.security.cryptography.x509certificates.x509store?view=netcore-2.0) uses [Keychain](https://developer.apple.com/documentation/security/keychain_services) (CU\My, LM\My), [SecTrustSettings](https://developer.apple.com/documentation/security/certificate_key_and_trust_services/trust) (CU/LM Root/Disallowed)
* [SslStream](https://docs.microsoft.com/dotnet/api/system.net.security.sslstream) uses Secure Transport ([SslContextRef](https://developer.apple.com/documentation/security/sslcontextref))

There are some cryptography operations that were supported by OpenSSL on macOS that are no longer supported with the new implementation, due to the functionality provided by the Apple Security Framework. See the [Cross-Platform Cryptography](https://github.com/dotnet/corefx/blob/master/Documentation/architecture/cross-platform-cryptography.md) document to learn about cryptography support per operating system.

The following types/scenarios have been affected by this change:

* HTTPS: libcurl
* Understanding that libcurl+openssl is special has been removed.
* OID lookup moves to a fixed set of data due to lack of exposed platform API.