dotnet / dotnet/dotnet-api-docs

Document IV truncation for .NET Framework but not .NET Core for TripleDESCryptoServiceProvider

Open
#3,272 1 comment 0 reactions 0 assignees View on GitHub
area-System.Security doc-enhancement Pri3
Dominant language
C#
Stars
949
Forks
1.7k
Avg merge
3d 27m
Merged PRs (30d)
49

Description

**Issue description**

👋 Hi docs folks! On Corefx [an issue was filed][1] because of a compatibility difference between .NET Framework and .NET Core for the `TripleDESCryptoServiceProvider` class that isn't documented anywhere except in the comments of the .NET Framework reference source.

The gist is the initialization vector on `TripleDESCryptoServiceProvider` (either the `IV` property or the `rbgIV` parameter on `CreateEncryptor` and `CreateDecryptor` methods) accepts a byte array. In .NET Core, that byte array for IV must be equal to a valid block size of the algorithm. For 3DES, that's 64-bits (8 bytes).

In .NET _Framework_, it would silently just use the first 8 bytes, even if you gave it 9, or 20.

When migrating from the .NET Framework to .NET Core, users that were erroneously passing in more than 8 bytes started getting exceptions. The fix for this is to just change your code during the migration to pass in just the first 8 bytes.

I'm happy to try to submit a pull request for this, but I'm not sure the best way or place to communicate this. In the remarks section for the class?

**Target framework**

Check the .NET target framework(s) being used, and include the version number(s).

- [X] .NET Core (2.0, 2.1)
- [X] .NET Framework (all of them)
- [ ] .NET Standard

[1]: https://github.com/dotnet/corefx/issues/32694#issuecomment-427970128

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.