X25519: Handle zero peer keys on downlevel Windows platforms by vcsjones · Pull Request #134535 · dotnet/runtime

vcsjones · 2026-09-23T18:28:01Z

An all-zero peer (public) key should always produce a zero shared secret, which should get rejected during key agreement.

Windows normally rejects this during importation time, but that is not enabled because Windows would also eagerly reject off-twist public keys which should work. With this change, when a "zero" public key is imported (either by naturally being zero or reduced to zero) we skip importing it into bcrypt and retain "This was a zero key". During derivation we throw since that would produce a zero shared secret. This keeps Windows consistent with other platforms, where import is not the protected path, but derivation is.

For X25519DHCng (ncrypt) its not possible to really gate this when the peer key is zero. However that responsibility falls to the person creating the public key handle, and the handle is external in this case.

This was discovered with HPKE tests in #134528.

Add the Wycheproof all-zero public-key vector to each raw secret agreement overload. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

vcsjones · 2026-09-23T18:28:14Z

/azp run runtime

vcsjones · 2026-09-23T18:28:39Z

Draft and NO-REVIEW because this PR does not contain the fix, yet. I want to see the tests fail in CI before pushing the fix.

azure-pipelines · 2026-09-23T18:28:40Z

Azure Pipelines: Successfully started running 1 pipeline(s).

azure-pipelines · 2026-09-23T18:28:47Z

Azure Pipelines: Successfully started running 3 pipeline(s). 13 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

dotnet-policy-service · 2026-09-23T18:29:00Z

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

vcsjones · 2026-09-23T18:45:56Z

/azp run runtime-coreclr libraries-jitstress

azure-pipelines · 2026-09-23T18:46:06Z

Azure Pipelines: Successfully started running 1 pipeline(s).

vcsjones · 2026-09-23T20:25:17Z

Confirmed in jitstress test run https://helixr1107v0xdcypoyl9e7f.blob.core.windows.net/dotnet-runtime-refs-pull-134535-merge-73a894a0113b416799/System.Security.Cryptography.Tests/1/console.72dee97e.log?helixlogtype=result

Assert.ThrowsAny() Failure: No exception was thrown Expected: typeof(System.Security.Cryptography.CryptographicException) Stack Trace: /_/src/libraries/Common/tests/System/Security/Cryptography/X25519DiffieHellmanBaseTests.cs(306,0): at System.Security.Cryptography.Tests.X25519DiffieHellmanBaseTests.DeriveRawSecretAgreement_Bytes_ZeroSharedSecret_Throws(String peerPublicKeyHex) at InvokeStub_X25519DiffieHellmanBaseTests.DeriveRawSecretAgreement_Bytes_ZeroSharedSecret_Throws(Object, Span`1) /_/src/libraries/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.cs(95,0): at System.Reflection.MethodBaseInvoker.InvokeWithOneArg(Object obj, BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)

Detect peer public keys that reduce to zero before invoking downlevel Windows CNG implementations that can return an incorrect nonzero shared secret. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

vcsjones · 2026-09-23T20:29:03Z

/azp run runtime-coreclr libraries-jitstress

azure-pipelines · 2026-09-23T20:29:13Z

Azure Pipelines: Successfully started running 1 pipeline(s).

Copilot

Copilot review overview

🟡 Changes recommended

One or more issues must be addressed before approval.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

Add non-canonical field-prime input to test key reduction · New

What changed in this PR

Fixes Windows X25519 agreement with all-zero peer keys by rejecting reduced-zero public keys before deriving a secret.

Changes:

Added zero-key coverage across raw agreement overloads.
Added reduced-zero detection to both Windows X25519 implementations.

File	Description
src/libraries/Common/tests/System/Security/Cryptography/X25519DiffieHellmanBaseTests.cs	Updated as part of this pull request.
src/libraries/Common/src/System/Security/Cryptography/X25519DiffieHellmanImplementation.Windows.cs	Updated as part of this pull request.
src/libraries/Common/src/System/Security/Cryptography/X25519DiffieHellmanCng.Windows.cs	Updated as part of this pull request.

vcsjones · 2026-09-23T20:48:59Z

/azp run runtime-coreclr libraries-jitstress

azure-pipelines · 2026-09-23T20:49:09Z

Azure Pipelines: Successfully started running 1 pipeline(s).

Copilot

Copilot review overview

🟢 Approval recommended

No unresolved issues were identified that would block approval.

Review effort: Lite
Findings: None

Resolved since last review (1)

Add non-canonical field-prime input to test key reduction

Continue testing reduced-zero peer values through raw-byte APIs on all Windows versions while limiting CngKey object round-trip coverage to Windows 11 and newer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

vcsjones · 2026-09-23T22:57:15Z

/azp run runtime-coreclr libraries-jitstress

azure-pipelines · 2026-09-23T22:57:25Z

Azure Pipelines: Successfully started running 1 pipeline(s).

Copilot

Copilot review overview

🔵 Needs a closer look

One or more issues must be addressed before approval.

Review effort: Lite
Findings: None

Caller-supplied CngKey objects may reject or transform reduced-zero public values during provider import, so retain this coverage through the raw-byte APIs instead. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

vcsjones · 2026-09-24T01:37:07Z

/azp run runtime-coreclr libraries-jitstress

azure-pipelines · 2026-09-24T01:37:17Z

Azure Pipelines: Successfully started running 1 pipeline(s).

Copilot

Copilot review overview

🔵 Needs a closer look

One or more issues must be addressed before approval.

Review effort: Lite
Findings: None

vcsjones · 2026-09-24T13:37:11Z

/azp run runtime-coreclr libraries-jitstress

azure-pipelines · 2026-09-24T13:37:27Z

Azure Pipelines: Successfully started running 1 pipeline(s).

vcsjones · 2026-09-24T18:01:58Z

/backport to release/11.0

github-actions · 2026-09-24T18:02:09Z

Started backporting to release/11.0 (link to workflow run)

Test zero X25519 peer public keys

64ec184

Add the Wycheproof all-zero public-key vector to each raw secret agreement overload. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

vcsjones added this to the 12.0.0 milestone Sep 23, 2026

vcsjones self-assigned this Sep 23, 2026

vcsjones added NO-REVIEW Experimental/testing PR, do NOT review it area-System.Security labels Sep 23, 2026

vcsjones deployed to copilot-pat-pool September 23, 2026 18:28 — with GitHub Actions Active

Reject zero X25519 peer keys on Windows

a8249b9

Detect peer public keys that reduce to zero before invoking downlevel Windows CNG implementations that can return an incorrect nonzero shared secret. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

vcsjones removed the NO-REVIEW Experimental/testing PR, do NOT review it label Sep 23, 2026

Merge branch 'main' into x25519-peer-zeros

3201f59

vcsjones marked this pull request as ready for review September 23, 2026 20:28

Copilot AI lite review requested due to automatic review settings September 23, 2026 20:28

Copilot started reviewing on behalf of vcsjones September 23, 2026 20:29 View session

Copilot AI reviewed Sep 23, 2026

View reviewed changes

Comment thread src/libraries/Common/tests/System/Security/Cryptography/X25519DiffieHellmanBaseTests.cs Outdated

Add a non-canonical key that reduces to zero as a test key

9f9233c

Copilot AI review requested due to automatic review settings September 23, 2026 20:47

Copilot started reviewing on behalf of vcsjones September 23, 2026 20:48 View session

Copilot AI reviewed Sep 23, 2026

View reviewed changes

bartonjs reviewed Sep 23, 2026

View reviewed changes

Comment thread ...braries/Common/src/System/Security/Cryptography/X25519DiffieHellmanImplementation.Windows.cs

bartonjs approved these changes Sep 23, 2026

View reviewed changes

vcsjones enabled auto-merge (squash) September 23, 2026 22:02

vcsjones disabled auto-merge September 23, 2026 22:31

Guard reduced-zero CNG object tests on Windows 10

0938ca2

Continue testing reduced-zero peer values through raw-byte APIs on all Windows versions while limiting CngKey object round-trip coverage to Windows 11 and newer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings September 23, 2026 22:55

Copilot started reviewing on behalf of vcsjones September 23, 2026 22:55 View session

Copilot AI reviewed Sep 23, 2026

View reviewed changes

build-analysis Bot mentioned this pull request Sep 23, 2026

STATUS_UNSUCCESSFUL in RsaCryptRoundtrip_OaepSHA1 #29683

Open

bartonjs approved these changes Sep 23, 2026

View reviewed changes

vcsjones and others added 2 commits September 23, 2026 21:26

Don't import zero-ish public keys at all for bcrypt

5de2f63

Exclude reduced-zero CngKey object tests

0598ca0

Caller-supplied CngKey objects may reject or transform reduced-zero public values during provider import, so retain this coverage through the raw-byte APIs instead. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot AI review requested due to automatic review settings September 24, 2026 01:36

Copilot started reviewing on behalf of vcsjones September 24, 2026 01:37 View session

Copilot AI reviewed Sep 24, 2026

View reviewed changes

build-analysis Bot mentioned this pull request Sep 24, 2026

System.TimeoutException in System.Net.Security.Tests.TlsSessionTests.SocketBoundSession_RequestClientCertificate_DrivesSecondHandshakeToCompletion #134222

Open

bartonjs approved these changes Sep 24, 2026

View reviewed changes

vcsjones merged commit dc61491 into dotnet:main Sep 24, 2026
90 of 93 checks passed

vcsjones deleted the x25519-peer-zeros branch September 24, 2026 18:02

github-actions Bot mentioned this pull request Sep 24, 2026

[release/11.0] X25519: Handle zero peer keys on downlevel Windows platforms #134607

Open

2 of 4 tasks

Conversation

vcsjones commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vcsjones commented Sep 23, 2026

Uh oh!

vcsjones commented Sep 23, 2026

Uh oh!

azure-pipelines Bot commented Sep 23, 2026

Uh oh!

azure-pipelines Bot commented Sep 23, 2026

Uh oh!

dotnet-policy-service Bot commented Sep 23, 2026

Uh oh!

vcsjones commented Sep 23, 2026

Uh oh!

azure-pipelines Bot commented Sep 23, 2026

Uh oh!

vcsjones commented Sep 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vcsjones commented Sep 23, 2026

Uh oh!

azure-pipelines Bot commented Sep 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

vcsjones commented Sep 23, 2026

Uh oh!

azure-pipelines Bot commented Sep 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟢 Approval recommended

Uh oh!

Uh oh!

vcsjones commented Sep 23, 2026

Uh oh!

azure-pipelines Bot commented Sep 23, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

vcsjones commented Sep 24, 2026

Uh oh!

azure-pipelines Bot commented Sep 24, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🔵 Needs a closer look

Uh oh!

vcsjones commented Sep 24, 2026

Uh oh!

azure-pipelines Bot commented Sep 24, 2026

Uh oh!

Uh oh!

vcsjones commented Sep 24, 2026

Uh oh!

github-actions Bot commented Sep 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

vcsjones commented Sep 23, 2026 •

edited

Loading

vcsjones commented Sep 23, 2026 •

edited

Loading