Prefer using non-deprecated EC OSSL APIs where possible by PranavSenthilnathan · Pull Request #127190 · dotnet/runtime

PranavSenthilnathan · 2026-04-20T23:34:49Z

Adds new native entry points that use the modern OpenSSL 3.0 EVP_PKEY parameter and keygen APIs for EC key
generation, import, and export, avoiding the deprecated EC_KEY APIs where possible.

On pre-3.0 OpenSSL, the existing EC_KEY code paths are preserved as fallbacks. All new lightup APIs are guarded with
API_EXISTS under FEATURE_DISTRO_AGNOSTIC_SSL.

Unified EC APIs (EC_GROUP_get/set_curve, EC_POINT_get/set_affine_coordinates) are promoted to REQUIRED (available
since OpenSSL 1.1.1, which is the minimum supported version).

dotnet-policy-service · 2026-04-20T23:35:40Z

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

Copilot

Pull request overview

This PR introduces new OpenSSL 3.0+ EVP_PKEY-based EC key generation/import paths (to avoid deprecated EC_KEY APIs where possible), with managed code updated to prefer these paths and fall back to legacy behavior when needed.

Changes:

Add native CryptoNative exports to generate/import EC keys via EVP_PKEY (named curves and explicit parameters).
Update managed ECOpenSsl/ECDH code to use the new EVP_PKEY paths first, with legacy EC_KEY fallback.
Extend the OpenSSL shim to light up additional OpenSSL 3.0 param-building/keygen APIs.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/native/libs/System.Security.Cryptography.Native/pal_ecc_import_export.h	Adds new native API declarations for EVP_PKEY EC key generation/import.
src/native/libs/System.Security.Cryptography.Native/pal_ecc_import_export.c	Implements EVP_PKEY-based EC keygen and fromdata import (named + explicit).
src/native/libs/System.Security.Cryptography.Native/opensslshim.h	Lights up OpenSSL 3.0 param_build and related functions used by new native code.
src/native/libs/System.Security.Cryptography.Native/entrypoints.c	Exposes the new native functions via the CryptoNative entrypoint table.
src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.cs	Prefers EVP_PKEY EC keygen/import for OpenSSL 3.0 with fallback to EC_KEY.
src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSslPublicKey.cs	Stores/uses EVP_PKEY handles directly instead of wrapping EC_KEY.
src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSsl.Derive.cs	Uses EVP_PKEY curve-name detection and imports via new ECOpenSsl helpers.
src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs	Adds P/Invoke wrappers for the new CryptoNative EVP_PKEY EC APIs.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 13 comments.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 7 comments.

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 7 comments.

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated 5 comments.

Copilot

Pull request overview

Copilot reviewed 14 out of 14 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 7 comments.

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

src/native/libs/System.Security.Cryptography.Native/pal_ecc_import_export.c:403

CryptoNative_EcKeyCreateByKeyParameters calls EC_KEY_new_by_curve_name / EC_KEY_set_* / EC_KEY_check_key / EC_KEY_free. After making EC_KEY_* LIGHTUP under FEATURE_DISTRO_AGNOSTIC_SSL, these function pointers can be NULL (e.g., OpenSSL built without deprecated EC_KEY APIs), which would crash via a NULL call. Add an API_EXISTS guard early and return a clean failure when EC_KEY APIs are unavailable.

int32_t CryptoNative_EcKeyCreateByKeyParameters(EC_KEY** key, const char* oid, const uint8_t* qx, int32_t qxLength, const uint8_t* qy, int32_t qyLength, const uint8_t* d, int32_t dLength)
{
    if (!key || !oid)
    {
        assert(false);

PranavSenthilnathan · 2026-06-11T23:22:22Z

@dotnet-policy-service rerun

ec changes

d64dad9

PranavSenthilnathan self-assigned this Apr 20, 2026

Copilot AI review requested due to automatic review settings April 20, 2026 23:34

PranavSenthilnathan added the area-System.Security label Apr 20, 2026

Copilot started reviewing on behalf of PranavSenthilnathan April 20, 2026 23:35 View session

Copilot AI reviewed Apr 20, 2026

View reviewed changes

This was referenced Apr 21, 2026

Android arm32 device not found (armeabi-v7a architecture unavailable) #125440

Closed

Libraries .NET 4.8.1 build failing #127007

Closed

PranavSenthilnathan added 3 commits April 20, 2026 23:24

fix pub key computation and key size

43775ae

missed case with GenerateECKey creating EC_KEY

6afa0f7

add tests

a619c89

Copilot AI review requested due to automatic review settings April 22, 2026 23:16

Copilot started reviewing on behalf of PranavSenthilnathan April 22, 2026 23:16 View session

Copilot AI reviewed Apr 22, 2026

View reviewed changes

PranavSenthilnathan added 3 commits April 23, 2026 16:48

remove EC2M paths where possible and cleanup

6535dcc

some more cleanup

3bdb9d7

style and cleanup

556f5d5

Copilot AI review requested due to automatic review settings April 24, 2026 18:40

Copilot started reviewing on behalf of PranavSenthilnathan April 24, 2026 18:41 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

PranavSenthilnathan added 2 commits April 24, 2026 12:06

PR comments

883529f

validate curve

d0b37ac

Copilot AI review requested due to automatic review settings April 24, 2026 19:14

Copilot started reviewing on behalf of PranavSenthilnathan April 24, 2026 19:15 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings May 15, 2026 15:27

Copilot started reviewing on behalf of PranavSenthilnathan May 15, 2026 15:27 View session

Copilot AI reviewed May 15, 2026

View reviewed changes

PranavSenthilnathan added 2 commits May 15, 2026 18:08

PR feedback

75d6507

Add EC_KEY ctor tests

19be6c2

Copilot AI review requested due to automatic review settings May 15, 2026 19:10

Copilot started reviewing on behalf of PranavSenthilnathan May 15, 2026 19:10 View session

Copilot AI reviewed May 15, 2026

View reviewed changes

build-analysis Bot mentioned this pull request May 16, 2026

ExceptionHandlingExpressions.ExpressionsUnwrapeExternallyThrownRuntimeWrappedException failure #128164

Open

bartonjs reviewed Jun 3, 2026

View reviewed changes

PranavSenthilnathan added 2 commits June 5, 2026 07:25

address PR comments

971290d

Fix build against ossl 1.1.1

c48ae1a

Copilot AI review requested due to automatic review settings June 5, 2026 20:48

Copilot started reviewing on behalf of PranavSenthilnathan June 5, 2026 20:48 View session

Copilot AI reviewed Jun 5, 2026

View reviewed changes

AI feedback

bd6032a

build-analysis Bot mentioned this pull request Jun 6, 2026

slow macOS - "##[error]The job running on agent Azure Pipelines 9 ran longer than the maximum time of 60 minutes." dotnet/dnceng#1883

Open

3 tasks

bartonjs reviewed Jun 8, 2026

View reviewed changes

Comment thread src/native/libs/System.Security.Cryptography.Native/pal_ecc_import_export.c

bartonjs approved these changes Jun 8, 2026

View reviewed changes

Fix tests

b02395a

Copilot AI review requested due to automatic review settings June 10, 2026 19:45

Copilot started reviewing on behalf of PranavSenthilnathan June 10, 2026 19:46 View session

Copilot AI reviewed Jun 10, 2026

View reviewed changes

Comment thread src/native/libs/System.Security.Cryptography.Native/pal_ecc_import_export.c

fix source build and a test failure

4f1017a

This was referenced Jun 11, 2026

NuGet failing with Response status code does not indicate success: 503 (Service Unavailable) dotnet/arcade#11723

Open

CI build failure: error CS8032: An instance of analyzer Microsoft.NetCore.CSharp.Analyzers.... cannot be created #129031

Open

PranavSenthilnathan merged commit 397e72c into dotnet:main Jun 11, 2026
116 checks passed

PranavSenthilnathan deleted the ossl-deprecations-ec branch June 11, 2026 23:26

dotnet-maestro Bot mentioned this pull request Jun 12, 2026

[main] Source code updates from dotnet/runtime dotnet/dotnet#7196

Open

Conversation

PranavSenthilnathan commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dotnet-policy-service Bot commented Apr 20, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

PranavSenthilnathan commented Apr 20, 2026 •

edited

Loading