Merge and addapt Secure channel enhancements to new master code

Applications/ConsoleReferenceClient/ClientSamples.cs

@@ -857,7 +857,7 @@ await uaClient
             result.Sort((x, y) => x.NodeId.CompareTo(y.NodeId));
 
             m_logger.LogInformation(
-                "ManagedBrowseFullAddressSpace found {Count} references on server in {Duration}ms.",
+                "ManagedBrowseFullAddressSpace found {Count} references on server in {Duration} ms.",
                 result.Count,
                 stopWatch.ElapsedMilliseconds);
 
@@ -1078,7 +1078,7 @@ BrowseDescriptionCollection browseDescriptionCollection
             result.Sort((x, y) => x.NodeId.CompareTo(y.NodeId));
 
             m_logger.LogInformation(
-                "BrowseFullAddressSpace found {Count} references on server in {Duration}ms.",
+                "BrowseFullAddressSpace found {Count} references on server in {Duration} ms.",
                 referenceDescriptions.Count,
                 stopWatch.ElapsedMilliseconds);
 

Applications/ConsoleReferenceServer/Quickstarts.ReferenceServer.Config.xml

@@ -166,6 +166,38 @@
         <SecurityMode>SignAndEncrypt_3</SecurityMode>
         <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_brainpoolP384r1</SecurityPolicyUri>
       </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>Sign_2</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP256_AesGcm</SecurityPolicyUri>
+      </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>SignAndEncrypt_3</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_nistP256_AesGcm</SecurityPolicyUri>
+      </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>Sign_2</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_brainpoolP256r1_ChaChaPoly</SecurityPolicyUri>
+      </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>SignAndEncrypt_3</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_brainpoolP256r1_ChaChaPoly</SecurityPolicyUri>
+      </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>Sign_2</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_brainpoolP384r1_ChaChaPoly</SecurityPolicyUri>
+      </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>SignAndEncrypt_3</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#ECC_brainpoolP384r1_ChaChaPoly</SecurityPolicyUri>
+      </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>Sign_2</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#RSA_DH_AesGcm</SecurityPolicyUri>
+      </ServerSecurityPolicy>
+      <ServerSecurityPolicy>
+        <SecurityMode>SignAndEncrypt_3</SecurityMode>
+        <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#RSA_DH_AesGcm</SecurityPolicyUri>
+      </ServerSecurityPolicy>
       <ServerSecurityPolicy>
         <SecurityMode>None_1</SecurityMode>
         <SecurityPolicyUri>http://opcfoundation.org/UA/SecurityPolicy#None</SecurityPolicyUri>

Libraries/Opc.Ua.Client/Session/SessionConfiguration.cs

@@ -123,10 +123,18 @@ public SessionState(SessionOptions options)
         public NodeId AuthenticationToken { get; init; }
 
         /// <summary>
-        /// The last server nonce received.
+        /// The raw bytes of the last server nonce received.
+        /// Persisting bytes avoids object-serialization ambiguity for Nonce internals.
         /// </summary>
         [DataMember(IsRequired = true, Order = 80)]
-        public Nonce? ServerNonce { get; init; }
+        public byte[]? ServerNonce { get; init; }
+
+        /// <summary>
+        /// The raw bytes of the client nonce used when the session was created.
+        /// Required for enhanced-policy activate signatures during reconnect.
+        /// </summary>
+        [DataMember(IsRequired = false, Order = 85)]
+        public byte[]? ClientNonce { get; init; }
 
         /// <summary>
         /// The user identity token policy which was used to create the session.
@@ -135,10 +143,10 @@ public SessionState(SessionOptions options)
         public string? UserIdentityTokenPolicy { get; init; }
 
         /// <summary>
-        /// The last server ecc ephemeral key received.
+        /// The raw bytes of the last server ECC ephemeral key received.
         /// </summary>
         [DataMember(IsRequired = false, Order = 100)]
-        public Nonce? ServerEccEphemeralKey { get; init; }
+        public byte[]? ServerEccEphemeralKey { get; init; }
 
         /// <summary>
         /// Allows the list of subscriptions to be saved/restored

Libraries/Opc.Ua.Configuration/ApplicationInstance.cs

@@ -868,8 +868,10 @@ await DeleteApplicationInstanceCertificateAsync(configuration, id, ct).Configure
             else
             {
                 ECCurve? curve =
-                    EccUtils.GetCurveFromCertificateTypeId(id.CertificateType)
-                    ?? throw ServiceResultException.ConfigurationError("The Ecc certificate type is not supported.");
+                    CryptoUtils.GetCurveFromCertificateTypeId(id.CertificateType)
+                    ?? throw new ServiceResultException(
+                        StatusCodes.BadConfigurationError,
+                        "The Ecc certificate type is not supported.");
 
                 id.Certificate = builder.SetECCurve(curve.Value).CreateForECDsa();
 

Libraries/Opc.Ua.Gds.Server.Common/CertificateGroup.cs

@@ -756,7 +756,7 @@ private static bool TryGetECCCurve(NodeId certificateType, out ECCurve curve)
                 return false;
             }
             curve =
-                EccUtils.GetCurveFromCertificateTypeId(certificateType)
+                CryptoUtils.GetCurveFromCertificateTypeId(certificateType)
                 ?? throw new ServiceResultException(
                     StatusCodes.BadNotSupported,
                     $"The certificate type {certificateType} is not supported.");

Libraries/Opc.Ua.Server/Configuration/ConfigurationNodeManager.cs

@@ -392,6 +392,7 @@ public void HasApplicationSecureAdminAccess(ISystemContext context)
         }
 
         /// <inheritdoc/>
+        [System.Diagnostics.CodeAnalysis.SuppressMessage("Naming", "CA1725:Parameter names should match base declaration", Justification = "<Pending>")]
         public void HasApplicationSecureAdminAccess(
             ISystemContext context,
             CertificateStoreIdentifier trustedStore)
@@ -950,7 +951,7 @@ private X509Certificate2 GenerateTemporaryApplicationCertificate(
             else
             {
                 ECCurve? curve =
-                    EccUtils.GetCurveFromCertificateTypeId(certificateTypeId)
+                    CryptoUtils.GetCurveFromCertificateTypeId(certificateTypeId)
                     ?? throw new ServiceResultException(
                         StatusCodes.BadNotSupported,
                         "The Ecc certificate type is not supported.");