Skip to content

Commit 3b5a522

Browse files
vcsjonesvcsjones
authored
Merge pull request #43638 from vcsjones/crypto-docs-obsolete
Cross Platform Cryptography: Remove remarks about unsupported .NET versions
2 parents 2a1467c + 92c0325 commit 3b5a522

File tree

1 file changed

+18
-30
lines changed

1 file changed

+18
-30
lines changed

‎docs/standard/security/cross-platform-cryptography.md

Lines changed: 18 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -29,29 +29,27 @@ All hash algorithm and hash-based message authentication (HMAC) classes, includi
2929
|SHA-2-256 | ✔️ | ✔️ |✔️ |✔️ |✔️ |✔️ |
3030
|SHA-2-384 | ✔️ | ✔️ |✔️ |✔️ |✔️ |✔️ |
3131
|SHA-2-512 | ✔️ | ✔️ |✔️ |✔️ |✔️ |✔️ |
32-
|SHA-3-256<sup>1</sup> | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ |
33-
|SHA-3-384<sup>1</sup> | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ |
34-
|SHA-3-512<sup>1</sup> | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ |
35-
|SHAKE-128<sup>1</sup> | Windows 11 Build 25324+| OpenSSL 1.1.1+<sup>3</sup> |❌ |❌ |❌ |❌ |
36-
|SHAKE-256<sup>1</sup> | Windows 11 Build 25324+| OpenSSL 1.1.1+<sup>3</sup> |❌ |❌ |❌ |❌ |
32+
|SHA-3-256 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ |
33+
|SHA-3-384 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ |
34+
|SHA-3-512 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ |
35+
|SHAKE-128 | Windows 11 Build 25324+| OpenSSL 1.1.1+<sup>2</sup> |❌ |❌ |❌ |❌ |
36+
|SHAKE-256 | Windows 11 Build 25324+| OpenSSL 1.1.1+<sup>2</sup> |❌ |❌ |❌ |❌ |
3737
|HMAC-MD5 | ✔️ | ✔️ |✔️ |✔️ |✔️ |❌ |
3838
|HMAC-SHA-1 | ✔️ | ✔️ |✔️ |✔️ |✔️ |✔️ |
3939
|HMAC-SHA-2-256 | ✔️ | ✔️ |✔️ |✔️ |✔️ |✔️ |
4040
|HMAC-SHA-2-384 | ✔️ | ✔️ |✔️ |✔️ |✔️ |✔️ |
4141
|HMAC-SHA-2-512 | ✔️ | ✔️ |✔️ |✔️ |✔️ |✔️ |
42-
|HMAC-SHA-3-256<sup>1</sup> | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ |
43-
|HMAC-SHA-3-384<sup>1</sup> | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ |
44-
|HMAC-SHA-3-512<sup>1</sup> | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ |
45-
|KMAC-128<sup>2</sup> | Windows 11 Build 26016+| OpenSSL 3.0+ |❌ |❌ |❌ |❌ |
46-
|KMAC-256<sup>2</sup> | Windows 11 Build 26016+| OpenSSL 3.0+ |❌ |❌ |❌ |❌ |
47-
|KMAC-XOF-128<sup>2</sup> | Windows 11 Build 26016+| OpenSSL 3.0+ |❌ |❌ |❌ |❌ |
48-
|KMAC-XOF-256<sup>2</sup> | Windows 11 Build 26016+| OpenSSL 3.0+ |❌ |❌ |❌ |❌ |
42+
|HMAC-SHA-3-256 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ |
43+
|HMAC-SHA-3-384 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ |
44+
|HMAC-SHA-3-512 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ |
45+
|KMAC-128<sup>1</sup> | Windows 11 Build 26016+| OpenSSL 3.0+ |❌ |❌ |❌ |❌ |
46+
|KMAC-256<sup>1</sup> | Windows 11 Build 26016+| OpenSSL 3.0+ |❌ |❌ |❌ |❌ |
47+
|KMAC-XOF-128<sup>1</sup> | Windows 11 Build 26016+| OpenSSL 3.0+ |❌ |❌ |❌ |❌ |
48+
|KMAC-XOF-256<sup>1</sup> | Windows 11 Build 26016+| OpenSSL 3.0+ |❌ |❌ |❌ |❌ |
4949

50-
<sup>1</sup>Available starting in .NET 8.
50+
<sup>1</sup>Available starting in .NET 9.
5151

52-
<sup>2</sup>Available starting in .NET 9.
53-
54-
<sup>3</sup>Streaming extensible output function (XOF) is available starting in .NET 9. On Linux, this requires OpenSSL 3.3.
52+
<sup>2</sup>Streaming extensible output function (XOF) is available starting in .NET 9. On Linux, this requires OpenSSL 3.3.
5553

5654
## Symmetric encryption
5755

@@ -82,22 +80,16 @@ Since authenticated encryption requires newer platform APIs to support the algor
8280

8381
| Cipher + Mode | Windows | Linux | macOS | iOS, tvOS, MacCatalyst | Android | Browser |
8482
|-------------------|-------------------------|----------------|---------|------------------------|---------------|---------|
85-
| AES-GCM | ✔️ | ✔️ | ⚠️ | ⚠️ | ✔️ | ❌ |
83+
| AES-GCM | ✔️ | ✔️ | ✔️ | ⚠️ | ✔️ | ❌ |
8684
| AES-CCM | ✔️ | ✔️ | ⚠️ | ❌ | ✔️ | ❌ |
87-
| ChaCha20Poly1305 | Windows 10 Build 20142+ | OpenSSL 1.1.0+ | ⚠️ | ⚠️ | API Level 28+ | ❌ |
85+
| ChaCha20Poly1305 | Windows 10 Build 20142+ | OpenSSL 1.1.0+ | ✔️ | ⚠️ | API Level 28+ | ❌ |
8886

8987
### AES-CCM on macOS
9088

9189
On macOS, the system libraries don't support AES-CCM for third-party code, so the <xref:System.Security.Cryptography.AesCcm> class uses OpenSSL for support. Users on macOS need to obtain an appropriate copy of OpenSSL (libcrypto) for this type to function, and it must be in a path that the system would load a library from by default. We recommend that you install OpenSSL from a package manager such as Homebrew.
9290

9391
The `libcrypto.0.9.7.dylib` and `libcrypto.0.9.8.dylib` libraries included in macOS are from earlier versions of OpenSSL and will not be used. The `libcrypto.35.dylib`, `libcrypto.41.dylib`, and `libcrypto.42.dylib` libraries are from LibreSSL and will not be used.
9492

95-
### AES-GCM and ChaCha20Poly1305 on macOS
96-
97-
macOS did not support AES-GCM or ChaCha20Poly1305 until macOS 10.15 for third-party code. Prior to .NET 8, <xref:System.Security.Cryptography.AesGcm> and <xref:System.Security.Cryptography.ChaCha20Poly1305> have the same requirement as AES-CCM and users must install OpenSSL for these types to function.
98-
99-
Starting in .NET 8, .NET on macOS will use the Apple's CryptoKit framework for AES-GCM and ChaCha20Poly1305. Users will not need to install or configure any additional dependencies for AES-GCM or ChaCha20Poly1305 on macOS.
100-
10193
### AES-GCM and ChaCha20Poly1305 on iOS, tvOS, and MacCatalyst
10294

10395
Support for AES-GCM and ChaCha20Poly1305 is available starting in .NET 9 on iOS and tvOS 13.0 and later, and all versions of MacCatalyst.
@@ -157,16 +149,14 @@ Padding and digest support vary by platform:
157149
| PKCS1 Encryption | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
158150
| OAEP - SHA-1 | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
159151
| OAEP - SHA-2 | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ |
160-
| OAEP - SHA-3<sup>2</sup> | Windows 11 Build 25324+ | OpenSSL 1.1.1+ | ❌ | ❌ | ❌ | ❌ |
152+
| OAEP - SHA-3 | Windows 11 Build 25324+ | OpenSSL 1.1.1+ | ❌ | ❌ | ❌ | ❌ |
161153
| PKCS1 Signature (MD5, SHA-1) | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ |
162154
| PKCS1 Signature (SHA-2) | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ⚠️<sup>1</sup> |
163-
| PKCS1 Signature (SHA-3)<sup>2</sup> | Windows 11 Build 25324+ | OpenSSL 1.1.1+ | ❌ | ❌ | ❌ | ❌ |
155+
| PKCS1 Signature (SHA-3) | Windows 11 Build 25324+ | OpenSSL 1.1.1+ | ❌ | ❌ | ❌ | ❌ |
164156
| PSS | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ |
165157

166158
<sup>1</sup> Windows CryptoAPI (CAPI) is capable of PKCS1 signature with a SHA-2 algorithm. But the individual RSA object may be loaded in a cryptographic service provider (CSP) that doesn't support it.
167159

168-
<sup>2</sup> Requires .NET 8.
169-
170160
#### RSA on Windows
171161

172162
* Windows CryptoAPI (CAPI) is used whenever [`new RSACryptoServiceProvider()`](xref:System.Security.Cryptography.RSACryptoServiceProvider) is used.
@@ -238,8 +228,6 @@ The <xref:System.Security.Cryptography.ECDiffieHellman> class supports the "raw"
238228
* HMAC(Z, prepend || Z || append)
239229
* Tls11Prf(label, seed)
240230

241-
"Raw" key derivation was introduced in .NET 8.
242-
243231
ECDH key curves are defined by the OS libraries and are subject to their limitations.
244232

245233
| Elliptic Curve | Windows 10 | Windows 7 - 8.1 | Linux | macOS | iOS, tvOS, MacCatalyst | Android |

0 commit comments

Comments
 (0)