diff --git a/docs/standard/security/cross-platform-cryptography.md b/docs/standard/security/cross-platform-cryptography.md index acd237c8c11a0..34efde3620aec 100644 --- a/docs/standard/security/cross-platform-cryptography.md +++ b/docs/standard/security/cross-platform-cryptography.md @@ -29,29 +29,27 @@ All hash algorithm and hash-based message authentication (HMAC) classes, includi |SHA-2-256 | ✔️ | ✔️ |✔️ |✔️ |✔️ |✔️ | |SHA-2-384 | ✔️ | ✔️ |✔️ |✔️ |✔️ |✔️ | |SHA-2-512 | ✔️ | ✔️ |✔️ |✔️ |✔️ |✔️ | -|SHA-3-2561 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ | -|SHA-3-3841 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ | -|SHA-3-5121 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ | -|SHAKE-1281 | Windows 11 Build 25324+| OpenSSL 1.1.1+3 |❌ |❌ |❌ |❌ | -|SHAKE-2561 | Windows 11 Build 25324+| OpenSSL 1.1.1+3 |❌ |❌ |❌ |❌ | +|SHA-3-256 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ | +|SHA-3-384 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ | +|SHA-3-512 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ | +|SHAKE-128 | Windows 11 Build 25324+| OpenSSL 1.1.1+2 |❌ |❌ |❌ |❌ | +|SHAKE-256 | Windows 11 Build 25324+| OpenSSL 1.1.1+2 |❌ |❌ |❌ |❌ | |HMAC-MD5 | ✔️ | ✔️ |✔️ |✔️ |✔️ |❌ | |HMAC-SHA-1 | ✔️ | ✔️ |✔️ |✔️ |✔️ |✔️ | |HMAC-SHA-2-256 | ✔️ | ✔️ |✔️ |✔️ |✔️ |✔️ | |HMAC-SHA-2-384 | ✔️ | ✔️ |✔️ |✔️ |✔️ |✔️ | |HMAC-SHA-2-512 | ✔️ | ✔️ |✔️ |✔️ |✔️ |✔️ | -|HMAC-SHA-3-2561 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ | -|HMAC-SHA-3-3841 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ | -|HMAC-SHA-3-5121 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ | -|KMAC-1282 | Windows 11 Build 26016+| OpenSSL 3.0+ |❌ |❌ |❌ |❌ | -|KMAC-2562 | Windows 11 Build 26016+| OpenSSL 3.0+ |❌ |❌ |❌ |❌ | -|KMAC-XOF-1282 | Windows 11 Build 26016+| OpenSSL 3.0+ |❌ |❌ |❌ |❌ | -|KMAC-XOF-2562 | Windows 11 Build 26016+| OpenSSL 3.0+ |❌ |❌ |❌ |❌ | +|HMAC-SHA-3-256 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ | +|HMAC-SHA-3-384 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ | +|HMAC-SHA-3-512 | Windows 11 Build 25324+| OpenSSL 1.1.1+ |❌ |❌ |❌ |❌ | +|KMAC-1281 | Windows 11 Build 26016+| OpenSSL 3.0+ |❌ |❌ |❌ |❌ | +|KMAC-2561 | Windows 11 Build 26016+| OpenSSL 3.0+ |❌ |❌ |❌ |❌ | +|KMAC-XOF-1281 | Windows 11 Build 26016+| OpenSSL 3.0+ |❌ |❌ |❌ |❌ | +|KMAC-XOF-2561 | Windows 11 Build 26016+| OpenSSL 3.0+ |❌ |❌ |❌ |❌ | -1Available starting in .NET 8. +1Available starting in .NET 9. -2Available starting in .NET 9. - -3Streaming extensible output function (XOF) is available starting in .NET 9. On Linux, this requires OpenSSL 3.3. +2Streaming extensible output function (XOF) is available starting in .NET 9. On Linux, this requires OpenSSL 3.3. ## Symmetric encryption @@ -82,9 +80,9 @@ Since authenticated encryption requires newer platform APIs to support the algor | Cipher + Mode | Windows | Linux | macOS | iOS, tvOS, MacCatalyst | Android | Browser | |-------------------|-------------------------|----------------|---------|------------------------|---------------|---------| -| AES-GCM | ✔️ | ✔️ | ⚠️ | ⚠️ | ✔️ | ❌ | +| AES-GCM | ✔️ | ✔️ | ✔️ | ⚠️ | ✔️ | ❌ | | AES-CCM | ✔️ | ✔️ | ⚠️ | ❌ | ✔️ | ❌ | -| ChaCha20Poly1305 | Windows 10 Build 20142+ | OpenSSL 1.1.0+ | ⚠️ | ⚠️ | API Level 28+ | ❌ | +| ChaCha20Poly1305 | Windows 10 Build 20142+ | OpenSSL 1.1.0+ | ✔️ | ⚠️ | API Level 28+ | ❌ | ### AES-CCM on macOS @@ -92,12 +90,6 @@ On macOS, the system libraries don't support AES-CCM for third-party code, so th The `libcrypto.0.9.7.dylib` and `libcrypto.0.9.8.dylib` libraries included in macOS are from earlier versions of OpenSSL and will not be used. The `libcrypto.35.dylib`, `libcrypto.41.dylib`, and `libcrypto.42.dylib` libraries are from LibreSSL and will not be used. -### AES-GCM and ChaCha20Poly1305 on macOS - -macOS did not support AES-GCM or ChaCha20Poly1305 until macOS 10.15 for third-party code. Prior to .NET 8, and have the same requirement as AES-CCM and users must install OpenSSL for these types to function. - -Starting in .NET 8, .NET on macOS will use the Apple's CryptoKit framework for AES-GCM and ChaCha20Poly1305. Users will not need to install or configure any additional dependencies for AES-GCM or ChaCha20Poly1305 on macOS. - ### AES-GCM and ChaCha20Poly1305 on iOS, tvOS, and MacCatalyst Support for AES-GCM and ChaCha20Poly1305 is available starting in .NET 9 on iOS and tvOS 13.0 and later, and all versions of MacCatalyst. @@ -157,16 +149,14 @@ Padding and digest support vary by platform: | PKCS1 Encryption | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | | OAEP - SHA-1 | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | | OAEP - SHA-2 | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | -| OAEP - SHA-32 | Windows 11 Build 25324+ | OpenSSL 1.1.1+ | ❌ | ❌ | ❌ | ❌ | +| OAEP - SHA-3 | Windows 11 Build 25324+ | OpenSSL 1.1.1+ | ❌ | ❌ | ❌ | ❌ | | PKCS1 Signature (MD5, SHA-1) | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | | PKCS1 Signature (SHA-2) | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ⚠️1 | -| PKCS1 Signature (SHA-3)2 | Windows 11 Build 25324+ | OpenSSL 1.1.1+ | ❌ | ❌ | ❌ | ❌ | +| PKCS1 Signature (SHA-3) | Windows 11 Build 25324+ | OpenSSL 1.1.1+ | ❌ | ❌ | ❌ | ❌ | | PSS | ✔️ | ✔️ | ✔️ | ✔️ | ✔️ | ❌ | 1 Windows CryptoAPI (CAPI) is capable of PKCS1 signature with a SHA-2 algorithm. But the individual RSA object may be loaded in a cryptographic service provider (CSP) that doesn't support it. -2 Requires .NET 8. - #### RSA on Windows * Windows CryptoAPI (CAPI) is used whenever [`new RSACryptoServiceProvider()`](xref:System.Security.Cryptography.RSACryptoServiceProvider) is used. @@ -238,8 +228,6 @@ The class supports the "raw" * HMAC(Z, prepend || Z || append) * Tls11Prf(label, seed) -"Raw" key derivation was introduced in .NET 8. - ECDH key curves are defined by the OS libraries and are subject to their limitations. | Elliptic Curve | Windows 10 | Windows 7 - 8.1 | Linux | macOS | iOS, tvOS, MacCatalyst | Android |