Skip to content

Conversation

vcsjones
Copy link
Member

Summary

HKDF.DeriveKey was documenting the ikm parameter as throwing an argument exception if it is empty or too big. There is no validation on the ikm parameter. There is however, empty and too-big validation on the output parameter, so it seems like we just documented the wrong parameter here.

Source reference: https://github.com/dotnet/runtime/blob/7a33b4bb6ced097f081b1eeab575cfb1c8c88bb5/src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HKDF.cs#L179-L185

@vcsjones vcsjones requested a review from bartonjs September 22, 2025 21:41
@vcsjones vcsjones self-assigned this Sep 22, 2025
@vcsjones vcsjones requested a review from a team as a code owner September 22, 2025 21:41
@vcsjones vcsjones added the area-System.Security Issues related to security practices for .NET developers. label Sep 22, 2025
Copy link
Contributor

Tagging subscribers to this area: @dotnet/area-system-security, @vcsjones

@gewarren gewarren merged commit 7342be3 into main Sep 22, 2025
6 checks passed
@gewarren gewarren deleted the hkdf-typo branch September 22, 2025 22:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area-System.Security Issues related to security practices for .NET developers.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants