Skip to content

Conversation

@vcsjones
Copy link
Member

Summary

HKDF.DeriveKey was documenting the ikm parameter as throwing an argument exception if it is empty or too big. There is no validation on the ikm parameter. There is however, empty and too-big validation on the output parameter, so it seems like we just documented the wrong parameter here.

Source reference: https://github.com/dotnet/runtime/blob/7a33b4bb6ced097f081b1eeab575cfb1c8c88bb5/src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/HKDF.cs#L179-L185

@vcsjones vcsjones requested a review from bartonjs September 22, 2025 21:41
@vcsjones vcsjones self-assigned this Sep 22, 2025
@vcsjones vcsjones requested a review from a team as a code owner September 22, 2025 21:41
@vcsjones vcsjones added the area-System.Security Issues related to security practices for .NET developers. label Sep 22, 2025
@dotnet-policy-service
Copy link
Contributor

Tagging subscribers to this area: @dotnet/area-system-security, @vcsjones

@gewarren gewarren merged commit 7342be3 into main Sep 22, 2025
6 checks passed
@gewarren gewarren deleted the hkdf-typo branch September 22, 2025 22:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area-System.Security Issues related to security practices for .NET developers.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants