GCM encryption not available on linux when using DataProtection

[webczat]

It seems that DataProtection does not support gcm on linux, I get System.PlatformNotSupportedException stating that gcm is windows only.
That happens both in aspnetcore 3.1, and according to my code reading, also in current master.
I discovered that the AuthenticatedEncryptorFactory checks if the os is windows in the gcm case and throws, but https://github.com/dotnet/runtime/blob/master/docs/design/features/cross-platform-cryptography.md seems to state that dotnet core does support gcm on non windows. I haven't tested so it is still possible it is not supported in dotnet core 3.0/3.1, though.

[GrabYourPitchforks]

For context, there didn't exist managed GCM classes when this code was first written. So the DataProtection implementation necessarily had to p/invoke into Windows to perform the operation. Looks like the DataProtection layer never got the OS check removed once the managed classes came online.

[webczat]

I believe the gcm is openssl... although not sure what the DataProtection will use.

[blowdart]

Is there a specific reason why you want it, data protection already does both encryption and authentication anyway. Is it just for speed?

[webczat]

Well, I am just playing with aspnetcore stuff quite randomly, and noticed that this configuration does not work even though it is supported by api and is supported on linux in System.Security.Cryptography. So that comes a bit unexpected. Just came at this by accident.
I am not sure if the aes/gcm isn't considered more secure than aes/cbc+hmac...?

[daidnoggin]

We bumped into this today as well when trying to set the EncryptionAlgorithm to AES_256_GCM. For us, its a nice to have.

We're using DataProtection to encrypt many frequent payloads, so would prefer the speed if available.

We've moved this issue to the Backlog milestone. This means that it is not going to be worked on for the coming release. We will reassess the backlog following the current release and consider this item at that time. To learn more about our issue management process and to have better expectation regarding different types of issues you can read our Triage Process.

[blowdart]

@bartonjs Jeremy are the GCM algorithms available under linux?

[bartonjs]

Yep. Available via System.Security.Cryptography.AesGcm (no ICryptoTransform implementation)

[GrabYourPitchforks]

The DataProtection stack currently special-cases a bunch of stuff for CNG, such as p/invoking BCryptHashData as part of its logic. Now that we have static one-shot hash functions in the BCL, we can start removing some of that custom logic and rely solely on the runtime's own implementation, which already chooses the most optimized thing for each platform. We could start relying on the built-in one-shot AESGCM implementation, and perhaps even the built-in one-shot AESCBC implementations if those are introduced in vNext.

Note: These code paths do not require ICryptoTransform support. The only time ICryptoTransform is used is if you configure the DataProtection stack with a custom SymmetricAlgorithm and KeyedHashAlgorithm, which I suspect very few people actually do in practice.