ASP.NET Core Data Protection: Symmetric algorithm is not specified

Viewed 34

I'm trying to deploy my web server on a Ubuntu 20.04 server. I am using ASP.NET Core it's Data Protection feature and provided it with a certificate to be able to encrypt the keys stored in the database like so:

        var dataProtectionCertificate = new X509Certificate2(
            configuration.GetValue<string>("Core:DataProtectionCertificatePath"),
            configuration.GetValue<string>("Core:DataProtectionCertificatePassword"));

        services.AddDataProtection()
            .SetApplicationName(left out for security)
            .PersistKeysToDbContext<ApplicationDbContext>()
            .ProtectKeysWithCertificate(dataProtectionCertificate);

The certificate I've created is a PFX file made on this server using OpenSSL with the following commands:

  • openssl genrsa -aes256 -out app_key.pem 2048
  • openssl req -key app_key.pem -new -x509 -days 36500 -out app_cert.crt
  • openssl pkcs12 -export -in app_cert.crt -inkey app_key.pem -out app_cert.pfx

I then provide this PFX certificate to my application along with a password.

On my own PC this is running just fine (Windows 10), but on the server (Ubuntu 20.04) this is throwing an exception:

root-nextlevel-auth-1  | warn: Microsoft.AspNetCore.DataProtection.KeyManagement.DefaultKeyResolver[12]
root-nextlevel-auth-1  |       Key {5698643d-b0a7-4c77-b4f7-03c93ed2d78f} is ineligible to be the default key because its CreateEncryptor method failed.
root-nextlevel-auth-1  |       System.Security.Cryptography.CryptographicException: Symmetric algorithm is not specified.
root-nextlevel-auth-1  |          at System.Security.Cryptography.Xml.EncryptedXml.GetDecryptionKey(EncryptedData , String )
root-nextlevel-auth-1  |          at System.Security.Cryptography.Xml.EncryptedXml.DecryptDocument()
root-nextlevel-auth-1  |          at Microsoft.AspNetCore.DataProtection.XmlEncryption.EncryptedXmlDecryptor.Decrypt(XElement encryptedElement)
root-nextlevel-auth-1  |          at Microsoft.AspNetCore.DataProtection.XmlEncryption.XmlEncryptionExtensions.DecryptElement(XElement element, IActivator activator)
root-nextlevel-auth-1  |          at Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager.Microsoft.AspNetCore.DataProtection.KeyManagement.Internal.IInternalXmlKeyManager.DeserializeDescriptorFromKeyElement(XElement keyElement)
root-nextlevel-auth-1  |          at Microsoft.AspNetCore.DataProtection.KeyManagement.DeferredKey.<>c__DisplayClass1_0.<GetLazyDescriptorDelegate>b__0()
root-nextlevel-auth-1  |          at System.Lazy`1.ViaFactory(LazyThreadSafetyMode )
root-nextlevel-auth-1  |          at System.Lazy`1.ExecutionAndPublication(LazyHelper , Boolean )
root-nextlevel-auth-1  |          at System.Lazy`1.CreateValue()
root-nextlevel-auth-1  |          at System.Lazy`1.get_Value()
root-nextlevel-auth-1  |          at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyBase.get_Descriptor()
root-nextlevel-auth-1  |          at Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.CngGcmAuthenticatedEncryptorFactory.CreateEncryptorInstance(IKey key)
root-nextlevel-auth-1  |          at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyBase.CreateEncryptor()
root-nextlevel-auth-1  |          at Microsoft.AspNetCore.DataProtection.KeyManagement.DefaultKeyResolver.CanCreateAuthenticatedEncryptor(IKey key)

I'm not super familiar with the in depths of ceritificates and encryption algorithms so if someone knows what could be causing this that would be appreciated.

Edit: Here is the XML key in question:

<key id="661223d7-f355-41c7-944a-37cdd88f556b" version="1">
    <creationDate>2022-09-19T20:44:16.1017041Z</creationDate>
    <activationDate>2022-09-19T20:44:09.7790984Z</activationDate>
    <expirationDate>2022-12-18T20:44:09.7790984Z</expirationDate>
    <descriptor deserializerType="Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.ConfigurationModel.AuthenticatedEncryptorDescriptorDeserializer, Microsoft.AspNetCore.DataProtection, Version=6.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60">
        <descriptor>
            <encryption algorithm="AES_256_CBC" />
            <validation algorithm="HMACSHA256" />
            <encryptedSecret decryptorType="Microsoft.AspNetCore.DataProtection.XmlEncryption.EncryptedXmlDecryptor, Microsoft.AspNetCore.DataProtection, Version=6.0.0.0, Culture=neutral, PublicKeyToken=adb9793829ddae60"
                xmlns="http://schemas.asp.net/2015/03/dataProtection">
                <EncryptedData Type="http://www.w3.org/2001/04/xmlenc#Element"
                    xmlns="http://www.w3.org/2001/04/xmlenc#">
                    <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc" />
                    <KeyInfo
                        xmlns="http://www.w3.org/2000/09/xmldsig#">
                        <EncryptedKey
                            xmlns="http://www.w3.org/2001/04/xmlenc#">
                            <EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-1_5" />
                            <KeyInfo
                                xmlns="http://www.w3.org/2000/09/xmldsig#">
                                <X509Data>
                                    <X509Certificate>hidden</X509Certificate>
                                </X509Data>
                            </KeyInfo>
                            <CipherData>
                                <CipherValue>hidden</CipherValue>
                            </CipherData>
                        </EncryptedKey>
                    </KeyInfo>
                    <CipherData>
                        <CipherValue>hidden</CipherValue>
                    </CipherData>
                </EncryptedData>
            </encryptedSecret>
        </descriptor>
    </descriptor>
</key>
0 Answers
Related