System.Security.Cryptography.CryptographicException: The payload was invalid

This post has been republished via RSS; it originally appeared at: IIS Support Blog articles.

When you are using your .Net Core application to decrypt a string from a different machine than it was encrypted, you may run into the following exception:

 

Exception:

System.Security.Cryptography.CryptographicException: The payload was invalid.

   at Microsoft.AspNetCore.DataProtection.Cng.CbcAuthenticatedEncryptor.DecryptImpl(Byte* pbCiphertext, UInt32 cbCiphertext, Byte* pbAdditionalAuthenticatedData, UInt32 cbAdditionalAuthenticatedData)

   at Microsoft.AspNetCore.DataProtection.Cng.Internal.CngAuthenticatedEncryptorBase.Decrypt(ArraySegment`1 ciphertext, ArraySegment`1 additionalAuthenticatedData)

   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.UnprotectCore(Byte[] protectedData, Boolean allowOperationsOnRevokedKeys, UnprotectStatus& status)

   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.DangerousUnprotect(Byte[] protectedData, Boolean ignoreRevocationErrors, Boolean& requiresMigration, Boolean& wasRevoked)

   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Unprotect(Byte[] protectedData)

   at Microsoft.AspNetCore.DataProtection.DataProtectionCommonExtensions.Unprotect(IDataProtector protector, String protectedData)

 

Two things you will need to check:

1. Is the encryption key persists to a local path? - The key needs to be persisted to a shared location

2. SetApplicationName must be used to set an explicit application name. - If ApplicationName is not set, it will be generated a guid at runtime for different machines, and that will lead to the error above.

 

 

Code Example below:

 

            services.AddDataProtection()

               .ProtectKeysWithCertificate(x509Cert)

               .UseCryptographicAlgorithms(

                      new AuthenticatedEncryptorConfiguration()

                      {

                          EncryptionAlgorithm = EncryptionAlgorithm.AES_256_CBC,

                          ValidationAlgorithm = ValidationAlgorithm.HMACSHA256

                      }

                  )

              .PersistKeysToFileSystem(new System.IO.DirectoryInfo(Configuration.GetValue<string>("KeyLocation"))) //shared network folder for key location

              .SetApplicationName("MyApplicationName")

              .SetDefaultKeyLifetime(TimeSpan.FromDays(600));

 

REMEMBER: these articles are REPUBLISHED. Your best bet to get a reply is to follow the link at the top of the post to the ORIGINAL post! BUT you're more than welcome to start discussions here:

This site uses Akismet to reduce spam. Learn how your comment data is processed.