Code Cleanup: Remove OSX 10.14 compatibility code

[bartonjs]

10.14 looks to have hit implicit End of Life, since it has gone two months without a security update.

Assuming that .NET 7 changes the minimum macOS to 10.15, we can remove 10.14-specific compat code, like

runtime/src/libraries/Common/src/System/Security/Cryptography/RSASecurityTransforms.macOS.cs

Lines 76 to 93 in bcfa532

	private static bool HasWorkingPKCS1Padding { get; } = OperatingSystem.IsMacOSVersionAtLeast(10, 15);
	private static void ImportPrivateKey(
	RSAParameters rsaParameters,
	out SafeSecKeyRefHandle privateKey,
	out SafeSecKeyRefHandle publicKey)
	{
	// macOS 10.14 and older have broken PKCS#1 depadding for decryption
	// of empty data. The bug doesn't affect the legacy CSSM keys so we
	// use them instead.
	if (HasWorkingPKCS1Padding)
	{
	privateKey = ImportKey(rsaParameters);
	publicKey = Interop.AppleCrypto.CopyPublicKey(privateKey);
	}
	else
	{
	privateKey = ImportLegacyPrivateKey(rsaParameters);

There may be other code that can be removed.

[ghost]

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @GrabYourPitchforks
See info in area-owners.md if you want to be subscribed.

Issue Details

---

10.14 looks to have hit implicit End of Life, since it has gone two months without a security update.

Assuming that .NET 7 changes the minimum macOS to 10.15, we can remove 10.14-specific compat code, like

runtime/src/libraries/Common/src/System/Security/Cryptography/RSASecurityTransforms.macOS.cs

Lines 76 to 93 in bcfa532

	private static bool HasWorkingPKCS1Padding { get; } = OperatingSystem.IsMacOSVersionAtLeast(10, 15);
	private static void ImportPrivateKey(
	RSAParameters rsaParameters,
	out SafeSecKeyRefHandle privateKey,
	out SafeSecKeyRefHandle publicKey)
	{
	// macOS 10.14 and older have broken PKCS#1 depadding for decryption
	// of empty data. The bug doesn't affect the legacy CSSM keys so we
	// use them instead.
	if (HasWorkingPKCS1Padding)
	{
	privateKey = ImportKey(rsaParameters);
	publicKey = Interop.AppleCrypto.CopyPublicKey(privateKey);
	}
	else
	{
	privateKey = ImportLegacyPrivateKey(rsaParameters);

There may be other code that can be removed.

Author:	bartonjs
Assignees:	-
Labels:	area-System.Security
Milestone:	Future

[bartonjs]

runtime/src/libraries/Native/Unix/System.Security.Cryptography.Native.Apple/pal_ecc.c

Lines 89 to 94 in 2c2d6df

	case 72:
	return 256;
	case 104:
	return 384;
	case 141:
	return 521;

is probably already dead code, since the subsequent 3 cases say they're for Mojave (10.14).

[vcsjones]

One thing to be mindful of is the shared code with iOS / iPad OS. We support much older iOS versions that prevented a lot of cleanup, the last time I looked.

[bartonjs]

True, true. But of the two things I've linked in so far, I think they're both "macOS-only"... i.e. Mojave's ECC size was changed to align with the size reported on iOS; and iOS only has the data keys, not the keychain keys, so there's no legacy import for that (and the file is in a "we're different between macOS and iOS here", anyways)

[vcsjones]

Everything else I can identify requires bumping the minimum iOS version to 11, while Maui still supports iOS 10.

• RSA+PSS provided by the platform, instead of us doing the padding manually.
  

  runtime/src/native/libs/System.Security.Cryptography.Native.Apple/pal_signverify.c

  Lines 126 to 127 in 7414af2

  	// Requires macOS 10.13+ or iOS 11+
  	/*if (signatureAlgorithm == PAL_SignatureAlgorithm_RSA_Pss)

• Removing some ALPN linking workarounds
  

  runtime/src/native/libs/System.Security.Cryptography.Native.Apple/pal_ssl.c

  Lines 8 to 10 in 9212310

  	// For that reason we use function pointers instead of direct call.
  	// This can be revisited after we drop support for 10.12 and iOS 10

[vcsjones]

@bartonjs I don't think there is anything else we can do here, especially given how far back we support iOS. Should we close this, or are you aware of anything else that could use some cleanup?

[vcsjones]

I think we can close this out. All identified places have been cleaned up, even the iOS 10 ones since we bumped out iOS minimum to iOS 11. We can open new issues if we identify more opportunities to remove legacy code.