Algorithm 'AesGcm' is not supported on this platform but platform is supported

[quintushr]

Description

When I use the constructor of the AesGcm class on macOS Monterey, an exception is thrown with the message 'Algorithm 'AesGcm' is not supported on this platform.' I checked the documentation, and it only mentions that browser, iOS, and tvOS are not supported.

Reproduction Steps

Run this code on Macos :

public static void Main()
{
  var aesGcm = new AesGcm(key);
}

Expected behavior

no exception

Actual behavior

Exception :
PlatformNotSupportedException: Algorithm 'AesGcm' is not supported on this platform.

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

No response

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

When I use the constructor of the AesGcm class on macOS Monterey, an exception is thrown with the message 'Algorithm 'AesGcm' is not supported on this platform.' I checked the documentation, and it only mentions that browser, iOS, and tvOS are not supported.

Reproduction Steps

Run this code on Macos :

public static void Main()
{
  var aesGcm = new AesGcm(key);
}

Expected behavior

no exception

Actual behavior

Exception :
PlatformNotSupportedException: Algorithm 'AesGcm' is not supported on this platform.

Regression?

No response

Known Workarounds

No response

Configuration

No response

Other information

No response

Author:	quintushr
Assignees:	-
Labels:	area-System.Security
Milestone:	-

[vcsjones]

In .NET 7 and below, AesGcm has a dependency on OpenSSL being installed and configured on macOS. It needs to be installed, and the libraries need to be in a path that macOS will load libraries from. See #89006 (comment) for an example. If OpenSSL is not installed, it will throw the PlatformNotSupported exception.

Starting in .NET 8, AesGcm has removed the dependency on OpenSSL and relies on CryptoKit, so it should "just work" out of the box.

[karakasa]

I suppose it should be better documented and throw a more detailed Exception?

[vcsjones]

and throw a more detailed Exception?

Well, the exception is gone in .NET 8, and changing the exception for .NET 6 or 7 probably won't meet the servicing bar. For other OpenSsl backed primitives, the exception was already improved for .NET 8 with #89046.

[vcsjones]

I think we can close this issue out. To summarize:

• AesGcm on macOS requires installing and configuring OpenSSL in .NET 7 or below.
• In .NET 8, AesGcm uses CryptoKit, so the exception will no longer occur.
• The remaining types that continue to use OpenSSL on macOS have their exception text improved in .NET 8.

Please feel free to re-open this issue if there are issues you believe are unaddressed.