AsymmetricSignatureProvider abusively disposes RSACryptoServiceProvider instances it doesn't own on .NET Desktop

On .NET Desktop, signing or verifying a token more than once when the security key is a RsaSecurityKey results in an exception if the underlying algorithm instance is a RSACryptoServiceProvider:

System.ObjectDisposedException: Le handle sécurisé a été fermé
   à System.Security.Cryptography.Utils._GetKeyParameter(SafeKeyHandle hKey, UInt32 paramID)
   à System.Security.Cryptography.RSACryptoServiceProvider.get_KeySize()
   à Microsoft.IdentityModel.Tokens.RsaSecurityKey.get_KeySize()
   à Microsoft.IdentityModel.Tokens.AsymmetricSignatureProvider.ValidateAsymmetricSecurityKeySize(SecurityKey key, String algorithm, Boolean willCreateSignatures)
   à Microsoft.IdentityModel.Tokens.AsymmetricSignatureProvider..ctor(SecurityKey key, String algorithm, Boolean willCreateSignatures)
   à Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateProvider(SecurityKey key, String algorithm, Boolean willCreateSignatures)
   à Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateForSigning(SecurityKey key, String algorithm)
   à System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.CreateEncodedSignature(String input, SigningCredentials signingCredentials)
   à System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.WriteToken(SecurityToken token)
 `AsymmetricSignatureProvider.Dispose()`

This bug is likely caused by Dispose(), that disposes the underlying RSACryptoServiceProvider instance without ensuring it owns it: https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/blob/master/src/Microsoft.IdentityModel.Tokens/AsymmetricSignatureProvider.cs#L691

(it’s likely the same as the one an ASOS user experienced last month when trying to use a CSP HSM)

[brentschmaltz]

@PinpointTownes @mbliesath https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/pull/518

[brentschmaltz]

@mbliesath missed your comment. The library is disposing an rsa object it didn’t create. A possible workaround it we get this fixed is based on JwtSecurityTokenHandler calling CryptoProviderFactory.ReleaseSignatureProvider after creating the signature. You can set your own CPF and override ReleaseSignatureProvider. RSP is in the call graph that will dispose the rsa. SigningCredentials. CryptoProviderFactory is a convenient place to set your CustomProviderFactory.