Data Protection: Exception - "The parameter is incorrect"

I receive a CryptographicException when the AntiForgeryToken is rendered in my MVC view (@Html.AntiForgeryToken). The error doesn’t appear on a colleague’s machine with identical code.

My setup is:

var cert = GetCert()
 services.AddDataProtection()
                .ProtectKeysWithCertificate(cert.Thumbprint)
                .PersistKeysToRedis(redisConnection, "foo:dpikeys")
                .SetApplicationName("foo.IdentityServer");

The keys are being successfully written to redis. I have “[ValidateAntiForgeryToken]” attributes on my controller actions.

Exception stack trace:

System.Security.Cryptography.CryptographicException: "The parameter is incorrect"
at System.Security.Cryptography.NCryptNative.DecryptData[T](SafeNCryptKeyHandle key, Byte[] data, T& paddingInfo, AsymmetricPaddingMode paddingMode, NCryptDecryptor`1 decryptor)
at System.Security.Cryptography.NCryptNative.DecryptDataPkcs1(SafeNCryptKeyHandle key, Byte[] data)
  at System.Security.Cryptography.RSACng.Decrypt(Byte[] data, RSAEncryptionPadding padding)
  at System.Security.Cryptography.RSAPKCS1KeyExchangeDeformatter.DecryptKeyExchange(Byte[] rgbIn)
  at System.Security.Cryptography.Xml.EncryptedXml.DecryptEncryptedKey(EncryptedKey encryptedKey)
  at System.Security.Cryptography.Xml.EncryptedXml.GetDecryptionKey(EncryptedData encryptedData, String symmetricAlgorithmUri)
 at System.Security.Cryptography.Xml.EncryptedXml.DecryptDocument()
 at Microsoft.AspNetCore.DataProtection.XmlEncryption.EncryptedXmlDecryptor.Decrypt(XElement encryptedElement)
 at Microsoft.AspNetCore.DataProtection.XmlEncryption.XmlEncryptionExtensions.DecryptElement(XElement element, IActivator activator)
at Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager.Microsoft.AspNetCore.DataProtection.KeyManagement.Internal.IInternalXmlKeyManager.DeserializeDescriptorFromKeyElement(XElement keyElement)
at Microsoft.AspNetCore.DataProtection.KeyManagement.DeferredKey.<>c__DisplayClass1_0.<GetLazyDescriptorDelegate>b__0()
at System.Lazy`1.CreateValue()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Lazy`1.get_Value()
at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyBase.get_Descriptor()
at Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.CngGcmAuthenticatedEncryptorFactory.CreateEncryptorInstance(IKey key)
   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyBase.CreateEncryptor()
   at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRing.KeyHolder.GetEncryptorInstance(Boolean& isRevoked)
  at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRing.get_DefaultAuthenticatedEncryptor()
  at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Protect(Byte[] plaintext)
   at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgeryTokenSerializer.Serialize(AntiforgeryToken token)
   at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgery.Serialize(IAntiforgeryFeature antiforgeryFeature)
  at Microsoft.AspNetCore.Antiforgery.Internal.DefaultAntiforgery.GetAndStoreTokens(HttpContext httpContext)
  at Microsoft.AspNetCore.Mvc.ViewFeatures.AntiforgeryExtensions.GetHtml(IAntiforgery antiforgery, HttpContext httpContext)
  at Microsoft.AspNetCore.Mvc.ViewFeatures.DefaultHtmlGenerator.GenerateAntiforgery(ViewContext viewContext)
 at Microsoft.AspNetCore.Mvc.TagHelpers.FormTagHelper.Process(TagHelperContext context, TagHelperOutput output)
   at Microsoft.AspNetCore.Razor.TagHelpers.TagHelper.ProcessAsync(TagHelperContext context, TagHelperOutput output)
   at Microsoft.AspNetCore.Razor.Runtime.TagHelpers.TagHelperRunner.<RunAsync>d__0.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.GetResult()
at AspNetCore._Views_Account_Login_cshtml.<ExecuteAsync>d__27.MoveNext() in
C:\Code\foo\foo.IdentityServer\Views\Account\Login.cshtml:line 0

[natemcmaster]

Without steps to reproduce, there isn’t much I can do to help. The stack trace shows the error as coming from several layers below the ASP.NET stack which leads me to believe there is a problem with how the certificate was generated or there is a bug deep in the System.Security.Cryptography stack. Try creating a repro by using EncryptedXml APIs directly: https://docs.microsoft.com/en-us/dotnet/standard/security/how-to-decrypt-xml-elements-with-x-509-certificates. That will get you closer to the source of the exception.

[NtFreX]

The problem on my colleagues machine was that the certificate was only in the machine store and when decrypting an xml only the user store will be searched…

---

@blowdart You can of courser provide your own X509Certificate2 when configuring.

I understand the statement as when using the certificate directly it will not try to load it from the store when decrypting?

---

The code example in this procedure decrypts an XML element using an X.509 certificate from the local certificate store of the current user account.

https://docs.microsoft.com/en-us/dotnet/standard/security/how-to-decrypt-xml-elements-with-x-509-certificates

When I look into the xml decryption docu you linked it makes it clear that the certificate must be in the user store.

---

@soeron Providing certificate doesn’t solves anything.

I can reproduce the fact that providing the certifiacte directly without having it in the user store doesn’t solve anything.

---

What is the intendet bevaivor when prodiving a certificate directly? Should it use the certificate store or not?

---

Maybe this method produces the wrong result or is this the intended bahaivor?

System.Security.Cryptography.Xml.Utils.BuildBagOfCerts