Update security docs to address outdated cryptographic defaults, broken samples, and weak recommendations#53164

Open

jeffhandley wants to merge 21 commits intodotnet:mainfrom

jeffhandley:jeffhandley/outdated-recommendations

Commits on Apr 16, 2026

Add OWASP-aligned PBKDF2 iteration guidance and password hashing context

jeffhandley
and
Copilot
committed
Modernize AES encryption snippets and add CBC mode warnings

jeffhandley
and
Copilot
committed
Replace 1024-bit RSA and PKCS#1 v1.5 with 2048-bit RSA and OAEP

jeffhandley
and
Copilot
committed
Add deprecation warnings for legacy crypto algorithms and APIs

jeffhandley
and
Copilot
committed
Fix correctness bugs in crypto code samples

jeffhandley
and
Copilot
committed
Address PR review feedback

jeffhandley
and
Copilot
committed
Revert DPAPI RNG to RNGCryptoServiceProvider for net461 compat

jeffhandley
and
Copilot
committed
Address second round of PR review feedback

jeffhandley
and
Copilot
committed
Fix RSACryptoServiceProvider obsoletion wording in hardware encryption doc

jeffhandley
and
Copilot
committed
Add VB DPAPI project file and re-apply fixes

jeffhandley
and
Copilot
committed
Restore hard-coded sample keys with illustration comments

jeffhandley
and
Copilot
committed
Address reviewer feedback: NIST over OWASP, no algorithm names, no AES-GCM

jeffhandley
and
Copilot
committed
Address additional reviewer feedback on RSA key sizes and RNG wording

jeffhandley
and
Copilot
committed
Modernize hardware encryption sample: SHA-1 to SHA-256, add disposal

jeffhandley
and
Copilot
committed
Remove remaining AES-GCM reference and soften algorithm recommendations

jeffhandley
and
Copilot
committed
Align broader security docs with current NIST guidance

jeffhandley
and
Copilot
committed
Tighten remaining security compatibility docs

jeffhandley
and
Copilot
committed
Remove remaining AES-GCM recommendations

jeffhandley
and
Copilot
committed
Fix DPAPI sample analyzer failures

jeffhandley
and
Copilot
committed
Fix CryptoWalkThru partial reads

jeffhandley
and
Copilot
committed

Commits on Apr 17, 2026

Apply feedback (top half)
bartonjs
authored

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update security docs to address outdated cryptographic defaults, broken samples, and weak recommendations#53164

Update security docs to address outdated cryptographic defaults, broken samples, and weak recommendations#53164
jeffhandley wants to merge 21 commits intodotnet:mainfrom
jeffhandley:jeffhandley/outdated-recommendations

Commits on Apr 16, 2026

Add OWASP-aligned PBKDF2 iteration guidance and password hashing context

Modernize AES encryption snippets and add CBC mode warnings

Replace 1024-bit RSA and PKCS#1 v1.5 with 2048-bit RSA and OAEP

Add deprecation warnings for legacy crypto algorithms and APIs

Fix correctness bugs in crypto code samples

Address PR review feedback

Revert DPAPI RNG to RNGCryptoServiceProvider for net461 compat

Address second round of PR review feedback

Fix RSACryptoServiceProvider obsoletion wording in hardware encryption doc

Add VB DPAPI project file and re-apply fixes

Restore hard-coded sample keys with illustration comments

Address reviewer feedback: NIST over OWASP, no algorithm names, no AES-GCM

Address additional reviewer feedback on RSA key sizes and RNG wording

Modernize hardware encryption sample: SHA-1 to SHA-256, add disposal

Remove remaining AES-GCM reference and soften algorithm recommendations

Align broader security docs with current NIST guidance

Tighten remaining security compatibility docs

Remove remaining AES-GCM recommendations

Fix DPAPI sample analyzer failures

Fix CryptoWalkThru partial reads

Commits on Apr 17, 2026

Apply feedback (top half)