RSACertificateExtensions.GetRSAPublicKey Error

[enycw001]

The result is different in.net7 and.net8
.net7 returns RSACng, which is correct
.net8 returns RSABCrypt
The following is the code

cert = new("cert.pfx", "123456");
public_rsa = (RSACng)cert.GetRSAPublicKey();
private_rsa = (RSACng)cert.GetRSAPrivateKey();

[ghost]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

---

The result is different in.net7 and.net8
.net7 returns RSACng, which is correct
.net8 returns RSABCrypt
The following is the code

cert = new("cert.pfx", "123456");
public_rsa = (RSACng)cert.GetRSAPublicKey();
private_rsa = (RSACng)cert.GetRSAPrivateKey();

Author:	enycw001
Assignees:	-
Labels:	area-System.Security, untriaged
Milestone:	-

[stephentoub]

net7 returns RSACng, which is correct. .net8 returns RSABCrypt

They both return an RSA. The exact concrete derived type returned is not defined nor guaranteed and is considered an implementation detail. The actual type used was changed in #76277.

[vcsjones]

Stephen is correct, this was an intentional change for .NET 8. The return type will vary by operating system already, so you should avoid casting it to a specific implementation.

Ideally you would just use the return value as it is without casting it - this will ensure correct cross-platform behavior.

If you really need an RSACng instance because you only need to support Windows, you can round trip the parameters to the desired concrete type:

RSA rsa = cert.GetRSAPublicKey();
RSACng cng = new RSACng();
cng.ImportParameters(rsa.ExportParameters(false));
rsa.Dispose();

Since this is working as intended, and there are solutions to continue to use RSACng if needed, I am going to close this out. If you feel this has been inadequately answered, please feel free to re-open the issue.

Thanks!