1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
|
//------------------------------------------------------------
// Copyright (c) Microsoft Corporation. All rights reserved.
//------------------------------------------------------------
using System.Security;
using System.Security.Permissions;
using Microsoft.Win32;
using System.Runtime;
namespace System.ServiceModel.Security
{
static class SecurityUtilsEx
{
static int fipsAlgorithmPolicy = -1;
// Federal Information Processing Standards Publications
// at http://www.itl.nist.gov/fipspubs/geninfo.htm
// Note: this is copied from System.IdentityModel.SecurityUtilsEx.RequiresFipsCompliance.
internal static bool RequiresFipsCompliance
{
[Fx.Tag.SecurityNote(Critical = "Calls an UnsafeNativeMethod and a Critical method (GetFipsAlgorithmPolicyKeyFromRegistry).",
Safe = "Processes the return and just returns a bool, which is safe.")]
[SecuritySafeCritical]
get
{
if (fipsAlgorithmPolicy == -1)
{
if (OSEnvironmentHelper.IsVistaOrGreater)
{
bool fipsEnabled;
#pragma warning suppress 56523 // we check for the return code of the method instead of calling GetLastWin32Error
bool readPolicy = (System.ServiceModel.Channels.UnsafeNativeMethods.ERROR_SUCCESS == System.ServiceModel.Channels.UnsafeNativeMethods.BCryptGetFipsAlgorithmMode(out fipsEnabled));
if (readPolicy && fipsEnabled)
fipsAlgorithmPolicy = 1;
else
fipsAlgorithmPolicy = 0;
}
else
{
fipsAlgorithmPolicy = GetFipsAlgorithmPolicyKeyFromRegistry();
if (fipsAlgorithmPolicy != 1)
fipsAlgorithmPolicy = 0;
}
}
return fipsAlgorithmPolicy == 1;
}
}
const string fipsPolicyRegistryKey = @"System\CurrentControlSet\Control\Lsa";
[Fx.Tag.SecurityNote(Critical = "Asserts to get a value from the registry.")]
[SecurityCritical]
[RegistryPermission(SecurityAction.Assert, Read = @"HKEY_LOCAL_MACHINE\" + fipsPolicyRegistryKey)]
static int GetFipsAlgorithmPolicyKeyFromRegistry()
{
int fipsAlgorithmPolicy = -1;
using (RegistryKey fipsAlgorithmPolicyKey = Registry.LocalMachine.OpenSubKey(fipsPolicyRegistryKey, false))
{
if (fipsAlgorithmPolicyKey != null)
{
object data = fipsAlgorithmPolicyKey.GetValue("FIPSAlgorithmPolicy");
if (data != null)
fipsAlgorithmPolicy = (int)data;
}
}
return fipsAlgorithmPolicy;
}
}
}
|
