.NET 6: Interop.AppleCrypto.GetRandomBytes fails on all iOS Devices

[josephatkuvio]

Description

On .NET 6 Preview 7, all calls to Interop.AppleCrypto.GetRandomBytes fail on all current iOS devices with a DllNotFoundException: libcoreclr.so. This call works fine on all iOS Simulator configurations, and all other platforms tested.

In my particular case, this call is occurring within various public authentication libraries, to securely generate random strings for PKCE codes (both IdentityModel and System.Identity.Client). When I rebuild these libraries to use System.Random() instead (which I'm sure breaks compliance), the app runs fine. Not able to tell via the stack trace what the underlying issue might be.

Configuration

.NET 6 Preview 7
MAUI Single Project
Blazor + MAUI.WebView
iOS ARM64 Build
IdentityModel and/or System.Identity.Client Package

Regression?

Unknown, but likely a regression from mono/mono, as these packages work fine in Xamarin builds.

Other information

Relevant stack trace

System.DllNotFoundException: libcoreclr.so 
at Interop.AppleCrypto.GetRandomBytes(Byte*, Inte32) in System.Security.Cryptography.Algorithms.dll
at System.Security.Cryptography.RandomNumberGenerator in System.Security.Cryptography.Algorithms.dll
at IdentityModel.CryptoRandom.CreateRandomKey in IdentityModel.dll

Tagging subscribers to this area: @bartonjs, @vcsjones, @krwq, @GrabYourPitchforks
See info in area-owners.md if you want to be subscribed.

Issue Details

---

Description

On .NET 6 Preview 7, all calls to Interop.AppleCrypto.GetRandomBytes fail on all current iOS devices with a DllNotFoundException: libcoreclr.so. This call works fine on all iOS Simulator configurations, and all other platforms tested.

In my particular case, this call is occurring within various public authentication libraries, to securely generate random strings for PKCE codes (both IdentityModel and System.Identity.Client). When I rebuild these libraries to use System.Random() instead (which I'm sure breaks compliance), the app runs fine. Not able to tell via the stack trace what the underlying issue might be.

Configuration

.NET 6 Preview 7
MAUI Single Project
Blazor + MAUI.WebView
iOS ARM64 Build
IdentityModel and/or System.Identity.Client Package

Regression?

Unknown, but likely a regression from mono/mono, as these packages work fine in Xamarin builds.

Other information

Relevant stack trace

System.DllNotFoundException: libcoreclr.so 
at Interop.AppleCrypto.GetRandomBytes(Byte*, Inte32) in System.Security.Cryptography.Algorithms.dll
at System.Security.Cryptography.RandomNumberGenerator in System.Security.Cryptography.Algorithms.dll
at IdentityModel.CryptoRandom.CreateRandomKey in IdentityModel.dll

Author:	josephatkuvio
Assignees:	-
Labels:	area-System.Security, untriaged
Milestone:	-

[josephatkuvio]

FYI, similar issue here -- this one was marked closed as "should be working in Preview 7": #53749

@marek-safar not sure if you can tell if these issues are related.

[lambdageek]

/cc @steveisok

[lambdageek]

/cc @rolfbjarne Maybe related to dotnet/macios#12211 except this is for ios devices, not just catalyst

[akoeplinger]

hm I don't see a P/Invoke to libcoreclr.so in System.Security.Cryptography.Algorithms.dll from the preview7 runtime pack so something else must be going on:

ikdasm --moduleref /Users/alexander/Downloads/microsoft.netcore.app.runtime.mono.ios-arm64.6.0.0-preview.7.21377.19/runtimes/ios-arm64/lib/net6.0/System.Security.Cryptography.Algorithms.dll
ModuleRef Table (1..2)
1: /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation
2: libSystem.Security.Cryptography.Native.Apple

[filipnavara]

@akoeplinger I believe the (incorrect) name of the DLL comes from some fallback in the runtime. I've seen it before. Essentially it means that an attempt to load the correct library/entrypoint failed for some reason.

[akoeplinger]

@filipnavara ah good point, now that you mentioned it I remember

runtime/src/mono/mono/metadata/native-library.c

Line 1028 in 8bfb45a

retry_with_libcoreclr:

[filipnavara]

You were faster in finding it than me :-)

[filipnavara]

I actually think I know why this fails. For AOT the static versions of the libraries are linked into the main executable. However due to bug in earlier previews the symbols for "System.Native.Cryptography.Apple" were skipped in the process. This can lead to them being linked out. I'll try to find when this was fixed. Meanwhile, running nm on the final executable should tell whether some symbols were preserved or not.

[filipnavara]

So, the PR that should have fixed it is this one: dotnet/macios#12323.

It was merged after Preview 7, it is present in RC 1. If you feel adventurous you can try a prerelease.

[stephentoub]

retry_with_libcoreclr

Should this be changed such that the error which gets reported is for the original lib rather than for the retry? Just thinking about future diagnosability.