MaxReferencesPerSignedInfo hard-coded to 100 in System.Security.Cryptography.Xml

[wikendu-th]

We had an issue with XML Signing in a .NET Framework application on Windows (System.Security.Cryptography.CryptographicException:
Malformed element SignedInfo/Reference.) and successfully used a workaround setting the registry key SignedXmlMaxReferencesPerSignedInfo:

After some setting up and debuging system libraries I found out where it throws the excpetion and apperantly by default it only allow 100 recipients. To change that, I needed to add a new registry key named "SignedXmlMaxReferencesPerSignedInfo" with DWord value to be greater than 145 in my case to "Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft.NETFramework\Security" and it started working.

SignedXml.LoadXML((XmlElement)nodeList[0]) throwing "Malformed element SignedInfo/Reference"

We planned on migrating the application to .NET 10. But in we found that in .NET 10 the limit is hard-coded to 100 References, which would make it impossible to migrate while using System.Security.Cryptography.Xml.

Is it possible to make this limit configurable again?

Check located in SignedInfo.cs:
https://github.com/dotnet/runtime/blob/v10.0.2/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/SignedInfo.cs#L260

Limit defined in Utils.cs: https://github.com/dotnet/runtime/blob/v10.0.2/src/libraries/System.Security.Cryptography.Xml/src/System/Security/Cryptography/Xml/Utils.cs#L763

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

[bartonjs]

The readme for System.Security.Cryptography.Xml describes our position on the library: the specs aren't good, so you don't want to use the library/concept at all, and we only fix critical issues in the library.

.NET 10 doesn't use the registry for configuration because we don't have an analogous system for Linux. We could invent a different configuration mechanism here (which would likely be AppConfig), but that wouldn't quite interoperate with what we have for .NET Framework.

If I recall correctly, we picked 100 rather arbitrarily, mostly as "1 makes sense.... 10 might make sense... so... 100?". I'm a bit curious as to why you have over 100 references.

[wikendu-th]

I'm a bit curious as to why you have over 100 references.

These are SOAP messages with sometimes have more than 100 attachments, with each attachment being represented as a reference in the XML signature. It is a rare occurrence, but the messages are produced outside of the application and must be processed.

[vcsjones]

Starting in version 11 of the System.Security.Cryptography.Xml package, an AppContext setting has been added so you will be able to do something like:

AppContext.SetData("System.Security.Cryptography.MaxReferencesPerSignedInfo", 200);

Putting that at the top of your program's Main before any SignedXmls are processed will allow you to configure the maximum references.