Skip to content

Conversation

Copy link
Contributor

Copilot AI commented Jan 7, 2026

DSA (Digital Signature Algorithm) support has been removed from macOS in .NET 11 Preview 1. Apple deprecated the SecurityTransforms library that provided the implementation, which only supported weak DSA-1024 with SHA-1 and never supported key generation.

Changes

  • New breaking change document: docs/core/compatibility/cryptography/11.0/dsa-removed-macos.md

    • Documents PlatformNotSupportedException thrown by DSA APIs on macOS
    • Finite field DSA only; EC-DSA unaffected
    • Migration path: DSA.Create()ECDsa.Create()
  • Index updates: Added Cryptography section to docs/core/compatibility/11.md

  • TOC updates: Added navigation entry in docs/core/compatibility/toc.yml

Affected APIs

  • System.Security.Cryptography.DSA.Create (all overloads)
  • System.Security.Cryptography.DSACryptoServiceProvider (all constructors)
  • System.Security.Cryptography.X509Certificates.DSACertificateExtensions.* (GetDSAPrivateKey, GetDSAPublicKey, CopyWithPrivateKey)

iOS, tvOS, and MacCatalyst never supported DSA and remain unaffected.

Original prompt

This section details on the original issue you should resolve

<issue_title>[Breaking change]: DSA has been removed from macOS</issue_title>
<issue_description>### Description

The Digital Signature Algorithm (DSA) has been removed from macOS. This only impacts "finite field" DSA. Elliptic Curve DSA (EC-DSA) is not affected.

Version

.NET 11 Preview 1

Previous behavior

The DSA algorithm and its supporting types, DSA, DSACryptoServiceProvider and X.509 certificates with DSA keys would function on macOS.

New behavior

DSA is no longer functional on macOS. Attempts to use DSA. DSACryptoServiceProvider, or other APIs that interact with DSA will throw PlatformNotSupportedException.

Type of breaking change

  • Binary incompatible: Existing binaries might encounter a breaking change in behavior, such as failure to load or execute, and if so, require recompilation.
  • Source incompatible: When recompiled using the new SDK or component or to target the new runtime, existing source code might require source changes to compile successfully.
  • Behavioral change: Existing binaries might behave differently at run time.

Reason for change

.NET on macOS relies on the operating system to provide an implementation of DSA. Apple did this through a now obsolete library called SecurityTransforms, with no replacement. The implementation that Apple did offer was also limited in functionality. It only supported DSA-1024 with SHA-1 which is considered weak. Further, it never supported generating DSA keys.

iOS, tvOS, and MacCatalyst never supported DSA.

Recommended action

Migrate away from the DSA algorithm and use a modern cryptographic digital signature algorithm such as EC-DSA.

Feature area

Cryptography

Affected APIs

  • M:System.Security.Cryptography.DSA.Create (all overloads)
  • M:System.Security.Cryptography.DSACryptoServiceProvider.#ctor (all overloads)
  • M:System.Security.Cryptography.X509Certificates.DSACertificateExtensions.GetDSAPrivateKey (all overloads)
  • M:System.Security.Cryptography.X509Certificates.DSACertificateExtensions.GetPublicKey (all overloads)
  • M:System.Security.Cryptography.X509Certificates.DSACertificateExtensions.GetDSAPrivateKey (all overloads)
  • M:System.Security.Cryptography.X509Certificates.DSACertificateExtensions.CopyWithPrivateKey (all overloads)

Additionally, any APIs that interact with DSA keys.


Associated WorkItem - 543460</issue_description>

Comments on the Issue (you are @copilot in this section)

@vcsjones /cc @bartonjs @bartonjs LGTM

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.


Internal previews

📄 File 🔗 Preview link
docs/core/compatibility/11.md Breaking changes in .NET 11
docs/core/compatibility/cryptography/11/dsa-removed-macos.md DSA removed from macOS
docs/core/compatibility/toc.yml docs/core/compatibility/toc
docs/core/compatibility/unsupported-apis.md APIs that always throw exceptions on .NET (Core)

Copilot AI changed the title [WIP] Remove DSA support for macOS due to deprecation Document DSA removal from macOS in .NET 11 Jan 7, 2026
Copilot AI requested a review from gewarren January 7, 2026 23:07
Updated recommendations for migrating away from DSA algorithm and clarified affected APIs.
@gewarren gewarren marked this pull request as ready for review January 9, 2026 01:19
@gewarren gewarren requested a review from a team as a code owner January 9, 2026 01:19
Copilot AI review requested due to automatic review settings January 9, 2026 01:19
@gewarren gewarren enabled auto-merge (squash) January 9, 2026 01:19
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR documents the removal of DSA (Digital Signature Algorithm) support from macOS in .NET 11 Preview 1. Apple deprecated the SecurityTransforms library that provided the implementation, which only supported weak DSA-1024 with SHA-1 and never supported key generation.

Key Changes

  • Added comprehensive breaking change documentation for DSA removal from macOS
  • Updated the .NET 11 breaking changes index to include new Cryptography section
  • Added navigation entry in the table of contents
  • Updated unsupported APIs list with DSA-related APIs for macOS

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File Description
docs/core/compatibility/cryptography/11/dsa-removed-macos.md New breaking change document detailing DSA removal, affected APIs, and migration guidance to EC-DSA
docs/core/compatibility/11.md Added Cryptography section with reference to DSA removal document
docs/core/compatibility/toc.yml Added Cryptography navigation entry under .NET 11 breaking changes
docs/core/compatibility/unsupported-apis.md Added five DSA-related API entries for macOS platform with .NET 11+ footnote

@gewarren gewarren closed this Jan 9, 2026
auto-merge was automatically disabled January 9, 2026 01:31

Pull request was closed

@gewarren gewarren reopened this Jan 9, 2026
@gewarren gewarren requested a review from vcsjones January 9, 2026 01:40
Copy link
Member

@BillWagner BillWagner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This LGTM.

Let's :shipit:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Breaking change]: DSA has been removed from macOS

4 participants