Conversation
Copilot created this pull request from a session on behalf of
krwq
April 16, 2026 11:13
View session
krwq
marked this pull request as ready for review
April 16, 2026 11:13
github-actions
Bot
added
the
area-Meta
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates .NET API reference documentation and snippet comments to avoid recommending specific cryptographic algorithms, instead steering readers toward NIST guidance (notably NIST SP 800-131A Rev. 2), and refreshes PBKDF2 iteration guidance.
Changes:
- Replaces “use AES/SHA-256/RSA/ECDsa” style recommendations with “NIST-approved …” guidance across many XML docs and snippets.
- Updates PBKDF2 (
Rfc2898DeriveBytes) guidance (including minimum recommended iterations) and adds clearer security notes about defaults. - Adds/updates snippet safety comments (hard-coded credentials, SQL injection, deprecated/weak crypto).
Reviewed changes
Copilot reviewed 115 out of 115 changed files in this pull request and generated 9 comments.
Show a summary per file
| File | Description |
|---|---|
| xml/System.Workflow.ComponentModel.Compiler/WorkflowMarkupSourceAttribute.xml | Switches MD5 replacement guidance to “NIST-approved hash function.” |
| xml/System.Web/HttpWorkerRequest.xml | Updates MD5 guidance to “NIST-approved hash function.” |
| xml/System.Web.Security/SqlMembershipProvider.xml | Updates SHA1 guidance to “NIST-approved hash function.” |
| xml/System.Web.Security/MembershipPasswordFormat.xml | Updates SHA1 guidance and clarifies illustrative-only usage. |
| xml/System.Web.Configuration/MachineKeySection.xml | Updates SHA1 example guidance and clarifies illustrative-only usage. |
| xml/System.Web.Configuration/FormsAuthPasswordFormat.xml | Updates MD5/SHA1 guidance to “NIST-approved hash function.” |
| xml/System.ServiceModel/MsmqTransportSecurity.xml | Adds RC4 insecurity warning; updates SHA-1 hash guidance to NIST-approved language. |
| xml/System.ServiceModel/MsmqSecureHashAlgorithm.xml | Updates MD5/SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.ServiceModel.Security/TripleDesSecurityAlgorithmSuite.xml | Updates SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.ServiceModel.Security/SecurityKeyEntropyMode.xml | Updates SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.ServiceModel.Security/Basic256SecurityAlgorithmSuite.xml | Updates SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.ServiceModel.Security/Basic192SecurityAlgorithmSuite.xml | Updates SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.ServiceModel.Security/Basic128SecurityAlgorithmSuite.xml | Updates SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.ServiceModel.Configuration/MsmqTransportSecurityElement.xml | Mirrors MSMQ RC4 warning addition in configuration element docs. |
| xml/System.Security.Policy/Hash.xml | Updates MD5/SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.Security.Cryptography/TripleDESCryptoServiceProvider.xml | Replaces AES recommendation with NIST-approved symmetric encryption guidance + NIST link. |
| xml/System.Security.Cryptography/TripleDESCng.xml | Replaces AES recommendation with NIST-approved symmetric encryption guidance + NIST link. |
| xml/System.Security.Cryptography/TripleDES.xml | Replaces AES recommendation with NIST-approved symmetric encryption guidance + NIST link. |
| xml/System.Security.Cryptography/SHA1Managed.xml | Updates SHA-1 guidance to NIST-approved language + NIST link. |
| xml/System.Security.Cryptography/SHA1CryptoServiceProvider.xml | Updates SHA-1 guidance to NIST-approved language + NIST link. |
| xml/System.Security.Cryptography/SHA1Cng.xml | Updates SHA-1 guidance to NIST-approved language + NIST link. |
| xml/System.Security.Cryptography/SHA1.xml | Updates SHA-1 guidance to NIST-approved language + NIST link. |
| xml/System.Security.Cryptography/Rfc2898DeriveBytes.xml | Adds PRF/default guidance and updates minimum iteration recommendation to 600,000 with NIST references. |
| xml/System.Security.Cryptography/RSAEncryptionPadding.xml | Updates SHA-1 guidance to NIST-approved language (NIST SP reference). |
| xml/System.Security.Cryptography/RSACryptoServiceProvider.xml | Adds RSA key-size warning and updates hash guidance to NIST-approved language + NIST link. |
| xml/System.Security.Cryptography/RC2CryptoServiceProvider.xml | Replaces AES recommendation with NIST-approved symmetric encryption guidance + NIST link. |
| xml/System.Security.Cryptography/RC2.xml | Replaces AES recommendation with NIST-approved symmetric encryption guidance + NIST link. |
| xml/System.Security.Cryptography/PasswordDeriveBytes.xml | Adds guidance to avoid PBKDF1 for new applications in favor of PBKDF2. |
| xml/System.Security.Cryptography/PKCS1MaskGenerationMethod.xml | Updates SHA-1 guidance to NIST-approved language + NIST link. |
| xml/System.Security.Cryptography/MD5CryptoServiceProvider.xml | Replaces specific hash recommendations with NIST-approved guidance + NIST link. |
| xml/System.Security.Cryptography/MD5.xml | Replaces specific hash recommendations with NIST-approved guidance + NIST link. |
| xml/System.Security.Cryptography/KeyedHashAlgorithm.xml | Updates SHA-1 guidance to NIST-approved language + NIST link. |
| xml/System.Security.Cryptography/HashAlgorithmName.xml | Updates MD5/SHA-1 guidance to NIST-approved language + NIST link. |
| xml/System.Security.Cryptography/HashAlgorithm.xml | Updates SHA-1 guidance to NIST-approved language + NIST link. |
| xml/System.Security.Cryptography/HMACSHA1.xml | Updates SHA-1 guidance to NIST-approved language + NIST link. |
| xml/System.Security.Cryptography/HMACRIPEMD160.xml | Updates MD4/MD5 guidance to NIST-approved language + NIST link. |
| xml/System.Security.Cryptography/HMACMD5.xml | Updates MD5 guidance to NIST-approved language + NIST link. |
| xml/System.Security.Cryptography/HMAC.xml | Updates MD5/SHA-1 guidance to NIST-approved language + NIST link. |
| xml/System.Security.Cryptography/ECDsaCng.xml | Updates hash guidance to NIST-approved language + NIST link while retaining default algorithm fact. |
| xml/System.Security.Cryptography/ECDiffieHellmanCng.xml | Updates hash guidance to NIST-approved language + NIST link while retaining default algorithm fact. |
| xml/System.Security.Cryptography/DSASignatureFormatter.xml | Replaces RSA/ECDsa recommendation with NIST-approved digital signature guidance + NIST link. |
| xml/System.Security.Cryptography/DSASignatureFormat.xml | Replaces RSA/ECDsa recommendation with NIST-approved digital signature guidance + NIST link. |
| xml/System.Security.Cryptography/DSASignatureDeformatter.xml | Replaces RSA/ECDsa recommendation with NIST-approved digital signature guidance + NIST link. |
| xml/System.Security.Cryptography/DSAParameters.xml | Replaces RSA/ECDsa recommendation with NIST-approved digital signature guidance + NIST link. |
| xml/System.Security.Cryptography/DSAOpenSsl.xml | Replaces RSA/ECDsa recommendation with NIST-approved digital signature guidance + NIST link. |
| xml/System.Security.Cryptography/DSACryptoServiceProvider.xml | Replaces RSA recommendation with NIST-approved digital signature guidance + NIST link; updates SHA-1 guidance. |
| xml/System.Security.Cryptography/DSACng.xml | Replaces RSA/ECDsa recommendation with NIST-approved digital signature guidance + NIST link. |
| xml/System.Security.Cryptography/DSA.xml | Replaces RSA/ECDsa recommendation with NIST-approved digital signature guidance + NIST link. |
| xml/System.Security.Cryptography/DESCryptoServiceProvider.xml | Replaces AES recommendation with NIST-approved symmetric encryption guidance + NIST link. |
| xml/System.Security.Cryptography/DES.xml | Strengthens DES deprecation warning and switches to NIST-approved symmetric encryption guidance + NIST link. |
| xml/System.Security.Cryptography/CngAlgorithm.xml | Updates MD5/SHA-1 guidance to NIST-approved language (NIST SP reference). |
| xml/System.Security.Cryptography.Xml/SignedXml.xml | Updates SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.Security.Cryptography.Xml/Reference.xml | Updates SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.Security.Cryptography.Xml/EncryptedXml.xml | Adds “illustrative only” note for TripleDES example and suggests NIST-approved symmetric encryption. |
| xml/System.Security.Cryptography.Pkcs/Pkcs12Builder.xml | Updates SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.Security.Authentication/SslProtocols.xml | Updates TLS 1.0/1.1 summaries to note known vulnerabilities and recommend newer protocols. |
| xml/System.Security.Authentication/HashAlgorithmType.xml | Updates MD5/SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.Reflection/AssemblyHashAlgorithm.xml | Updates MD5/SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.Net/SecurityProtocolType.xml | Updates TLS 1.0/1.1 summaries to note known vulnerabilities and recommend newer protocols. |
| xml/System.Net/HttpResponseHeader.xml | Updates Content-MD5 guidance to “NIST-approved hash function.” |
| xml/System.Net/HttpRequestHeader.xml | Updates Content-MD5 guidance to “NIST-approved hash function.” |
| xml/System.Net.Http.Headers/HttpContentHeaders.xml | Updates Content-MD5 guidance to “NIST-approved hash function.” |
| xml/System.Messaging/Message.xml | Updates MD5/SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.Messaging/DefaultPropertiesToSend.xml | Updates MD5 guidance to “NIST-approved hash function.” |
| xml/System.IdentityModel/RsaSignatureCookieTransform.xml | Updates SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.IdentityModel/RsaEncryptionCookieTransform.xml | Updates SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.IdentityModel.Tokens/X509AsymmetricSecurityKey.xml | Updates SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.IdentityModel.Tokens/SymmetricSecurityKey.xml | Updates SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.IdentityModel.Tokens/SecurityAlgorithms.xml | Updates SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.IdentityModel.Tokens/InMemorySymmetricSecurityKey.xml | Updates SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.IO.Packaging/PackageDigitalSignatureManager.xml | Updates SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.Configuration.Assemblies/AssemblyHashAlgorithm.xml | Updates SHA-1 guidance to “NIST-approved hash function.” |
| xml/System.CodeDom/CodeChecksumPragma.xml | Updates SHA-1/MD5 guidance to “NIST-approved hash function.” |
| snippets/visualbasic/VS_Snippets_WebNet/System.Configuration.ProtectedConfigurationProvider/VB/ProtectedConfigurationProviderLib.vb | Adds TripleDES deprecation warning and NIST-approved guidance. |
| snippets/visualbasic/VS_Snippets_Data/XslCompiledTransform.Transform/VB/Xslt_Transform_v2.vb | Adds guidance not to hardcode credentials and to use a secure store. |
| snippets/visualbasic/VS_Snippets_Data/XslCompiledTransform.Load/VB/Xslt_Load_v2.vb | Adds guidance not to hardcode credentials and to use a secure store. |
| snippets/visualbasic/VS_Snippets_Data/XmlResolver_Samples/VB/XmlResolver_Samples.vb | Adds guidance not to hardcode credentials and to use a secure store. |
| snippets/visualbasic/VS_Snippets_Data/XmlReader.Create/VB/XmlReader_Create.vb | Adds guidance not to hardcode credentials and to use a secure store. |
| snippets/visualbasic/VS_Snippets_CFX/samlattribute/vb/source.vb | Updates SHA1 collision guidance to NIST-approved wording. |
| snippets/visualbasic/VS_Snippets_CFX/s_ueclientcredentials/vb/program.vb | Adds guidance not to hardcode credentials and to use a secure store. |
| snippets/visualbasic/System.Security.Cryptography/Rfc2898DeriveBytes/Overview/rfc28981.vb | Updates PBKDF2 iteration-count comment to reference NIST SP 800-132 guidance. |
| snippets/visualbasic/System.Security.Cryptography/RSACryptoServiceProvider/SignHash/class1.vb | Updates SHA1 collision guidance to NIST-approved wording. |
| snippets/visualbasic/System.Security.Cryptography/PasswordDeriveBytes/Overview/sample.vb | Updates SHA1 collision guidance to NIST-approved wording. |
| snippets/visualbasic/System.Security.Cryptography/DESCryptoServiceProvider/Overview/source.vb | Adds DES insecurity warning and NIST-approved symmetric encryption guidance. |
| snippets/visualbasic/System.Security.Cryptography/DESCryptoServiceProvider/CreateEncryptor/memoryexample.vb | Adds DES insecurity warning and NIST-approved symmetric encryption guidance. |
| snippets/visualbasic/System.Security.Cryptography/DESCryptoServiceProvider/CreateEncryptor/fileexample.vb | Adds DES insecurity warning and NIST-approved symmetric encryption guidance. |
| snippets/visualbasic/System.Security.Cryptography/DES/Create/memoryexample.vb | Adds DES insecurity warning and NIST-approved symmetric encryption guidance. |
| snippets/visualbasic/System.Security.Cryptography/DES/Create/fileexample.vb | Adds DES insecurity warning and NIST-approved symmetric encryption guidance. |
| snippets/visualbasic/System.Security.Cryptography/CryptoConfig/Overview/members.vb | Updates SHA1 collision guidance to NIST-approved wording. |
| snippets/visualbasic/System.Security.Cryptography/AsymmetricAlgorithm/Overview/customcrypto.vb | Updates SHA1 collision guidance to NIST-approved wording. |
| snippets/visualbasic/System.CodeDom/CodeChecksumPragma/Overview/codedirective.vb | Updates SHA1/MD5 collision guidance to NIST-approved wording. |
| snippets/csharp/VS_Snippets_WebNet/System.Configuration.ProtectedConfigurationProvider/CS/ProtectedConfigurationProviderLib.cs | Adds TripleDES deprecation warning and NIST-approved guidance. |
| snippets/csharp/VS_Snippets_CFX/windowsclientcredential/cs/source.cs | Adds guidance not to hardcode credentials and to use a secure store. |
| snippets/csharp/VS_Snippets_CFX/samlattribute/cs/source.cs | Updates SHA1 collision guidance to NIST-approved wording. |
| snippets/csharp/VS_Snippets_CFX/s_uex509certificatevalidationmode/cs/client.cs | Adds guidance not to hardcode credentials and to use a secure store. |
| snippets/csharp/VS_Snippets_CFX/s_ueclientcredentials/cs/program.cs | Adds guidance not to hardcode credentials and to use a secure store. |
| snippets/csharp/VS_Snippets_CFX/s_ue_httpdigestclientcredential/cs/source.cs | Adds guidance not to hardcode credentials and to use a secure store. |
| snippets/csharp/System.Xml/XmlUrlResolver/Overview/XmlResolver_Samples.cs | Adds guidance not to hardcode credentials and to use a secure store. |
| snippets/csharp/System.Xml/XmlResolver/Overview/Xslt_Load_v2.cs | Adds guidance not to hardcode credentials and to use a secure store. |
| snippets/csharp/System.Xml/XmlParserContext/Overview/XmlReader_Create.cs | Adds guidance not to hardcode credentials and to use a secure store. |
| snippets/csharp/System.Xml.Xsl/XslCompiledTransform/Overview/Xslt_Transform_v2.cs | Adds guidance not to hardcode credentials and to use a secure store. |
| snippets/csharp/System.Windows.Forms/DataGridView/CellContentClick/employees.cs | Adds SQL injection warning and recommends parameterized queries. |
| snippets/csharp/System.Security.Cryptography/Rfc2898DeriveBytes/Overview/rfc28981.cs | Updates PBKDF2 iteration-count comment to reference NIST SP 800-132 guidance. |
| snippets/csharp/System.Security.Cryptography/RSACryptoServiceProvider/SignHash/class1.cs | Updates SHA1 collision guidance to NIST-approved wording. |
| snippets/csharp/System.Security.Cryptography/PasswordDeriveBytes/Overview/sample.cs | Updates SHA1 collision guidance to NIST-approved wording. |
| snippets/csharp/System.Security.Cryptography/DESCryptoServiceProvider/Overview/source.cs | Adds DES insecurity warning and NIST-approved symmetric encryption guidance. |
| snippets/csharp/System.Security.Cryptography/DESCryptoServiceProvider/CreateEncryptor/memoryexample.cs | Adds DES insecurity warning and NIST-approved symmetric encryption guidance. |
| snippets/csharp/System.Security.Cryptography/DESCryptoServiceProvider/CreateEncryptor/fileexample.cs | Adds DES insecurity warning and NIST-approved symmetric encryption guidance. |
| snippets/csharp/System.Security.Cryptography/DES/Create/memoryexample.cs | Adds DES insecurity warning and NIST-approved symmetric encryption guidance. |
| snippets/csharp/System.Security.Cryptography/DES/Create/fileexample.cs | Adds DES insecurity warning and NIST-approved symmetric encryption guidance. |
| snippets/csharp/System.Security.Cryptography/CryptoConfig/Overview/members.cs | Updates SHA1 collision guidance to NIST-approved wording. |
| snippets/csharp/System.Security.Cryptography/CryptoAPITransform/Overview/members.cs | Adds DES insecurity warning and NIST-approved symmetric encryption guidance. |
| snippets/csharp/System.Security.Cryptography/AsymmetricAlgorithm/Overview/customcrypto.cs | Updates SHA1 collision guidance to NIST-approved wording. |
| snippets/csharp/System.Net/ICertificatePolicy/Overview/source.cs | Adds warning about obsolete API and certificate-validation bypass risks. |
| snippets/csharp/System.CodeDom/CodeChecksumPragma/Overview/codedirective.cs | Updates SHA1/MD5 collision guidance to NIST-approved wording. |
gewarren
reviewed
Apr 16, 2026
| // WARNING: This example uses string concatenation for simplicity. | ||
| // In production code, always use parameterized queries to prevent | ||
| // SQL injection attacks. | ||
| DataGridView2.DataSource = Populate("SELECT * FROM Orders WHERE EmployeeId = " + employeeId); |
Collaborator
There was a problem hiding this comment.
If it's straightforward to use a parameterized query, I think we should do that, or I can do it in a follow up PR.
Member
There was a problem hiding this comment.
Note
This comment is AI-generated.
Opened as follow-up: #13072.
| > This type implements the <xref:System.IDisposable> interface. When you have finished using the type, you should dispose of it either directly or indirectly. To dispose of the type directly, call its <xref:System.IDisposable.Dispose*> method in a `try`/`catch` block. To dispose of it indirectly, use a language construct such as `using` (in C#) or `Using` (in Visual Basic). For more information, see the "Using an Object that Implements IDisposable" section in the <xref:System.IDisposable> interface topic. | ||
|
|
||
| Due to collision problems with SHA-1, Microsoft recommends a security model based on SHA-256 or better. | ||
| Due to collision problems with SHA-1, Microsoft recommends a security model based on a NIST-approved hash function. See [NIST SP 800-131A Rev. 2](https://csrc.nist.gov/pubs/sp/800/131/a/r2/final) for guidance on approved algorithms. |
Collaborator
There was a problem hiding this comment.
Suggested change
| Due to collision problems with SHA-1, Microsoft recommends a security model based on a NIST-approved hash function. See [NIST SP 800-131A Rev. 2](https://csrc.nist.gov/pubs/sp/800/131/a/r2/final) for guidance on approved algorithms. | |
| Due to collision problems with SHA-1, Microsoft recommends a security model based on an NIST-approved hash function. See [NIST SP 800-131A Rev. 2](https://csrc.nist.gov/pubs/sp/800/131/a/r2/final) for guidance on approved algorithms. |
Collaborator
There was a problem hiding this comment.
Not sure if it's generally pronounced "nist" or "n-i-s-t". If the latter, the article should be "an".
Member
There was a problem hiding this comment.
I'd say it's 99:1 "nist" over "N-I-S-T". So "NIST SP 800-131A" is "nist s-p eight hundred, one thirty one, a". ChatGPT's take on turning that into IPA is /nɪst ˌɛs ˈpiː ˌeɪt ˈhʌndrəd wʌn ˈθɜrti wʌn eɪ/, which looks sort of right? 😄
Member
There was a problem hiding this comment.
non-native listening to this 💀⚰️ pronouncing /ɲist/ in my head and starting to learn the phonetical alphabet because of @bartonjs
Contributor
Author
mconnew
reviewed
Apr 20, 2026
krwq
force-pushed
the
copilot/fix-incorrect-security-guidelines
branch
from
September 16, 2026 11:31
5b93c40 to
c025bdb
Compare
Member
|
Note This comment is AI-generated. Rebased onto current Applied
Pushed back on / not applied
Rebase noteThe PR branch had drifted so far from |
krwq
force-pushed
the
copilot/fix-incorrect-security-guidelines
branch
2 times, most recently
from
September 16, 2026 11:44
91df73f to
9beed96
Compare
…references Security warnings across the docs recommended specific algorithms (AES, SHA-256, RSA, ECDsa) as replacements for deprecated ones. These become stale as standards evolve. All recommendations now defer to NIST SP 800-131A Rev. 2 instead of naming specific algorithms. - Symmetric ciphers (DES, TripleDES, RC2, EncryptedXml): 'use AES' -> 'NIST-approved symmetric encryption algorithm' - Hash functions (SignedXml, Pkcs12Builder, SecurityAlgorithmSuite, HttpHeaders, etc.): 'SHA-256 or better' -> 'NIST-approved hash function' with NIST SP 800-131A Rev. 2 link - Digital signatures (DSA family): 'use RSA/ECDsa' -> 'NIST-approved digital signature algorithm' - PBKDF2 (Rfc2898DeriveBytes): iteration count updated from 1,000 -> 600,000; refers to NIST SP 800-132 - MD5 note upgraded to IMPORTANT; TLS 1.0/1.1 vulnerability note moved to Remarks in SecurityProtocolType Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
krwq
force-pushed
the
copilot/fix-incorrect-security-guidelines
branch
from
September 16, 2026 11:49
9beed96 to
0d78d17
Compare
Member
|
Note This comment is AI-generated. CI now green ✅ (all checks pass). Summary of what happened:
Final tree: 58 files changed, +132/-82 vs I did not attempt to fix the snippet build infra in this PR — it's out of scope, and reviewers already noted (in the SQL-injection comment) that follow-up PRs are the preferred path. |
gewarren
pushed a commit
that referenced
this pull request
Sep 17, 2026
… (#13072) * employees snippet: use parameterized SQL for PopulateSales Follow-up to PR #12524 (review comment on employees.cs). The PopulateSales method concatenated the `EmployeeId` cell value into a `SELECT ... WHERE EmployeeId = ` literal, so an untrusted cell value could produce SQL injection. Use a SqlParameter and a matching `@EmployeeId` placeholder instead. The parameterless `Populate` overload is kept for the existing call sites; a new `params SqlParameter[]` overload backs the parameterized call and forwards to the same connection/adapter path. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: ef73ba66-2734-45b8-ab5b-243681f0e519 * Add Project.csproj so CellContentClick snippet builds in CI The employees.cs snippet had no project file, so touching it fails the Snippets 5000 pipeline with CS0234/CS0246 for the System.Windows.Forms and System.Data.SqlClient types it references. Add a net10.0-windows project mirroring the sibling DataGridView\BeginEdit project, plus a System.Data.SqlClient PackageReference. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: ef73ba66-2734-45b8-ab5b-243681f0e519 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: ef73ba66-2734-45b8-ab5b-243681f0e519
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security warnings across the docs recommend specific algorithms (AES, SHA-256, RSA, ECDsa) as replacements for deprecated ones. These become stale as standards evolve — e.g., "use Aes (AES-256)" is already not future-proof.
All recommendations now defer to NIST SP 800-131A Rev. 2 instead of naming specific algorithms.
XML docs (~37 files)
Snippet code comments (~25 files)
// For new applications, use Aes (AES-256) instead.→// For new applications, use a NIST-approved symmetric encryption algorithm instead.// Microsoft recommends SHA256 or better.→// Microsoft recommends using a NIST-approved hash function.Pattern used
Factual statements about API defaults (e.g., "The default algorithm is
CngAlgorithm.Sha256") and Rijndael→Aes migration guidance are preserved — only recommendations were changed.Internal previews
Toggle expand/collapse
Note
This table shows the first 50 preview links (sorted alphabetically by file path) found in the OPS build report. For the full list, select OpenPublishing.Build Details within checks.
Build report