diff --git a/docs/core/compatibility/11.md b/docs/core/compatibility/11.md index 8ded84052a641..8572f1eb62f0f 100644 --- a/docs/core/compatibility/11.md +++ b/docs/core/compatibility/11.md @@ -23,6 +23,12 @@ If you're migrating an app to .NET 11, the breaking changes listed here might af | [MemoryStream maximum capacity updated and exception behavior changed](core-libraries/11/memorystream-max-capacity.md) | Behavioral change | | [TAR-reading APIs verify header checksums when reading](core-libraries/11/tar-checksum-validation.md) | Behavioral change | +## Cryptography + +| Title | Type of change | +|------------------------------------------------------------------|-------------------| +| [DSA removed from macOS](cryptography/11/dsa-removed-macos.md) | Behavioral change | + ## Globalization | Title | Type of change | diff --git a/docs/core/compatibility/cryptography/11/dsa-removed-macos.md b/docs/core/compatibility/cryptography/11/dsa-removed-macos.md new file mode 100644 index 0000000000000..f8fd012423397 --- /dev/null +++ b/docs/core/compatibility/cryptography/11/dsa-removed-macos.md @@ -0,0 +1,47 @@ +--- +title: "Breaking change: DSA removed from macOS" +description: "Learn about the breaking change in .NET 11 where the Digital Signature Algorithm (DSA) is no longer supported on macOS." +ms.date: 01/07/2026 +ai-usage: ai-assisted +ms.custom: https://github.com/dotnet/docs/issues/48201 +--- + +# DSA removed from macOS + +Starting in .NET 11, the Digital Signature Algorithm (DSA) is no longer supported on macOS. This removal only impacts "finite field" DSA. Elliptic Curve DSA (EC-DSA) isn't affected. Attempts to use , , or other APIs that interact with DSA throw a on macOS. + +## Version introduced + +.NET 11 Preview 1 + +## Previous behavior + +Previously, the DSA algorithm and its supporting types, , , and X.509 certificates with DSA keys functioned on macOS. + +## New behavior + +DSA is no longer functional on macOS. Attempts to use , , or other APIs that interact with DSA throw a . + +## Type of breaking change + +This change is a [behavioral change](../../categories.md#behavioral-change). + +## Reason for change + +.NET on macOS relies on the operating system to provide an implementation of DSA. Apple did this through a now obsolete library called SecurityTransforms, with no replacement. The implementation that Apple did offer was also limited in functionality. It only supported DSA-1024 with SHA-1, which is considered weak. Further, it never supported generating DSA keys. + +iOS, tvOS, and MacCatalyst never supported DSA. + +## Recommended action + +Migrate away from the DSA algorithm and use a modern cryptographic digital signature algorithm such as EC-DSA (Elliptic Curve DSA). + +## Affected APIs + +* +* [DSACryptoServiceProvider constructors](xref:System.Security.Cryptography.DSACryptoServiceProvider.%23ctor*) +* +* +* + +Additionally, any APIs that interact with DSA keys are affected. diff --git a/docs/core/compatibility/toc.yml b/docs/core/compatibility/toc.yml index 92a4e59be37e3..cd716c0da2c7a 100644 --- a/docs/core/compatibility/toc.yml +++ b/docs/core/compatibility/toc.yml @@ -18,6 +18,10 @@ items: href: core-libraries/11/memorystream-max-capacity.md - name: TAR-reading APIs verify header checksums when reading href: core-libraries/11/tar-checksum-validation.md + - name: Cryptography + items: + - name: DSA removed from macOS + href: cryptography/11/dsa-removed-macos.md - name: Globalization items: - name: Japanese Calendar minimum supported date corrected diff --git a/docs/core/compatibility/unsupported-apis.md b/docs/core/compatibility/unsupported-apis.md index 864b69782a092..8425608369512 100644 --- a/docs/core/compatibility/unsupported-apis.md +++ b/docs/core/compatibility/unsupported-apis.md @@ -2,7 +2,7 @@ title: Unsupported APIs on .NET Core and .NET 5+ titleSuffix: "" description: Learn which .NET APIs always throw an exception on .NET Core and .NET 5 and later versions. -ms.date: 11/07/2025 +ms.date: 01/08/2026 --- # APIs that always throw exceptions on .NET (Core) @@ -265,6 +265,11 @@ This article organizes the affected APIs by namespace. | | Linux and macOS | | | Linux and macOS | | | Linux and macOS | +| \* | macOS | +| \* | macOS | +| \* | macOS | +| \* | macOS | +| \* | macOS | | | macOS | | | All | | | All | @@ -297,6 +302,8 @@ This article organizes the affected APIs by namespace. | | All | | | All | +\* .NET 11 and later versions. + ## System.Security.Cryptography.Pkcs | Member | Platforms that throw |