Gate Composite ML-DSA CNG tests on NCrypt support

[PranavSenthilnathan]

Fixes #132830

Gate Composite ML-DSA CNG tests when Windows exposes BCrypt support without corresponding NCrypt support.

A temporary NCrypt support check gates CNG tests until BCrypt and NCrypt support are provided together. The general Composite ML-DSA check uses specific Windows build revisions because not all machines have been serviced with support yet.

Note

GitHub Copilot helped create this PR.

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @bartonjs, @vcsjones, @dotnet/area-system-security
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

This PR refines Windows gating for Composite ML-DSA tests by (1) adding a Windows build+UBR based capability check for overall Composite ML-DSA support and (2) adding an NCrypt-based check to gate CNG-specific Composite ML-DSA tests.

Changes:

• Add PlatformDetection.IsWindowsCompositeMLDsaSupported which uses Windows build + UBR thresholds to detect Composite ML-DSA availability.
• Add an NCrypt probing gate (CompositeMLDsaTestHelpers.IsCngSupported) and use it to conditionally run Composite ML-DSA CNG tests on Windows.
• Update CompositeMLDsa factory/platform support tests to use the new Windows capability check.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/libraries/Common/tests/TestUtilities/System/PlatformDetection.Windows.cs	Adds a cached Windows build+UBR based check for Composite ML-DSA support.
src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaTestHelpers.Cng.cs	Introduces an NCrypt-based gate to determine whether Composite ML-DSA is supported through CNG/NCrypt.
src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaFactoryTests.cs	Updates Windows support expectations to use IsWindowsCompositeMLDsaSupported.
src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaCngTests.Windows.cs	Switches CNG test gating to use the NCrypt-based gate.
src/libraries/Common/src/Interop/Windows/NCrypt/Interop.NCryptOpenStorageProvider.cs	Adds the NCryptIsAlgSupported interop import used by the new test gate.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaTestHelpers.Cng.cs:120

• IsCngSupported is used as a [ConditionalClass] / [ConditionalFact] gate. If NCryptOpenStorageProvider returns a failure code for environmental reasons (e.g., restricted environment), the current code throws and turns a skip condition into a hard failure (and the Lazy<bool> will cache the exception for all subsequent checks). Consider treating an inability to open the provider as "CNG not supported" for the purposes of gating these tests.

                if (error != ErrorCode.ERROR_SUCCESS)
                {
                    throw error.ToCryptographicException();
                }

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaTestHelpers.Cng.cs:113

• CheckCngSupport probes NCrypt support by introducing/using a new Interop.NCrypt.NCryptIsAlgSupported P/Invoke in product code. Since this is only used to gate tests, consider switching the probe to a pure managed check (e.g., try CngKey.Create(CngAlgorithm.CompositeMLDsa, ...) with ephemeral parameters and return false on NTE_NOT_SUPPORTED) so you can avoid carrying a new NCrypt interop entry in src/libraries/Common/src solely for tests.

            ErrorCode error = Interop.NCrypt.NCryptOpenStorageProvider(
                out SafeNCryptProviderHandle provider,
                CngProvider.MicrosoftSoftwareKeyStorageProvider.Provider,
                0);

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[PranavSenthilnathan]

/ba-g #132831

[PranavSenthilnathan]

/backport to release/11.0

[github-actions]

Started backporting to release/11.0 (link to workflow run)

[PranavSenthilnathan]

/backport to release/10.0

[github-actions]

Started backporting to release/10.0 (link to workflow run)

[github-actions]

@PranavSenthilnathan backporting to release/10.0 failed, the patch most likely resulted in conflicts. Please backport manually!

git am output

$ git cherry-pick caa4d61ee02e991b0592ffd9861cf052233cab4b

CONFLICT (modify/delete): src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaCngTests.Windows.cs deleted in HEAD and modified in caa4d61ee02 (Gate Composite ML-DSA CNG tests on NCrypt support (#132854)).  Version caa4d61ee02 (Gate Composite ML-DSA CNG tests on NCrypt support (#132854)) of src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaCngTests.Windows.cs left in tree.
Auto-merging src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaFactoryTests.cs
CONFLICT (content): Merge conflict in src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaFactoryTests.cs
CONFLICT (modify/delete): src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaTestHelpers.Cng.cs deleted in HEAD and modified in caa4d61ee02 (Gate Composite ML-DSA CNG tests on NCrypt support (#132854)).  Version caa4d61ee02 (Gate Composite ML-DSA CNG tests on NCrypt support (#132854)) of src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaTestHelpers.Cng.cs left in tree.
Auto-merging src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaTestHelpers.cs
error: could not apply caa4d61ee02... Gate Composite ML-DSA CNG tests on NCrypt support (#132854)
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"


$ git am --3way --empty=keep --ignore-whitespace --keep-non-patch changes.patch

Applying: Gate Composite ML-DSA CNG tests
Using index info to reconstruct a base tree...
M	src/libraries/Common/src/Interop/Windows/NCrypt/Interop.NCryptOpenStorageProvider.cs
A	src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaCngTests.Windows.cs
M	src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaFactoryTests.cs
A	src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaTestHelpers.Cng.cs
M	src/libraries/Common/tests/TestUtilities/System/PlatformDetection.Windows.cs
Falling back to patching base and 3-way merge...
Auto-merging src/libraries/Common/src/Interop/Windows/NCrypt/Interop.NCryptOpenStorageProvider.cs
CONFLICT (modify/delete): src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaCngTests.Windows.cs deleted in HEAD and modified in Gate Composite ML-DSA CNG tests.  Version Gate Composite ML-DSA CNG tests of src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaCngTests.Windows.cs left in tree.
Auto-merging src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaFactoryTests.cs
CONFLICT (content): Merge conflict in src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaFactoryTests.cs
CONFLICT (modify/delete): src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaTestHelpers.Cng.cs deleted in HEAD and modified in Gate Composite ML-DSA CNG tests.  Version Gate Composite ML-DSA CNG tests of src/libraries/Common/tests/System/Security/Cryptography/AlgorithmImplementations/CompositeMLDsa/CompositeMLDsaTestHelpers.Cng.cs left in tree.
Auto-merging src/libraries/Common/tests/TestUtilities/System/PlatformDetection.Windows.cs
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 Gate Composite ML-DSA CNG tests
Error: The process '/usr/bin/git' failed with exit code 128

Link to workflow output

[PranavSenthilnathan]

net10.0 implements Composite ML-DSA in the managed layer, so we don't need to backport this unless we backport the native implementation as well.