Thanks to visit codestin.com
Credit goes to github.com

Skip to content

SmtpClient docs recommend a third-party library that is not FIPS-compliant #114712

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
2 of 3 tasks
AnthonyMastrean opened this issue Oct 28, 2021 · 6 comments
Open
2 of 3 tasks

SmtpClient docs recommend a third-party library that is not FIPS-compliant #114712

AnthonyMastrean opened this issue Oct 28, 2021 · 6 comments
Assignees
@rokonec
Labels
area-System.Net untriaged New issue has not been triaged by the area owner

Comments

@AnthonyMastrean
Copy link

Issue description

.NET manages FIPS compliance by passing "cryptographic primitives calls through to the standard modules the underlying operating system provides". This is the case for the entire standard library on Linux and Windows.

https://docs.microsoft.com/en-us/dotnet/standard/security/fips-compliance

However, on the SmtpClient docs, you recommend MailKit (and other libraries) that do not make the same choices or guarantees.

https://docs.microsoft.com/en-us/dotnet/api/system.net.mail.smtpclient?view=net-5.0#remarks

MailKit depends on MimeKit which depends on Bouncy Castle, which reimplements cryptographic primitives instead of targeting the "standard modules the underlying operating system provides". Bouncy Castle is FIPS-validated on a 5-year-old version of their library targeting .NET 4.5.2.

https://www.bouncycastle.org/fips-csharp

Target framework

  • .NET Core
  • .NET Framework
  • .NET Standard
dotnet --info output or About VS info 
<replace>
@adegeo adegeo transferred this issue from dotnet/docs Nov 2, 2021
@dotnet-issue-labeler dotnet-issue-labeler bot added the untriaged New issue has not been triaged by the area owner label Nov 2, 2021
@adegeo
Copy link

adegeo commented Nov 2, 2021

This user has feedback related to the system.net.mail.smtpclient API.

@adegeo
Copy link

adegeo commented Nov 2, 2021

@AnthonyMastrean I transferred your issue to the SDK repo as they would be better suited to help you. From the docs perspective there isn't much we can do. If the SMTPClient API hasn't been keepig up with modern protocols, there are two alternatives:

  1. Request the SDK team to reimplement this API in a new way to support modern protocols.
  2. Find a different alternative to MailKit.

Hopefully they can help with either of those two solutions.

@AnthonyMastrean
Copy link
Author

AnthonyMastrean commented Nov 2, 2021 •
edited
Loading

Thank you. It doesn't seem like no. 1 would be a priority, but the SDK team would know best and we're definitely approaching no. 2 on our end. I filed the issue in the docs repository because it seemed like the recommendation/endorsement worked against the linked FIPS documentation and the approach of the .NET framework in general.

@marcpopMSFT marcpopMSFT transferred this issue from dotnet/sdk Apr 15, 2025
@dotnet-issue-labeler dotnet-issue-labeler bot added the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Apr 15, 2025
@marcpopMSFT
Copy link
Member

Old issue triage: Probably libraries should weigh in here on the recommended way to do this and how to update our docs. There may also be a better solution since this was originally filed.

@dotnet-policy-service Dotnet Policy Service
Copy link
Contributor

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

@teo-tsirpanis teo-tsirpanis removed the needs-area-label An area label is needed to ensure this gets routed to the appropriate area owners label Apr 18, 2025
@teo-tsirpanis
Copy link
Contributor

I don't think there is anything to do on the .NET side. The 3rd-party libraries .NET recommends don't have to provide the same feature set that .NET provides.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@rokonec rokonec

Labels
area-System.Net untriaged New issue has not been triaged by the area owner
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@dsplaisted @AnthonyMastrean @jeffschwMSFT @teo-tsirpanis @marcpopMSFT @rokonec @adegeo