Skip to content

Document DSA removal from macOS in .NET 11#50971

Merged
gewarren merged 8 commits intomainfrom
copilot/remove-dsa-support-macos
Jan 12, 2026
Merged

Document DSA removal from macOS in .NET 11#50971
gewarren merged 8 commits intomainfrom
copilot/remove-dsa-support-macos

Conversation

Copy link
Contributor

Copilot AI commented Jan 7, 2026 •
edited by github-actions bot
Loading

DSA (Digital Signature Algorithm) support has been removed from macOS in .NET 11 Preview 1. Apple deprecated the SecurityTransforms library that provided the implementation, which only supported weak DSA-1024 with SHA-1 and never supported key generation.

Changes

  • New breaking change document: docs/core/compatibility/cryptography/11.0/dsa-removed-macos.md

    • Documents PlatformNotSupportedException thrown by DSA APIs on macOS
    • Finite field DSA only; EC-DSA unaffected
    • Migration path: DSA.Create() → ECDsa.Create()

  • Index updates: Added Cryptography section to docs/core/compatibility/11.md

  • TOC updates: Added navigation entry in docs/core/compatibility/toc.yml

Affected APIs

  • System.Security.Cryptography.DSA.Create (all overloads)
  • System.Security.Cryptography.DSACryptoServiceProvider (all constructors)
  • System.Security.Cryptography.X509Certificates.DSACertificateExtensions.* (GetDSAPrivateKey, GetDSAPublicKey, CopyWithPrivateKey)

iOS, tvOS, and MacCatalyst never supported DSA and remain unaffected.

Original prompt

This section details on the original issue you should resolve

<issue_title>[Breaking change]: DSA has been removed from macOS</issue_title>
<issue_description>### Description

The Digital Signature Algorithm (DSA) has been removed from macOS. This only impacts "finite field" DSA. Elliptic Curve DSA (EC-DSA) is not affected.

Version

.NET 11 Preview 1

Previous behavior

The DSA algorithm and its supporting types, DSA, DSACryptoServiceProvider and X.509 certificates with DSA keys would function on macOS.

New behavior

DSA is no longer functional on macOS. Attempts to use DSA. DSACryptoServiceProvider, or other APIs that interact with DSA will throw PlatformNotSupportedException.

Type of breaking change

  • Binary incompatible: Existing binaries might encounter a breaking change in behavior, such as failure to load or execute, and if so, require recompilation.
  • Source incompatible: When recompiled using the new SDK or component or to target the new runtime, existing source code might require source changes to compile successfully.
  • Behavioral change: Existing binaries might behave differently at run time.

Reason for change

.NET on macOS relies on the operating system to provide an implementation of DSA. Apple did this through a now obsolete library called SecurityTransforms, with no replacement. The implementation that Apple did offer was also limited in functionality. It only supported DSA-1024 with SHA-1 which is considered weak. Further, it never supported generating DSA keys.

iOS, tvOS, and MacCatalyst never supported DSA.

Recommended action

Migrate away from the DSA algorithm and use a modern cryptographic digital signature algorithm such as EC-DSA.

Feature area

Cryptography

Affected APIs

  • M:System.Security.Cryptography.DSA.Create (all overloads)
  • M:System.Security.Cryptography.DSACryptoServiceProvider.#ctor (all overloads)
  • M:System.Security.Cryptography.X509Certificates.DSACertificateExtensions.GetDSAPrivateKey (all overloads)
  • M:System.Security.Cryptography.X509Certificates.DSACertificateExtensions.GetPublicKey (all overloads)
  • M:System.Security.Cryptography.X509Certificates.DSACertificateExtensions.GetDSAPrivateKey (all overloads)
  • M:System.Security.Cryptography.X509Certificates.DSACertificateExtensions.CopyWithPrivateKey (all overloads)

Additionally, any APIs that interact with DSA keys.

Associated WorkItem - 543460</issue_description>

Comments on the Issue (you are @copilot in this section)

@vcsjones /cc @bartonjs @bartonjs LGTM

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Internal previews

📄 File 🔗 Preview link
docs/core/compatibility/11.md Breaking changes in .NET 11
docs/core/compatibility/cryptography/11/dsa-removed-macos.md DSA removed from macOS
docs/core/compatibility/toc.yml docs/core/compatibility/toc
docs/core/compatibility/unsupported-apis.md APIs that always throw exceptions on .NET (Core)

Copilot AI changed the title [WIP] Remove DSA support for macOS due to deprecation Document DSA removal from macOS in .NET 11 Jan 7, 2026
Copilot AI requested a review from gewarren January 7, 2026 23:07
@gewarren
human edits
19d03cb
@gewarren
resolve merge conflicts
4fa00b5
@gewarren
Revise DSA migration guidance and affected APIs
54ca445 
Updated recommendations for migrating away from DSA algorithm and clarified affected APIs.
@gewarren gewarren marked this pull request as ready for review January 9, 2026 01:19
@gewarren gewarren requested a review from a team as a code owner January 9, 2026 01:19
Copilot AI review requested due to automatic review settings January 9, 2026 01:19
@gewarren gewarren enabled auto-merge (squash) January 9, 2026 01:19
Copilot AI reviewed Jan 9, 2026
View reviewed changes
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR documents the removal of DSA (Digital Signature Algorithm) support from macOS in .NET 11 Preview 1. Apple deprecated the SecurityTransforms library that provided the implementation, which only supported weak DSA-1024 with SHA-1 and never supported key generation.

Key Changes

  • Added comprehensive breaking change documentation for DSA removal from macOS
  • Updated the .NET 11 breaking changes index to include new Cryptography section
  • Added navigation entry in the table of contents
  • Updated unsupported APIs list with DSA-related APIs for macOS

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File Description
docs/core/compatibility/cryptography/11/dsa-removed-macos.md New breaking change document detailing DSA removal, affected APIs, and migration guidance to EC-DSA
docs/core/compatibility/11.md Added Cryptography section with reference to DSA removal document
docs/core/compatibility/toc.yml Added Cryptography navigation entry under .NET 11 breaking changes
docs/core/compatibility/unsupported-apis.md Added five DSA-related API entries for macOS platform with .NET 11+ footnote

@gewarren gewarren closed this Jan 9, 2026
auto-merge was automatically disabled January 9, 2026 01:31

Pull request was closed

@gewarren gewarren reopened this Jan 9, 2026
@gewarren gewarren requested a review from vcsjones January 9, 2026 01:40
BillWagner
BillWagner approved these changes Jan 9, 2026
View reviewed changes
Copy link
Member

@BillWagner BillWagner left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This LGTM.

Let's :shipit:

@gewarren gewarren merged commit 8279206 into main Jan 12, 2026
11 checks passed
@gewarren gewarren deleted the copilot/remove-dsa-support-macos branch January 12, 2026 19:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@vcsjones vcsjones vcsjones approved these changes

@BillWagner BillWagner BillWagner approved these changes

+1 more reviewer

@gewarren gewarren gewarren approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@gewarren gewarren

Copilot code review Copilot

Labels

dotnet-fundamentals/svc

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Breaking change]: DSA has been removed from macOS

5 participants

@vcsjones @BillWagner @gewarren