Tagging subscribers to this area: @dotnet/ncl, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.

/azp run runtime libraries-coreclr-outerloop

/azp list

/azp run runtime-libraries-coreclr outerloop

CI failures are unrelated, we are good to merge. I will give @wfurt a chance to have a look at this before merging. Thanks, Filip!

Thanks for review and running the tests!

should we try to take it to 8.0 @filipnavara? The fact that it impacts Powershell is concerning IMHO @karelz

should we try to take it to 8.0 @filipnavara? The fact that it impacts Powershell is concerning IMHO @karelz

Almost certainly yes.

@filipnavara is there a summary explanation, why we the bug is now exposed more in 8.0? (that will help to decide if we should take it for 8.0)

Sure. Here's the simple explanation, I can stretch it out if necessary... ;-)

In .NET 7 the NegotiateStream implementation used internal NegotiateStreamPal.Encrypt method to encrypt messages on Windows. PR #86948 switched the encryption to use the NegotiateAuthentication.Wrap public method instead. The only difference between these two methods should have been that Encrypt produces extra 4-byte length prefix. Unfortunately, the implementation of Wrap turned out to have more unintended differences which got exposed by this switch.

Wrap as implemented in .NET 7 and .NET 8 before this fix worked for NTLM because the size of signature/encryption prefix is fixed and there's no encryption padding. In Kerberos the prefix length can be different, and some encryption schemes need additional padding. This PR matches what Encrypt method did in .NET 7 in terms of the buffer management.

/backport to release/8.0

Started backporting to release/8.0: https://github.com/dotnet/runtime/actions/runs/6021734007