Cose.Tests.TestKeyRing.CreateECDsa fails with "OSStatus error -50" #121902

Activity

1. jkotas

   added

   blocking-clean-ciBlocking PR or rolling runs of 'runtime' or 'runtime-extra-platforms'Blocking PR or rolling runs of 'runtime' or 'runtime-extra-platforms'

   Known Build ErrorUse this to report build issues in the .NET Helix tabUse this to report build issues in the .NET Helix tab

   area-System.Security

   on Nov 23, 2025
2. dotnet-policy-service

   added

   untriagedNew issue has not been triaged by the area ownerNew issue has not been triaged by the area owner

   on Nov 23, 2025
3. jkotas commented on Nov 23, 2025

   

   jkotas

   on Nov 23, 2025

   MemberAuthor

   More actions

   Failure log:

       System.Security.Cryptography.Cose.Tests.CoseMultiSignMessageTests_SignStream_Async.SignWithNullHeaderMaps [FAIL]
         Interop+AppleCrypto+AppleCFErrorCryptographicException : The operation couldn’t be completed. (OSStatus error -50 - Unsupported key type: 73 (converted value: 73)
         Stack Trace:
           /_/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecKeyRef.cs(117,0): at Interop.AppleCrypto.CreateDataKey(ReadOnlySpan`1 keyData, PAL_KeyAlgorithm keyAlgorithm, Boolean isPublic)
           /_/src/libraries/Common/src/System/Security/Cryptography/EccAppleCrypto.cs(261,0): at System.Security.Cryptography.EccAppleCrypto.ImportKey(ECParameters parameters)
           /_/src/libraries/Common/src/System/Security/Cryptography/EccAppleCrypto.cs(219,0): at System.Security.Cryptography.EccAppleCrypto.ImportParameters(ECParameters parameters)
           /_/src/libraries/Common/src/System/Security/Cryptography/ECDsaAppleCrypto.cs(166,0): at System.Security.Cryptography.ECDsaImplementation.ECDsaAppleCrypto.ImportParameters(ECParameters parameters)
           /_/src/libraries/System.Security.Cryptography/src/System/Security/Cryptography/ECDsa.Create.AppleCrypto.cs(49,0): at System.Security.Cryptography.ECDsa.Create(ECParameters parameters)
           /_/src/libraries/System.Security.Cryptography.Cose/tests/TestKeyRing.cs(63,0): at System.Security.Cryptography.Cose.Tests.TestKeyRing.CreateECDsa(ECParameters parameters, Boolean includePrivateKey)
           /_/src/libraries/System.Security.Cryptography.Cose/tests/TestKeyRing.cs(23,0): at System.Security.Cryptography.Cose.Tests.TestKeyRing.get_ES256()
           /_/src/libraries/System.Security.Cryptography.Cose/tests/CoseTestHelpers.cs(470,0): at System.Security.Cryptography.Cose.Tests.CoseTestHelpers.get_ES256()
           /_/src/libraries/System.Security.Cryptography.Cose/tests/CoseTestHelpers.cs(514,0): at System.Security.Cryptography.Cose.Tests.CoseTestHelpers.GetKeyHashPaddingTriplet[T](CoseAlgorithm algorithm, Boolean useNonPrivateKey)
           /_/src/libraries/System.Security.Cryptography.Cose/tests/CoseMessageTests.Sign.cs(18,0): at System.Security.Cryptography.Cose.Tests.CoseMessageTests_Sign`1.get_DefaultKey()
           /_/src/libraries/System.Security.Cryptography.Cose/tests/CoseMessageTests.Sign.CustomHeaderMaps.cs(152,0): at System.Security.Cryptography.Cose.Tests.CoseMessageTests_Sign_CustomHeaderMaps.SignWithNullHeaderMaps()
              at System.RuntimeMethodHandle.InvokeMethod(ObjectHandleOnStack target, Void** arguments, ObjectHandleOnStack sig, BOOL isConstructor, ObjectHandleOnStack result)
              at System.RuntimeMethodHandle.InvokeMethod(ObjectHandleOnStack target, Void** arguments, ObjectHandleOnStack sig, BOOL isConstructor, ObjectHandleOnStack result)
           /_/src/coreclr/System.Private.CoreLib/src/System/RuntimeHandles.cs(1165,0): at System.RuntimeMethodHandle.InvokeMethod(Object target, Void** arguments, Signature sig, Boolean isConstructor)
           /_/src/coreclr/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.CoreCLR.cs(36,0): at System.Reflection.MethodBaseInvoker.InterpretedInvoke_Method(Object obj, IntPtr* args)
           /_/src/libraries/System.Private.CoreLib/src/System/Reflection/MethodBaseInvoker.cs(57,0): at System.Reflection.MethodBaseInvoker.InvokeWithNoArgs(Object obj, BindingFlags invokeAttr)
   
4. dotnet-policy-service commented on Nov 23, 2025

   

   dotnet-policy-serviceBot

   on Nov 23, 2025 – with Dotnet Policy Service

   Contributor

   More actions

   Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
   See info in area-owners.md if you want to be subscribed.
5. vcsjones commented on Nov 27, 2025

   

   vcsjones

   on Nov 27, 2025

   Member

   More actions

   Unless someone beats me to it I will look at this December 4th when I am back from time off.
6. vcsjones commented on Dec 2, 2025

   

   vcsjones

   on Dec 2, 2025

   Member

   More actions

   OSStatus error -50 - Unsupported key type: 73

   That is really strange because 73 is ECDSA. https://github.com/apple-oss-distributions/Security/blob/db15acbe6a7f257a859ad9a3bb86097bfe0679d9/OSX/sec/Security/SecItemConstants.c#L244-L246
7. danmoseley commented on Mar 22, 2026

   

   danmoseley

   on Mar 22, 2026

   Contributor

   More actions

   Note

   This analysis was generated by GitHub Copilot.

   Analysis

   All failing tests share a common root cause: TestKeyRing.get_ES256 calls ECDsa.Create(ECParameters), which goes through the Apple crypto interop path (Interop.AppleCrypto.CreateDataKey -> SecKeyCreateWithData) and intermittently fails with OSStatus -50.

   As @vcsjones noted, key type 73 is the correct constant for ECDSA in Apple's Security framework (source), so the parameters being passed are valid. This points to a transient failure in the macOS Security framework itself rather than a bug in the .NET code.

   Frequency

   21 hits in the past month, 6 in the past 7 days. The failures hit many different COSE test methods (Sign, Verify, SignStream, TrySign, etc.) because they all flow through the same TestKeyRing.ES256 property.

   Possible mitigations

   1. Cache the ECDsa key instance — TestKeyRing.ES256 is a property that creates a new key on each access. Caching the instance (e.g., via Lazy<ECDsa>) would reduce the number of calls to the flaky Apple API and likely eliminate most occurrences.
   2. Add retry logic in TestKeyRing.CreateECDsa — wrap the ECDsa.Create() call with a short retry (1-2 attempts with a small delay) to handle the transient failure gracefully.
   3. Combine both — cache with a retry-on-creation safety net would be the most robust approach.
8. danmoseley

   assigned

   Copilot

   and

   danmoseley

   on Mar 22, 2026
9. bartonjs

   closed this as completedin #125909on Mar 23, 2026
10. dotnet-policy-service

    removed

    untriagedNew issue has not been triaged by the area ownerNew issue has not been triaged by the area owner

    on Mar 23, 2026
11. github-actions

    locked and limited conversation to collaborators on Apr 23, 2026