Annotate System.Security.Cryptography.Algorithms for nullable

src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipher.cs

@@ -6,6 +6,7 @@
 using System.Diagnostics;
 using System.Security.Cryptography;
 
+#nullable enable
 namespace Internal.Cryptography
 {
     //
@@ -22,7 +23,7 @@ namespace Internal.Cryptography
     //
     internal abstract class BasicSymmetricCipher : IDisposable
     {
-        protected BasicSymmetricCipher(byte[] iv, int blockSizeInBytes)
+        protected BasicSymmetricCipher(byte[]? iv, int blockSizeInBytes)
         {
             IV = iv;
             BlockSizeInBytes = blockSizeInBytes;
@@ -52,6 +53,6 @@ protected virtual void Dispose(bool disposing)
             }
         }
 
-        protected byte[] IV { get; private set; }
+        protected byte[]? IV { get; private set; }
     }
 }

src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipherBCrypt.cs

@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Security.Cryptography;
@@ -13,10 +14,10 @@ internal sealed class BasicSymmetricCipherBCrypt : BasicSymmetricCipher
     {
         private readonly bool _encrypting;
         private SafeKeyHandle _hKey;
-        private byte[] _currentIv;  // CNG mutates this with the updated IV for the next stage on each Encrypt/Decrypt call.
-                                    // The base IV holds a copy of the original IV for Reset(), until it is cleared by Dispose().
+        private byte[]? _currentIv;  // CNG mutates this with the updated IV for the next stage on each Encrypt/Decrypt call.
+                                     // The base IV holds a copy of the original IV for Reset(), until it is cleared by Dispose().
 
-        public BasicSymmetricCipherBCrypt(SafeAlgorithmHandle algorithm, CipherMode cipherMode, int blockSizeInBytes, byte[] key, bool ownsParentHandle, byte[] iv, bool encrypting)
+        public BasicSymmetricCipherBCrypt(SafeAlgorithmHandle algorithm, CipherMode cipherMode, int blockSizeInBytes, byte[] key, bool ownsParentHandle, byte[]? iv, bool encrypting)
             : base(cipherMode.GetCipherIv(iv), blockSizeInBytes)
         {
             Debug.Assert(algorithm != null);
@@ -43,13 +44,13 @@ protected override void Dispose(bool disposing)
             if (disposing)
             {
                 SafeKeyHandle hKey = _hKey;
-                _hKey = null;
+                _hKey = null!;
                 if (hKey != null)
                 {
                     hKey.Dispose();
                 }
 
-                byte[] currentIv = _currentIv;
+                byte[]? currentIv = _currentIv;
                 _currentIv = null;
                 if (currentIv != null)
                 {
@@ -115,7 +116,7 @@ private void Reset()
         {
             if (IV != null)
             {
-                Buffer.BlockCopy(IV, 0, _currentIv, 0, IV.Length);
+                Buffer.BlockCopy(IV, 0, _currentIv!, 0, IV.Length);
             }
         }
     }

src/libraries/Common/src/Internal/Cryptography/HashProviderCng.cs

@@ -9,6 +9,7 @@
 using BCryptOpenAlgorithmProviderFlags = Interop.BCrypt.BCryptOpenAlgorithmProviderFlags;
 using BCryptCreateHashFlags = Interop.BCrypt.BCryptCreateHashFlags;
 
+#nullable enable
 namespace Internal.Cryptography
 {
     //
@@ -21,7 +22,7 @@ internal sealed class HashProviderCng : HashProvider
         //
         //   - "key" activates MAC hashing if present. If null, this HashProvider performs a regular old hash.
         //
-        public HashProviderCng(string hashAlgId, byte[] key) : this(hashAlgId, key, isHmac: key != null)
+        public HashProviderCng(string hashAlgId, byte[]? key) : this(hashAlgId, key, isHmac: key != null)
         {
         }
 
@@ -39,7 +40,7 @@ internal HashProviderCng(string hashAlgId, ReadOnlySpan<byte> key, bool isHmac)
             // Win7 won't set hHash, Win8+ will; and both will set _hHash.
             // So keep hHash trapped in this scope to prevent (mis-)use of it.
             {
-                SafeBCryptHashHandle hHash = null;
+                SafeBCryptHashHandle? hHash = null;
                 NTSTATUS ntStatus = Interop.BCrypt.BCryptCreateHash(_hAlgorithm, out hHash, IntPtr.Zero, 0, key, key == null ? 0 : key.Length, BCryptCreateHashFlags.BCRYPT_HASH_REUSABLE_FLAG);
                 if (ntStatus == NTSTATUS.STATUS_INVALID_PARAMETER)
                 {
@@ -62,6 +63,7 @@ internal HashProviderCng(string hashAlgId, ReadOnlySpan<byte> key, bool isHmac)
             {
                 int cbSizeOfHashSize;
                 int hashSize;
+                Debug.Assert(_hHash != null);
                 NTSTATUS ntStatus = Interop.BCrypt.BCryptGetProperty(_hHash, Interop.BCrypt.BCryptPropertyStrings.BCRYPT_HASH_LENGTH, &hashSize, sizeof(int), out cbSizeOfHashSize, 0);
                 if (ntStatus != NTSTATUS.STATUS_SUCCESS)
                     throw Interop.BCrypt.CreateCryptographicException(ntStatus);
@@ -71,6 +73,7 @@ internal HashProviderCng(string hashAlgId, ReadOnlySpan<byte> key, bool isHmac)
 
         public sealed override unsafe void AppendHashData(ReadOnlySpan<byte> source)
         {
+            Debug.Assert(_hHash != null);
             NTSTATUS ntStatus = Interop.BCrypt.BCryptHashData(_hHash, source, source.Length, 0);
             if (ntStatus != NTSTATUS.STATUS_SUCCESS)
             {
@@ -95,6 +98,7 @@ public override bool TryFinalizeHashAndReset(Span<byte> destination, out int byt
                 return false;
             }
 
+            Debug.Assert(_hHash != null);
             NTSTATUS ntStatus = Interop.BCrypt.BCryptFinishHash(_hHash, destination, _hashSize, 0);
             if (ntStatus != NTSTATUS.STATUS_SUCCESS)
             {
@@ -138,7 +142,7 @@ private void ResetHashObject()
 
         private void DestroyHash()
         {
-            SafeBCryptHashHandle hHash = _hHash;
+            SafeBCryptHashHandle? hHash = _hHash;
             _hHash = null;
             if (hHash != null)
             {
@@ -149,8 +153,8 @@ private void DestroyHash()
         }
 
         private readonly SafeBCryptAlgorithmHandle _hAlgorithm;
-        private SafeBCryptHashHandle _hHash;
-        private byte[] _key;
+        private SafeBCryptHashHandle? _hHash;
+        private byte[]? _key;
         private readonly bool _reusable;
 
         private readonly int _hashSize;

src/libraries/Common/src/Internal/Cryptography/UniversalCryptoDecryptor.cs

@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Security.Cryptography;
@@ -77,7 +78,7 @@ protected sealed override byte[] UncheckedTransformFinalBlock(byte[] inputBuffer
             // Otherwise the decryption buffer is just the input data.
             //
 
-            byte[] ciphertext = null;
+            byte[]? ciphertext = null;
 
             if (_heldoverCipher == null)
             {
@@ -123,7 +124,7 @@ protected sealed override void Dispose(bool disposing)
         {
             if (disposing)
             {
-                byte[] heldoverCipher = _heldoverCipher;
+                byte[]? heldoverCipher = _heldoverCipher;
                 _heldoverCipher = null;
                 if (heldoverCipher != null)
                 {
@@ -248,6 +249,6 @@ private byte[] DepadBlock(byte[] block, int offset, int count)
         // whether this is the final block that needs depadding. This block is held (in encrypted form) in _heldoverCipher. The next call to TransformBlock
         // or TransformFinalBlock must include the decryption of _heldoverCipher in the results.
         //
-        private byte[] _heldoverCipher;
+        private byte[]? _heldoverCipher;
     }
 }

src/libraries/Common/src/Interop/OSX/Interop.CoreFoundation.CFError.cs

@@ -29,7 +29,7 @@ internal static int GetErrorCode(SafeCFErrorHandle cfError)
             }
         }
 
-        internal static string GetErrorDescription(SafeCFErrorHandle cfError)
+        internal static string? GetErrorDescription(SafeCFErrorHandle cfError)
         {
             Debug.Assert(cfError != null);
 

src/libraries/Common/src/Interop/OSX/Interop.CoreFoundation.CFString.cs

@@ -43,7 +43,7 @@ internal static string CFStringToString(SafeCFStringHandle cfString)
 
             if (interiorPointer != IntPtr.Zero)
             {
-                return Marshal.PtrToStringUTF8(interiorPointer);
+                return Marshal.PtrToStringUTF8(interiorPointer)!;
             }
 
             SafeCFDataHandle cfData = CFStringCreateExternalRepresentation(

src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.KeyAgree.cs

@@ -20,7 +20,7 @@ private static extern int AppleCryptoNative_EcdhKeyAgree(
             out SafeCFDataHandle cfDataOut,
             out SafeCFErrorHandle cfErrorOut);
 
-        internal static byte[] EcdhKeyAgree(
+        internal static byte[]? EcdhKeyAgree(
             SafeSecKeyRefHandle privateKey,
             SafeSecKeyRefHandle publicKey,
             Span<byte> opportunisticDestination,

src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Keychain.cs

@@ -371,7 +371,7 @@ internal static void TrackItem(SafeKeychainItemHandle keychainItem)
 
                 lock (s_lookup)
                 {
-                    SafeTemporaryKeychainHandle temporaryHandle;
+                    SafeTemporaryKeychainHandle? temporaryHandle;
 
                     if (s_lookup.TryGetValue(keychain.DangerousGetHandle(), out temporaryHandle))
                     {
@@ -393,7 +393,7 @@ internal static void UntrackItem(IntPtr keychainItem)
 
                 lock (s_lookup)
                 {
-                    SafeTemporaryKeychainHandle temporaryHandle;
+                    SafeTemporaryKeychainHandle? temporaryHandle;
 
                     if (s_lookup.TryGetValue(keychain.DangerousGetHandle(), out temporaryHandle))
                     {

src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErr.cs

@@ -10,7 +10,7 @@ internal static partial class AppleCrypto
     {
         internal static Exception CreateExceptionForOSStatus(int osStatus)
         {
-            string msg = GetSecErrorString(osStatus);
+            string? msg = GetSecErrorString(osStatus);
 
             if (msg == null)
             {

src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErrMessage.cs

@@ -12,7 +12,7 @@ internal static partial class AppleCrypto
         [DllImport(Libraries.AppleCryptoNative)]
         private static extern SafeCFStringHandle AppleCryptoNative_SecCopyErrorMessageString(int osStatus);
 
-        internal static string GetSecErrorString(int osStatus)
+        internal static string? GetSecErrorString(int osStatus)
         {
             using (SafeCFStringHandle cfString = AppleCryptoNative_SecCopyErrorMessageString(osStatus))
             {

src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecKeyRef.Export.cs

@@ -17,14 +17,14 @@ internal static partial class AppleCrypto
 
         [DllImport(Libraries.AppleCryptoNative)]
         private static extern int AppleCryptoNative_SecKeyExport(
-            SafeSecKeyRefHandle key,
+            SafeSecKeyRefHandle? key,
             int exportPrivate,
             SafeCreateHandle cfExportPassphrase,
             out SafeCFDataHandle cfDataOut,
             out int pOSStatus);
 
         internal static SafeCFDataHandle SecKeyExportData(
-            SafeSecKeyRefHandle key,
+            SafeSecKeyRefHandle? key,
             bool exportPrivate,
             ReadOnlySpan<char> password)
         {
@@ -70,7 +70,7 @@ internal static SafeCFDataHandle SecKeyExportData(
         }
 
         internal static byte[] SecKeyExport(
-            SafeSecKeyRefHandle key,
+            SafeSecKeyRefHandle? key,
             bool exportPrivate,
             string password)
         {

src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Bignum.cs

@@ -2,7 +2,9 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
+using System.Diagnostics.CodeAnalysis;
 using System.Runtime.InteropServices;
 using Microsoft.Win32.SafeHandles;
 
@@ -45,7 +47,7 @@ internal static SafeBignumHandle CreateBignum(byte[] bigEndianValue)
             return new SafeBignumHandle(handle, true);
         }
 
-        internal static byte[] ExtractBignum(IntPtr bignum, int targetSize)
+        internal static byte[]? ExtractBignum(IntPtr bignum, int targetSize)
         {
             // Given that the only reference held to bignum is an IntPtr, create an unowned SafeHandle
             // to ensure that we don't destroy the key after extraction.
@@ -55,7 +57,7 @@ internal static byte[] ExtractBignum(IntPtr bignum, int targetSize)
             }
         }
 
-        private static unsafe byte[] ExtractBignum(SafeBignumHandle bignum, int targetSize)
+        private static unsafe byte[]? ExtractBignum(SafeBignumHandle? bignum, int targetSize)
         {
             if (bignum == null || bignum.IsInvalid)
             {

src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Dsa.cs

@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Runtime.InteropServices;
@@ -125,10 +126,10 @@ internal static DSAParameters ExportDsaParameters(SafeDsaHandle key, bool includ
 
                 DSAParameters dsaParameters = new DSAParameters
                 {
-                    P = Crypto.ExtractBignum(p_bn, pgy_cb),
-                    Q = Crypto.ExtractBignum(q_bn, qx_cb),
-                    G = Crypto.ExtractBignum(g_bn, pgy_cb),
-                    Y = Crypto.ExtractBignum(y_bn, pgy_cb),
+                    P = Crypto.ExtractBignum(p_bn, pgy_cb)!,
+                    Q = Crypto.ExtractBignum(q_bn, qx_cb)!,
+                    G = Crypto.ExtractBignum(g_bn, pgy_cb)!,
+                    Y = Crypto.ExtractBignum(y_bn, pgy_cb)!,
                 };
 
                 if (includePrivateParameters)
@@ -167,7 +168,7 @@ internal static extern bool DsaKeyCreateByExplicitParameters(
             int gLength,
             byte[] y,
             int yLength,
-            byte[] x,
+            byte[]? x,
             int xLength);
     }
 }

src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.ERR.cs

@@ -2,12 +2,12 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Runtime.InteropServices;
 using System.Security.Cryptography;
 
-#nullable enable
 internal static partial class Interop
 {
     internal static partial class Crypto