System.ObjectDisposedException while calling the .RSACryptoServiceProvider.ImportParameters

Question

Hello,

We have a webservice we would like to sign an incoming request and send it further. We are using the static object of System.Security.Cryptography.RSACryptoServiceProvider and every instance is using the same static object to sign it. I read on microsoft that the static object is thread safe for this class. 

Problem is that on heavy load on webservice, the signing fails with below exception:

Exception Type: System.ObjectDisposedException
Message: Safe handle's handle field can only be set if the safe handle is not closed and has a ref count of 1.
ObjectName: 
Data: System.Collections.ListDictionaryInternal
TargetSite: Void _ImportKey(System.Security.Cryptography.SafeProvHandle, Int32, System.Security.Cryptography.CspProviderFlags, System.Object, System.Security.Cryptography.SafeKeyHandle ByRef)
HelpLink: NULL
Source: mscorlib

StackTrace Information
****************************
   at System.Security.Cryptography.Utils._ImportKey(SafeProvHandle hCSP, Int32 keyNumber, CspProviderFlags flags, Object cspObject, SafeKeyHandle& hKey)
   at System.Security.Cryptography.RSACryptoServiceProvider.ImportParameters(RSAParameters parameters)

Can someone help in troubleshooting the same. Let me know if more information is required.

Also, sometimes it is crashing the .net runtime and hence the w3wp process. Thanks!

Aman.

---

Amandeep Singh

Answer 1

Hi Aman,

Welcome to the MSDN Forum.

I am trying to involve some other one into this case.

Wait it patiently, please.

Additionally, would you like to post a detailed repro steps and your program language, VS edition, .net FM version and so on.

Thank you.

Best regards,

---

Mike Feng
MSDN Community Support | Feedback to us
Develop and promote your apps in Windows Store
Please remember to mark the replies as answers if they help and unmark them if they provide no help.

Answer 2

Hi,

Thank you for the report.   We have researched any known bug reports and submissions without finding an existing report.

To file the report, you can do so at the following location for the Microsoft.NET product team for further review:

https://connect.microsoft.com/VisualStudio/feedback/CreateFeedbackForm.aspx?FeedbackFormConfigurationID=5303&FeedbackType=1

If you do require further support engagement, we can offer that through the professional support offering which will route to the Developer Support team for the RSACryptoServiceProvider class:

    https://gettechsupport.microsoft.com/Default.aspx?pesid=14694

Thanks,

Nathan

Answer 3

I think you've mistaken. MSDN claims that static methods of this class are thread-safe, not the static object. And if multiple threads use the same object instance, the internal object state might get corrupted.

You should create a new instance of CryptoServiceProvider for each request, or at least for each thread.

Answer 4

Ok, that means that if there is a static object of this class, thread safety is not guaranteed. Hence, if there are multiple threads  accessing the same static object, they might step over each other and corrupt the in memory object state.

Another test i did was creating a new instance on every call, which actually worked on heavy load.

Can you shed more light on which system resources this class utilizes and will creating multiple instance of this class actually throttle that system resource.

---

Amandeep Singh

Answer 5

It internally uses native CryptoServiceProvider and CryptoKey handles. If you don't initialise a private key, a shared instance of CSP is used.

Typically it shouldn't be a performance problem creating a new instance for each request. But if you believe instance caching will improve your performance a lot, use a static Dictionary<int, RSACryptoServiceProvider> and store an instance per Thread.ManagedThreadId.

Answer 6

Thanks a lot for your response, it makes sense. But the reason i asked about what systems resources it actually uses is to have a better idea of how many system resources(required by this class) we have with us. Is it per CPU basis or anything else.

---

Amandeep Singh