System.ObjectDisposedException while calling the .RSACryptoServiceProvider.ImportParameters RRS feed

  • Question

  • Hello,

    We have a webservice we would like to sign an incoming request and send it further. We are using the static object of System.Security.Cryptography.RSACryptoServiceProvider and every instance is using the same static object to sign it. I read on microsoft that the static object is thread safe for this class. 

    Problem is that on heavy load on webservice, the signing fails with below exception:

    Exception Type: System.ObjectDisposedException
    Message: Safe handle's handle field can only be set if the safe handle is not closed and has a ref count of 1.
    Data: System.Collections.ListDictionaryInternal
    TargetSite: Void _ImportKey(System.Security.Cryptography.SafeProvHandle, Int32, System.Security.Cryptography.CspProviderFlags, System.Object, System.Security.Cryptography.SafeKeyHandle ByRef)
    HelpLink: NULL
    Source: mscorlib
    StackTrace Information
       at System.Security.Cryptography.Utils._ImportKey(SafeProvHandle hCSP, Int32 keyNumber, CspProviderFlags flags, Object cspObject, SafeKeyHandle& hKey)
       at System.Security.Cryptography.RSACryptoServiceProvider.ImportParameters(RSAParameters parameters)

    Can someone help in troubleshooting the same. Let me know if more information is required.

    Also, sometimes it is crashing the .net runtime and hence the w3wp process. Thanks!


    Amandeep Singh

    Monday, December 10, 2012 5:12 AM

All replies

  • Hi Aman,

    Welcome to the MSDN Forum.

    I am trying to involve some other one into this case.

    Wait it patiently, please.

    Additionally, would you like to post a detailed repro steps and your program language, VS edition, .net FM version and so on.

    Thank you.

    Best regards,

    Mike Feng
    MSDN Community Support | Feedback to us
    Develop and promote your apps in Windows Store
    Please remember to mark the replies as answers if they help and unmark them if they provide no help.

    Tuesday, December 11, 2012 3:08 PM
  • Hi,

    Thank you for the report.   We have researched any known bug reports and submissions without finding an existing report.

    To file the report, you can do so at the following location for the Microsoft.NET product team for further review:


    If you do require further support engagement, we can offer that through the professional support offering which will route to the Developer Support team for the RSACryptoServiceProvider class:




    Friday, December 14, 2012 10:44 PM
  • I think you've mistaken. MSDN claims that static methods of this class are thread-safe, not the static object. And if multiple threads use the same object instance, the internal object state might get corrupted.

    You should create a new instance of CryptoServiceProvider for each request, or at least for each thread.

    Wednesday, December 19, 2012 12:50 AM
  • Ok, that means that if there is a static object of this class, thread safety is not guaranteed. Hence, if there are multiple threads  accessing the same static object, they might step over each other and corrupt the in memory object state.

    Another test i did was creating a new instance on every call, which actually worked on heavy load.

    Can you shed more light on which system resources this class utilizes and will creating multiple instance of this class actually throttle that system resource.

    Amandeep Singh

    Wednesday, December 19, 2012 1:07 AM
  • It internally uses native CryptoServiceProvider and CryptoKey handles. If you don't initialise a private key, a shared instance of CSP is used.

    Typically it shouldn't be a performance problem creating a new instance for each request. But if you believe instance caching will improve your performance a lot, use a static Dictionary<int, RSACryptoServiceProvider> and store an instance per Thread.ManagedThreadId.

    Wednesday, December 19, 2012 1:35 AM
  • Thanks a lot for your response, it makes sense. But the reason i asked about what systems resources it actually uses is to have a better idea of how many system resources(required by this class) we have with us. Is it per CPU basis or anything else.

    Amandeep Singh

    Thursday, December 20, 2012 3:20 AM