Azure-activedirectory-identitymodel-extensions-for-dotnet: Token decryption failed: UnwrapKey failed, exception from cryptographic operation: 'Interop+Crypto+OpenSslCryptographicException: error:04065072

[weijia-ai]

I'm trying to rotate token decryption cert, thus I'm changing TokenValidationParameters from TokenDecryptionKey to TokenDecryptionKeys.
However, using TokenDecryptionKeys will throw following exception:

Hit exception in AuthorizeAsync IDX10659: UnwrapKey failed, exception from cryptographic operation: 'Interop+Crypto+OpenSslCryptographicException: error:04065072:rsa routines:rsa_ossl_private_decrypt:padding check failed
at System.Security.Cryptography.RSAOpenSsl.TryDecrypt(SafeRsaHandle key, ReadOnlySpan1 data, Span1 destination, RsaPadding rsaPadding, RsaPaddingProcessor rsaPaddingProcessor, Int32& bytesWritten)
at System.Security.Cryptography.RSAOpenSsl.Decrypt(Byte[] data, RSAEncryptionPadding padding)
at Microsoft.IdentityModel.Tokens.AsymmetricAdapter.Decrypt(Byte[] data)
at Microsoft.IdentityModel.Tokens.RsaKeyWrapProvider.UnwrapKey(Byte[] keyBytes)',

I noticed there was a similar issue here: https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/1431 it's similar but I don't think it's the same, since I didn't see any "keyId" error message.
But I still upgrade the Microsoft.Identity.Client to 4.22.0. Unfortunately it doesn't resolve my problem.

I'm blocked right now because I need to accept multiple token decryption keys to complete the cert rotation. Is there any workaround I can use? Thanks.

[GeoK]

Hi @weijia-ai - Updating Microsoft.Identity.Client will not resolve this issue, as IDX10659 is thrown by Microsoft.IdentityModel.Tokens assembly.

1511 changed the logic for resolving decryption keys. Try updating IdentityModel.* assemblies to the latest version.

[weijia-ai]

Thank you @GeoK !
I updated the package and the issue seems went away.