NancyFx/Nancy — pull request #576 by dlineberger (2012-03-24 22:59:13+00:00)
Title: Allow Nancy to run on machines with FIPS Compliance enabled

When attempting to run Nancy on Windows Server 2008 R2 with FIPS compliance turned on, the following exception occurs:

[InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.]
System.Security.Cryptography.SHA256Managed..ctor() +2464045
System.Security.Cryptography.HMACSHA256..ctor(Byte[] key) +51
System.Security.Cryptography.HMACSHA256..ctor() +24
Nancy.Cryptography.DefaultHmacProvider..ctor(IKeyGenerator keyGenerator) +46
Nancy.Cryptography.CryptographyConfiguration..cctor() +111

FIPS Compliance is required for running on many US government machines. It can be enabled in Local Security Policy -> Local Policiies -> Security Options -> System Cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing.

I attempted to circumvent this error by creating my own CryptographyConfiguration using FIPS-compliant algorithms (e.g. HMACSHA1 and DES Encryption), but still got the exception.

The error occurs because the static CryptographyConfiguration.Default instance uses non-FIPS compliant algorithms, and this instance gets created even if you provide your own configuration.

I have modifed CryptographyConfiguration to lazy-load the Default and NoEncryption instances, and allowed the user to inject a CryptographyConfiguration to the DiagnosticsConfiguration. This allows the user to bypass initializing the Default configuration if needed.