System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms. (4243817)

System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.

The .NET Transaction agent on a Windows 2012 server fails with the following error:

WARN    [40] com.quest.pas.agent.instrumentation.Instrumentor - An exception was caught wile loading a function, the function will be ignored; module id: 0x000007ff0972a4e0, function id: 0x000007ff09913670, function name: NextResult
System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.InvalidOperationException: This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.
   at System.Security.Cryptography.MD5CryptoServiceProvider..ctor()
   --- End of inner exception stack trace ---

The DotNet agent does not use non-FIPS compliant algorithms for any cryptographic communication, nor does it alter the way the monitored application uses cryptographic algorithms, nor does it alter the actual FIPS compliance of the application.

The agent uses MD5 signatures of system classes to verify compatibility. This does trigger the FIPS exception, and we have filed an enhancement request (DN-1482) to use a non-flagged algorithm for this check in a future release.

1. Stop the .NET Transaction Agent Service
2. Open Local Security Policy
3. Expand Local Policies,
4. Click Security Options
5. Find the following Group Policy Object in the right pane and disable it:
   System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing
6. Start the .NET Transaction Agent Service

If you still get the same error, you may have to change a registry key:

Windows Registry Disclaimer:
Quest does not provide support for problems that arise from improper modification of the registry. The Windows registry contains information critical to your computer and applications. Make sure you back up the registry before modifying it. For more information on the Windows Registry Editor and how to back up and restore it, refer to Microsoft Article ID 256986 “Description of the Microsoft Windows registry” at Microsoft Support.

 

1. Open Windows registry editor (Regedit)
2. Navigate to [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
3. If the value for "fipsalgorithmpolicy" is set to dword:00000001, change it to 00000000.
4. Restart the .NET Transaction Agent Service

 

STATUS:

Issue fixed in version 5.9.11.  The latest version of Foglight for Microsoft .NET cartridge can be downloaded here.

 

DN-1482, FAPM-1456