Search code examples
c#.netmd5azure-eventhubfips

EventProcessorHost throwing FIPS cryptographic algorithm exception


Attempting to instantiate the Microsoft.Azure.EventHubs EventProcessorHost in a Windows Service is causing the following exception to occur:

Service cannot be started.
Microsoft.Azure.EventHubs.Processor.EventProcessorRuntimeException: 
Out of retries creating lease for partition --->
...
System.InvalidOperationException: 
This implementation is not part of the Windows Platform FIPS validated cryptographic algorithms.

The server that it is running on has the FipsAlgorithmPolicy key set to Enabled (1) which is enforced by Group Policy, thus cannot be set to disabled (0).


Solution

  • The EventProcessorHost creates an instance of the CloudStorageAccount class internally. The default value of the static property, "UseV1MD5" is true. Therefore, the default behavior of any CloudStorageAccount objects that get instantiated is to use the flawed MD5 hash algorithm which is not FIPS/FISMA compliant.

    The solution is to set the static property to false before instantiating the EventProcessorHost, to ensure that the underlying CloudStorageAccount uses the FIPS/FISMA compliant version of the MD5 hash algorithm.

    CloudStorageAccount.UseV1MD5 = false;
    _eventProcessorHost = new EventProcessorHost("<event-hub-path>", 
        "<consumer-group-name>", 
        "<event-hub-connection-string>", 
        "<storage-connection-string>", 
        "<lease-container-name>");
    

    As of the time of this writing I was unable to find this solution via Google, StackOverflow, etc., and came upon it by analyzing the internals of these classes and experimenting.

    HTH