{"record":{"id":"ff74bac7eca12fc8","repo":"dotnet/wpf","slug":"encryptionnotpermitted","errorCode":"EncryptionNotPermitted","errorMessage":"RightsManagementFailureCode.EncryptionNotPermitted","messagePattern":"RightsManagementFailureCode\\.EncryptionNotPermitted","errorType":"error_code","errorClass":"RightsManagementException","httpStatus":null,"severity":"error","filePath":"src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/CryptoProvider.cs","lineNumber":61,"sourceCode":"        /// BlockSize property. BlockSize property should be used to determine the amount of extra \n        /// padding to be added to the clear text. The length, in bytes, of the buffer holding content to \n        /// be encrypted should be a multiple of the block cipher block size. \n        /// RMS system currently uses AES block cipher. All blocks are encrypted independently, so that 2 blocks \n        /// of identical clear text will produce identical results after encryption.  An application \n        /// is encouraged to either compress data prior to encryption or create some other scheme to mitigate \n        /// threats potentially arising from independent block encryption.\n        /// </summary> \n        public byte[] Encrypt(byte[] clearText)\n        {\n            CheckDisposed();\n\n            ArgumentNullException.ThrowIfNull(clearText);\n\n            // validation of the proper size of the clearText is done by the unmanaged libraries \n\n            if (!CanEncrypt)\n            {\n                throw new RightsManagementException(RightsManagementFailureCode.EncryptionNotPermitted);\n            }\n            \n            // first get the size\n            uint outputBufferSize=0;\n            byte[] outputBuffer = null;\n            int hr;\n\n#if DEBUG\n            hr= SafeNativeMethods.DRMEncrypt(\n                            EncryptorHandle, \n                            0, \n                            (uint)clearText.Length, \n                            clearText,\n                            ref outputBufferSize,\n                            null);\n\n            Errors.ThrowOnErrorCode(hr);\n","sourceCodeStart":43,"sourceCodeEnd":79,"githubUrl":"https://github.com/dotnet/wpf/blob/81131a70a4c573cd62748a5c36908fc4d662daa9/src/Microsoft.DotNet.Wpf/src/WindowsBase/System/Security/RightsManagement/CryptoProvider.cs#L43-L79","documentation":"CryptoProvider.Encrypt throws RightsManagementException with failure code EncryptionNotPermitted when the CanEncrypt property is false. CanEncrypt reflects whether the rights-management license bound to this CryptoProvider grants the ENCRYPT grant; without it the underlying unmanaged DRM layer is not allowed to encrypt content.","triggerScenarios":"Calling Encrypt on a CryptoProvider created from a UseLicense/signed PublishLicense whose bound grants do not include the Encrypt right (e.g. a consumer license with view-only rights).","commonSituations":"End user received a read-only protected document license; server issued a UseLicense without ENCRYPT; application assumed an owner-level CryptoProvider but got a consumer one.","solutions":["Obtain a UseLicense/PublishLicense that grants the Encrypt right (e.g. via UnsignedPublishLicense with an OWNER or EDIT/ENCRYPT grant for the user)","Check provider.CanEncrypt before calling Encrypt and branch accordingly","Re-acquire the license from the rights server with the correct rights for this principal","If decrypt-then-re-encrypt is intended, decrypt with Decrypt and create a new CryptoProvider from a license granting Encrypt"],"exampleFix":"// before\nbyte[] cipher = provider.Encrypt(clearText);\n// after\nif (!provider.CanEncrypt)\n    throw new InvalidOperationException(\"License does not grant the Encrypt right.\");\nbyte[] cipher = provider.Encrypt(clearText);","handlingStrategy":"validation","validationCode":"if (!provider.CanEncrypt)\n    throw new InvalidOperationException(\"Current license does not grant the Encrypt right.\");","typeGuard":"bool CanEncryptSafely(CryptoProvider p) => p is { IsDisposed: false, CanEncrypt: true };","tryCatchPattern":"try { cipher = provider.Encrypt(clearText); }\ncatch (RightsManagementException rmEx) when (rmEx.FailureCode == RightsManagementFailureCode.EncryptionNotPermitted)\n{ /* request upgraded license from rights server */ }","preventionTips":["Check CanEncrypt before every Encrypt call","Request licenses that include the Encrypt grant for authors","Surface license rights to users before offering edit/encrypt features"],"tags":["drm","rights-management","encryption","license"],"backgroundTag":"permission-denied","analyzedSha":"81131a70a4c573cd62748a5c36908fc4d662daa9","analyzedAt":"2026-09-14T10:12:48.479Z","contentChangedAt":"2026-09-14T10:12:48.479Z","schemaVersion":2},"datasetVersion":"2026-09-21T21:30:21.729Z"}