dotnet/wpf · error · InvalidOperationException

SR.CannotChangeCryptoProvider

Error message

SR.CannotChangeCryptoProvider

What it means

The CryptoProvider property setter throws InvalidOperationException with SR.CannotChangeCryptoProvider when _fixedSettings is true. Once the transform's settings are fixed, the crypto provider can no longer be swapped. The provider must be assigned before initialization completes.

Solutions

1. Assign CryptoProvider before initializing/flushing the transform
2. Create a fresh RightsManagementEncryptionTransform for the new provider
3. Track transform state and skip provider assignment once fixed
4. Fix application ordering so provider acquisition (SecureEnvironment.Create...CryptoProvider) precedes transform initialization

Example fix

// before
transform.InitializeRMForCreate(...); // fixes settings
transform.CryptoProvider = provider;   // throws
// after
transform.CryptoProvider = provider;
transform.InitializeRMForCreate(...);

if (!transform.CanSetCryptoProvider /* or track fixed state yourself */) throw new InvalidOperationException("Assign CryptoProvider before initialization fixes settings");

try { transform.CryptoProvider = provider; } catch (InvalidOperationException) { transform = new RightsManagementEncryptionTransform(); transform.CryptoProvider = provider; }

When it happens

Trigger: Setting transform.CryptoProvider after the transform has been initialized and its settings fixed; reconfiguring a transform that already participated in encryption/decryption.

Common situations: Late-binding the crypto provider after package flush; reusing a transform across documents and trying to install a different provider; dependency-injection containers replacing the provider post-initialization.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

• SR.CannotChangePublishLicense
• SR.CryptoProviderIsNotReady
• Animation_Invalid_DefaultValue
• ArgumentOutOfRangeException(authentication)
• ArgumentOutOfRangeException(authenticationType)

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/8908dcea878b677f. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/CompoundFile/RightsManagementEncryptionTransform.cs:491

        #endregion IDataTransform Properties
        
        #region RightsManagementEncryptionTransform Properties 

        /// <value>
        /// This property represents the CryptoProvider object that will be used to determine
        /// what operations the current user is allowed to perform on the encrypted content.
        /// </value>
        internal CryptoProvider CryptoProvider
        {
            get
            {
                return _cryptoProvider;
            }
            set
            {
                if (_fixedSettings)
                {
                    throw new InvalidOperationException(SR.CannotChangeCryptoProvider);
                }

                ArgumentNullException.ThrowIfNull(value);

                if (!value.CanEncrypt && !value.CanDecrypt)
                {
                    throw new ArgumentException(SR.CryptoProviderIsNotReady, nameof(value));
                }

                _cryptoProvider = value;
            }
        }

        /// <value>
        /// Expose the transform identifier for the use of the DataSpaceManager.
        /// </value>
        internal static string ClassTransformIdentifier
        {

View on GitHub (pinned to 81131a70a4)