dotnet/wpf · error · ArgumentException

SR.CryptoProviderIsNotReady

Error message

SR.CryptoProviderIsNotReady

What it means

The CryptoProvider property setter validates that the provided provider can actually do work: it must support encryption, decryption, or both. A provider with CanEncrypt == false && CanDecrypt == false is rejected with ArgumentException naming 'value' (SR.CryptoProviderIsNotReady).

Solutions

  1. Verify the user has encryption or decryption grants before obtaining the CryptoProvider
  2. Check provider.CanEncrypt / provider.CanDecrypt before assigning it to the transform
  3. Obtain the provider from a SecureEnvironment where the user was granted appropriate rights
  4. Use a different user account or publish license that includes the needed rights

Example fix

// before
transform.CryptoProvider = env.CryptoProvider; // may be unusable
// after
var provider = env.CryptoProvider;
if (!provider.CanEncrypt && !provider.CanDecrypt)
    throw new InvalidOperationException("User has no encrypt/decrypt rights");
transform.CryptoProvider = provider;
Defensive patterns

Strategy: validation

Validate before calling

if (provider == null || (!provider.CanEncrypt && !provider.CanDecrypt)) throw new ArgumentException("CryptoProvider cannot encrypt or decrypt", nameof(provider));

Try / catch

try { transform.CryptoProvider = provider; } catch (ArgumentException ex) when (ex.ParamName == "value") { /* request rights or re-acquire provider */ }

Prevention

When it happens

Trigger: Assigning transform.CryptoProvider a CryptoProvider instance returned by an RM environment that granted no use rights (cannot encrypt or decrypt), e.g. the user lacks rights to the protected content.

Common situations: User opened a document without sufficient rights grants; RM server returned a limited grant set; testing with a stub/empty CryptoProvider that reports no capabilities.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

AI-assisted analysis of dotnet/wpf@81131a70a4 (2026-09-14). Data as JSON: /api/errors/85f2e43b3d128571. Report an issue: GitHub.

Appendix: source

Thrown at src/Microsoft.DotNet.Wpf/src/WindowsBase/MS/Internal/IO/Packaging/CompoundFile/RightsManagementEncryptionTransform.cs:498

        /// </value>
        internal CryptoProvider CryptoProvider
        {
            get
            {
                return _cryptoProvider;
            }
            set
            {
                if (_fixedSettings)
                {
                    throw new InvalidOperationException(SR.CannotChangeCryptoProvider);
                }

                ArgumentNullException.ThrowIfNull(value);

                if (!value.CanEncrypt && !value.CanDecrypt)
                {
                    throw new ArgumentException(SR.CryptoProviderIsNotReady, nameof(value));
                }

                _cryptoProvider = value;
            }
        }

        /// <value>
        /// Expose the transform identifier for the use of the DataSpaceManager.
        /// </value>
        internal static string ClassTransformIdentifier
        {
            get
            {
                return "{C73DFACD-061F-43B0-8B64-0C620D2A8B50}";
            }
        }

        #endregion RightsManagementEncryptionTransform Properties

View on GitHub (pinned to 81131a70a4)