VS2017 15.5.1 SSDT Security Change from TripleDES to AES256-CBC? - algorithm

Question

I am working to establish a CI pipeline for SSIS, with the first step automating the creation of ISPAC deployment packages. I am using the code from: https://github.com/rtumaykin/ssis-build which creates ssisbuild.exe. The executable reads the XML from dtproj, unencrypting secured information using CrptoAPIs for TripleDES as documented here
These two lines of code
var passwordDeriveBytes = new PasswordDeriveBytes(password, rgbSalt);
cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("TripleDES", "SHA1", 192, cryptoServiceProvider.IV);
Supply the password and salt from the dtproj file (converted to byte array with Convert.FromBase64String(saltXMLAttributeNode.Value)
The TripleDES conversion generates the exceptions:
"Specified initialization {IV} does not match the block size for this algorithm."
Looking into the VS2017 15.5 dtproj XML I find this section:
SSIS:Algorithm="http://www.w3.org/2001/04/xmlenc#aes256-cbc">
Indicating the DTPROJ Encryption Algorithm is now aes256-cbc.
And in fact, changing the code to use:
cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("AES", "SHA1", 256, cryptoServiceProvider.IV);
Removes the error.
But the next lines:
var passwordDeriveBytes = new PasswordDeriveBytes(password, rgbSalt);
cryptoServiceProvider.Key = passwordDeriveBytes.CryptDeriveKey("AES", "SHA1", 256, cryptoServiceProvider.IV)
Generates the new non-descript error:
"Object identifier (OID) is unknown"
Rewriting the decryption process using the examples in the AESCrptoServiceProvder Class from System.Security.Cryptography.Aes
using:
static string DecryptStringFromBytesAes(byte[] ciphertext, byte[] key, byte[] aesiv)
{
if (ciphertext == null || ciphertext.Length <= 0)
throw new ArgumentNullException("cypherText");
if (key == null || key.Length <=0)
throw new ArgumentNullException("Key");
if (aesiv == null || aesiv.Length <=0)
throw new ArgumentNullException("AESIV");
string plaintext = null;
using (AesCryptoServiceProvider aesAlg = new AesCryptoServiceProvider())
{
aesAlg.Key = key;
aesAlg.IV = aesiv;
ICryptoTransform decryptor = aesAlg.CreateDecryptor(aesAlg.Key, aesAlg.IV);
using (MemoryStream msDecrypt = new MemoryStream(ciphertext))
{
using (CryptoStream csDecrypt = new CryptoStream(msDecrypt, decryptor, CryptoStreamMode.Read))
{
using (StreamReader srDecrtypt = new StreamReader(csDecrypt))
{
plaintext = srDecrtypt.ReadToEnd();
}
}
}
}
return plaintext;
}
where Key = the Salt value from dtproj generates an error
"The specified key is not a valid size for this algorithm."
when loading the key at line:
using (AesCryptoServiceProvider aesAlg = new AesCryptoServiceProvider())
{
aesAlg.Key = key;
I am either supplying the incorrect value for the key or using the incorrect CryptoServiceProvider.
Does anyone know how encryption has been changed in VS2017 SSDT 15.5.1?