http://bugs.winehq.org/show_bug.cgi?id=60214 Bug ID: 60214 Summary: bcrypt: BCryptExportKey/BCryptImportKeyPair do not support BCRYPT_OPAQUE_KEY_BLOB for asymmetric keys, breaking modern Steam login Product: Wine Version: 11.15 Hardware: x86-64 OS: MacOS Status: UNCONFIRMED Severity: normal Priority: P2 Component: bcrypt Assignee: wine-bugs@list.winehq.org Reporter: erik.hill0987@gmail.com Target Milestone: --- The modern Steam client's device-key login exports an asymmetric key with BCryptExportKey(key, NULL, BCRYPT_OPAQUE_KEY_BLOB, ...). Wine's export_asymmetric_key() in dlls/bcrypt/bcrypt_main.c has no branch for BCRYPT_OPAQUE_KEY_BLOB and returns STATUS_NOT_IMPLEMENTED: fixme:bcrypt:export_asymmetric_key unsupported blob type L"OpaqueKeyBlob" fixme:ncrypt:map_ntstatus unhandled status 0xc0000002 Because this fails locally, every Steam auth session dies before any network traffic (QR generation included). In the client's CEF log this surfaces as: Login: Failed to poll auth session. Result 2. Transport Error: 2 while the client's own CM WebSocket connects normally, which makes the failure look like a networking bug when it is not. REGRESSION BCRYPT_OPAQUE_KEY_BLOB was supported by the older gnutls-backed bcrypt (originally added for Titanfall 2, ~2018). The post-11.0 rewrite to the PE/SymCrypt bcrypt did not carry opaque asymmetric export/import forward. Still absent in master as of 2026-08. HOW REPRODUCIBLE: always (Steam login on Wine, macOS or Linux, wine > 11.0). EVIDENCE IT IS THE CAUSE (not merely correlated) Differential test across three stacks on macOS/M4, 2026-08-22: signal (cef/wine logs) | 11.15 fails | 11.6 works | CrossOver 26 (=wine 11.0) works export_asymmetric_key ... OpaqueKeyBlob fixme | present | absent | absent Failed to poll auth session | continuous | absent | absent reaches QR / logs on | no | yes | yes Transplanting the wine-11.0 bcrypt.dll/ncrypt.dll PE pair plus bcrypt.so into an 11.15 prefix removed the fixme and Steam progressed to QR generation. CrossOver's bcrypt/ncrypt are byte-identical to upstream wine-11.0 (verified against the published CrossOver 26 LGPL source tarball); CrossOver patches bcrypt/ncrypt nowhere. So the difference is purely the dropped opaque support, nothing vendor-proprietary. PROPOSED FIX A patch is available that adds BCRYPT_OPAQUE_KEY_BLOB export/import for asymmetric keys. Opaque blobs are implementation-private by contract (importable only into the same provider), so it serializes the fullest standard blob for the key with an 8-byte tag header and reverses it on import, reusing the existing per-alg helpers. Status of the patch: PROPOSED. The approach is proven by the binary transplant above, but this specific reimplementation still needs a wine build plus the dlls/bcrypt test suite before being sent as a formal patch. It will be attached once built and tested. Draft, patch, and a suggested round-trip test: https://github.com/egnaro9/steam-on-wine-macos/tree/main/wine-patch -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.