[Bug 60214] New: bcrypt: BCryptExportKey/BCryptImportKeyPair do not support BCRYPT_OPAQUE_KEY_BLOB for asymmetric keys, breaking modern Steam login
http://bugs.winehq.org/show_bug.cgi?id=60214 Bug ID: 60214 Summary: bcrypt: BCryptExportKey/BCryptImportKeyPair do not support BCRYPT_OPAQUE_KEY_BLOB for asymmetric keys, breaking modern Steam login Product: Wine Version: 11.15 Hardware: x86-64 OS: MacOS Status: UNCONFIRMED Severity: normal Priority: P2 Component: bcrypt Assignee: wine-bugs@list.winehq.org Reporter: erik.hill0987@gmail.com Target Milestone: --- The modern Steam client's device-key login exports an asymmetric key with BCryptExportKey(key, NULL, BCRYPT_OPAQUE_KEY_BLOB, ...). Wine's export_asymmetric_key() in dlls/bcrypt/bcrypt_main.c has no branch for BCRYPT_OPAQUE_KEY_BLOB and returns STATUS_NOT_IMPLEMENTED: fixme:bcrypt:export_asymmetric_key unsupported blob type L"OpaqueKeyBlob" fixme:ncrypt:map_ntstatus unhandled status 0xc0000002 Because this fails locally, every Steam auth session dies before any network traffic (QR generation included). In the client's CEF log this surfaces as: Login: Failed to poll auth session. Result 2. Transport Error: 2 while the client's own CM WebSocket connects normally, which makes the failure look like a networking bug when it is not. REGRESSION BCRYPT_OPAQUE_KEY_BLOB was supported by the older gnutls-backed bcrypt (originally added for Titanfall 2, ~2018). The post-11.0 rewrite to the PE/SymCrypt bcrypt did not carry opaque asymmetric export/import forward. Still absent in master as of 2026-08. HOW REPRODUCIBLE: always (Steam login on Wine, macOS or Linux, wine > 11.0). EVIDENCE IT IS THE CAUSE (not merely correlated) Differential test across three stacks on macOS/M4, 2026-08-22: signal (cef/wine logs) | 11.15 fails | 11.6 works | CrossOver 26 (=wine 11.0) works export_asymmetric_key ... OpaqueKeyBlob fixme | present | absent | absent Failed to poll auth session | continuous | absent | absent reaches QR / logs on | no | yes | yes Transplanting the wine-11.0 bcrypt.dll/ncrypt.dll PE pair plus bcrypt.so into an 11.15 prefix removed the fixme and Steam progressed to QR generation. CrossOver's bcrypt/ncrypt are byte-identical to upstream wine-11.0 (verified against the published CrossOver 26 LGPL source tarball); CrossOver patches bcrypt/ncrypt nowhere. So the difference is purely the dropped opaque support, nothing vendor-proprietary. PROPOSED FIX A patch is available that adds BCRYPT_OPAQUE_KEY_BLOB export/import for asymmetric keys. Opaque blobs are implementation-private by contract (importable only into the same provider), so it serializes the fullest standard blob for the key with an 8-byte tag header and reverses it on import, reusing the existing per-alg helpers. Status of the patch: PROPOSED. The approach is proven by the binary transplant above, but this specific reimplementation still needs a wine build plus the dlls/bcrypt test suite before being sent as a formal patch. It will be attached once built and tested. Draft, patch, and a suggested round-trip test: https://github.com/egnaro9/steam-on-wine-macos/tree/main/wine-patch -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60214 Erik Hill <erik.hill0987@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Summary|bcrypt: |bcrypt: |BCryptExportKey/BCryptImpor |BCryptExportKey/BCryptImpor |tKeyPair do not support |tKeyPair lack |BCRYPT_OPAQUE_KEY_BLOB for |BCRYPT_OPAQUE_KEY_BLOB |asymmetric keys, breaking |support for asymmetric keys |modern Steam login | --- Comment #1 from Erik Hill <erik.hill0987@gmail.com> --- Correction to this report. I over-attributed the cause. The OpaqueKeyBlob export gap itself is real (the fixme is definitive, and opaque asymmetric export/import is genuinely unimplemented). But I did NOT prove this gap is what breaks modern Steam login, and I should not have framed it that way. Gcenx, who maintains the macOS Wine packages, has the CURRENT Steam client working with a rendering fix alone: a small steamwebhelper wrapper forcing --in-process-gpu so DXMT's Metal renderer handles the in-process swapchain. That suggests the rendering path, not this crypto gap, may be the actual login blocker. My attempt to isolate which wall gates login was inconclusive: with DXMT + the in-process-gpu wrapper on stock 11.15, rendering failed a different way (GPU context lost) before login was ever attempted, so the crypto path never ran. I have retitled this to describe the verifiable API gap rather than assert a Steam root cause. Apologies for the noise; the opaque asymmetric export/import is still a genuine gap worth closing on its own merits. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60214 --- Comment #2 from Hans Leidekker <hans@meelstraat.net> --- (In reply to Erik Hill from comment #1)
I have retitled this to describe the verifiable API gap rather than assert a Steam root cause. Apologies for the noise; the opaque asymmetric export/import is still a genuine gap worth closing on its own merits.
That doesn't seem right. BCRYPT_OPAQUE_KEY_BLOB is documented as a symmetric, not asymmetric key format. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60214 Stian Low <wineryyyyy@gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |wineryyyyy@gmail.com --- Comment #3 from Stian Low <wineryyyyy@gmail.com> --- (In reply to Erik Hill from comment #1)
Correction to this report. I over-attributed the cause.
Might analysis/diagnostic come from AI? If so please state when AI is used for reports to help devs account for contexts where hallucinations may be likely. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
http://bugs.winehq.org/show_bug.cgi?id=60214 Hans Leidekker <hans@meelstraat.net> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |RESOLVED Resolution|--- |INVALID --- Comment #4 from Hans Leidekker <hans@meelstraat.net> --- See comment 2. -- Do not reply to this email, post in Bugzilla using the above URL to reply. You are receiving this mail because: You are watching all bug changes.
participants (1)
-
WineHQ Bugzilla