title: Upgraded from dotnet 5 to 6, getting error when decrypting: The computed authentication tag did not match the input authentication tag
body: <p>I upgraded from dotnet 5 to 6, and I'm unable to decrypt data that was encrypted before the upgrade:</p>
  <pre><code>System.Security.Cryptography.CryptographicException: The computed authentication tag did not match the input authentication tag.
     at System.Security.Cryptography.AeadCommon.Decrypt(SafeKeyHandle keyHandle, ReadOnlySpan`1 nonce, ReadOnlySpan`1 associatedData, ReadOnlySpan`1 ciphertext, ReadOnlySpan`1 tag, Span`1 plaintext, Boolean clearPlaintextOnFailure)
     at System.Security.Cryptography.AesGcm.Decrypt(ReadOnlySpan`1 nonce, ReadOnlySpan`1 ciphertext, ReadOnlySpan`1 tag, Span`1 plaintext, ReadOnlySpan`1 associatedData)
     at Microsoft.AspNetCore.DataProtection.Managed.AesGcmAuthenticatedEncryptor.Decrypt(ArraySegment`1 ciphertext, ArraySegment`1 additionalAuthenticatedData)
     at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.UnprotectCore(Byte[] protectedData, Boolean allowOperationsOnRevokedKeys, UnprotectStatus&amp; status)
     at Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Unprotect(Byte[] protectedData)
     at Microsoft.AspNetCore.DataProtection.DataProtectionCommonExtensions.Unprotect(IDataProtector protector, String protectedData)
  </code></pre>
  <p>Does this mean I'll need to re-ecrypt encrypted data, or is there some way I can configure my IDataProtector to be backward compatible?</p>
  <p>In my startup, I register my DataProtector like so:</p>
  <pre><code>var config = new AuthenticatedEncryptorConfiguration {
    EncryptionAlgorithm = EncryptionAlgorithm.AES_256_GCM,
    ValidationAlgorithm = ValidationAlgorithm.HMACSHA256
  };
  var credentials = new AzureCliCredential(new AzureCliCredentialOptions {
    TenantId = &quot;&lt;tenant id guid&gt;&quot;
  });
  var dataProtection = services
    .AddDataProtection()
    .PersistKeysToAzureBlobStorage(new Uri(azureStorageSettings.KeysFullBlobUri), credentials)
    .UseCryptographicAlgorithms(config)
    .ProtectKeysWithAzureKeyVault(new Uri(azureKeyVaultSettings.KeyUri), credentials);
  </code></pre>
  <p>And when here's what I use to encrypt/decrypt:</p>
  <pre><code>private readonly IDataProtectionProvider _protectorProvider;
  
  ...
  
  public string EncryptFormSubmission(string formSubmissionJson, string itemKey)
    =&gt; GetProtector(itemKey).Protect(formSubmissionJson);
  
  public string DecryptFormSubmission(string formSubmissionJson, string itemKey)
    =&gt; GetProtector(itemKey).Unprotect(formSubmissionJson);
  
  private IDataProtector GetProtector(string itemKey)
    =&gt; _protectorProvider.CreateProtector(_coreSettings.FormSubmissionKey + &quot;_&quot; + itemKey);
  
  </code></pre>
  <p>I'm starting to look through <a href="https://github.com/dotnet/aspnetcore/blob/main/src/DataProtection/DataProtection/src/Managed/AesGcmAuthenticatedEncryptor.cs" rel="nofollow noreferrer">https://github.com/dotnet/aspnetcore/blob/main/src/DataProtection/DataProtection/src/Managed/AesGcmAuthenticatedEncryptor.cs</a>, so I'll update if I find anything out.</p>