From d8d0ba34c71b403c80b0fdc2bc1216667213f265 Mon Sep 17 00:00:00 2001
From: Buyaa Namnan <bunamnan@microsoft.com>
Date: Wed, 29 Jan 2020 14:09:11 -0800
Subject: [PATCH 01/13] Annotate System.Security.Cryptography.Algorithms for
 nullable

---
 .../Cryptography/BasicSymmetricCipher.cs      |   4 +-
 .../BasicSymmetricCipherBCrypt.cs             |  10 +-
 .../Internal/Cryptography/HashProviderCng.cs  |  13 +-
 .../Cryptography/UniversalCryptoDecryptor.cs  |   6 +-
 .../OSX/Interop.CoreFoundation.CFError.cs     |   2 +-
 .../OSX/Interop.CoreFoundation.CFString.cs    |   2 +-
 .../Interop.KeyAgree.cs                       |   2 +-
 .../Interop.Keychain.cs                       |   4 +-
 .../Interop.SecErr.cs                         |   2 +-
 .../Interop.SecErrMessage.cs                  |   2 +-
 .../Interop.SecKeyRef.Export.cs               |   6 +-
 .../Interop.Bignum.cs                         |   4 +-
 .../Interop.Dsa.cs                            |   2 +-
 .../Interop.EcDsa.ImportExport.cs             |  16 +-
 .../Interop.EcKey.cs                          |   2 +-
 .../Interop.Rsa.cs                            |  12 +-
 .../Common/src/Interop/Windows/BCrypt/Cng.cs  |   4 +-
 .../BCrypt/Interop.BCryptEncryptDecrypt.cs    |   8 +-
 .../Interop.BCryptOpenAlgorithmProvider.cs    |   2 +-
 .../Interop/Windows/NCrypt/Interop.Keys.cs    |   4 +-
 .../NCrypt/Interop.NCryptDeriveKeyMaterial.cs |  24 +--
 .../Win32/SafeHandles/SafeHandleCache.cs      |   4 +-
 .../Asn1/AlgorithmIdentifierAsn.manual.cs     |   2 +-
 .../Asn1/ECDomainParameters.xml.cs            |   2 +-
 .../Cryptography/Asn1/Pbkdf2SaltChoice.xml.cs |   2 +-
 .../System/Security/Cryptography/CngPkcs8.cs  |   4 +-
 .../Cryptography/DSACng.ImportExport.cs       |   8 +-
 .../System/Security/Cryptography/DSACng.cs    |   2 +-
 .../Cryptography/DSAKeyFormatHelper.cs        |   2 +-
 .../Security/Cryptography/DSAOpenSsl.cs       |   4 +-
 .../Cryptography/DSASecurityTransforms.cs     |   8 +-
 .../Cryptography/ECCng.HashAlgorithm.cs       |   6 +-
 .../Cryptography/ECCng.ImportExport.cs        |  20 +--
 .../ECDiffieHellmanCng.ImportExport.cs        |   4 +-
 .../Cryptography/ECDiffieHellmanCng.cs        |  10 +-
 .../Cryptography/ECDiffieHellmanDerivation.cs |  12 +-
 .../ECDiffieHellmanOpenSsl.Derive.cs          |  20 +--
 .../Cryptography/ECDiffieHellmanOpenSsl.cs    |   2 +-
 .../ECDiffieHellmanOpenSslPublicKey.cs        |   2 +-
 .../ECDiffieHellmanSecurityTransforms.cs      |  16 +-
 .../Cryptography/ECDsaCng.ImportExport.cs     |   4 +-
 .../Security/Cryptography/ECDsaOpenSsl.cs     |   2 +-
 .../Cryptography/ECOpenSsl.ImportExport.cs    |  10 +-
 .../System/Security/Cryptography/ECOpenSsl.cs |  10 +-
 .../Cryptography/EccKeyFormatHelper.cs        |   5 +-
 .../Cryptography/EccSecurityTransforms.cs     |   6 +-
 .../Security/Cryptography/KeyFormatHelper.cs  |  12 +-
 .../Cryptography/PasswordBasedEncryption.cs   |  20 +--
 .../System/Security/Cryptography/Pkcs12Kdf.cs |   4 +-
 .../Cryptography/RSACng.ImportExport.cs       |  12 +-
 .../Cryptography/RSACng.SignVerify.cs         |   8 +-
 .../Security/Cryptography/RSAOpenSsl.cs       |  32 ++--
 .../Cryptography/RSASecurityTransforms.cs     |  12 +-
 .../Cryptography/RsaPaddingProcessor.cs       |   2 +-
 .../Security/Cryptography/SecKeyPair.cs       |   6 +-
 ...ystem.Security.Cryptography.Algorithms.sln |   4 +-
 ...System.Security.Cryptography.Algorithms.cs | 144 +++++++++---------
 ...em.Security.Cryptography.Algorithms.csproj |   1 +
 .../Cryptography/AesImplementation.OSX.cs     |   2 +-
 .../Cryptography/AesImplementation.Unix.cs    |   2 +-
 .../Cryptography/AesImplementation.Windows.cs |   2 +-
 .../Cryptography/AesImplementation.cs         |   6 +-
 .../Internal/Cryptography/AppleCCCryptor.cs   |  10 +-
 .../Cryptography/DesImplementation.OSX.cs     |   2 +-
 .../Cryptography/DesImplementation.Unix.cs    |   2 +-
 .../Cryptography/DesImplementation.Windows.cs |   2 +-
 .../Cryptography/DesImplementation.cs         |   6 +-
 .../src/Internal/Cryptography/HMACCommon.cs   |  16 +-
 .../Cryptography/HashAlgorithmNames.cs        |   2 +-
 .../HashProviderDispenser.Unix.cs             |   2 +-
 .../src/Internal/Cryptography/Helpers.cs      |   2 +-
 .../Internal/Cryptography/OpenSslCipher.cs    |   6 +-
 .../Cryptography/RC2Implementation.OSX.cs     |   2 +-
 .../Cryptography/RC2Implementation.Unix.cs    |   2 +-
 .../Cryptography/RC2Implementation.Windows.cs |   2 +-
 .../Cryptography/RC2Implementation.cs         |   6 +-
 .../TripleDesImplementation.OSX.cs            |   2 +-
 .../TripleDesImplementation.Unix.cs           |   2 +-
 .../TripleDesImplementation.Windows.cs        |   2 +-
 .../Cryptography/TripleDesImplementation.cs   |   6 +-
 ...em.Security.Cryptography.Algorithms.csproj |   1 +
 .../src/System/Security/Cryptography/Aes.cs   |   4 +-
 .../Security/Cryptography/AesCcm.Unix.cs      |   2 +-
 .../Security/Cryptography/AesCcm.Windows.cs   |   2 +-
 .../System/Security/Cryptography/AesCcm.cs    |   4 +-
 .../Security/Cryptography/AesGcm.Unix.cs      |   2 +-
 .../Security/Cryptography/AesGcm.Windows.cs   |   2 +-
 .../System/Security/Cryptography/AesGcm.cs    |   4 +-
 .../AsymmetricKeyExchangeDeformatter.cs       |   2 +-
 .../AsymmetricKeyExchangeFormatter.cs         |   4 +-
 .../AsymmetricSignatureDeformatter.cs         |   4 +-
 .../AsymmetricSignatureFormatter.cs           |   4 +-
 .../Security/Cryptography/CngKeyLite.cs       |  17 ++-
 .../System/Security/Cryptography/CngPkcs8.cs  |   2 +-
 .../Security/Cryptography/CryptoConfig.cs     |  22 +--
 .../src/System/Security/Cryptography/DES.cs   |   6 +-
 .../System/Security/Cryptography/DSA.Xml.cs   |   8 +-
 .../src/System/Security/Cryptography/DSA.cs   |   4 +-
 .../System/Security/Cryptography/DSACng.cs    |   4 +-
 .../Security/Cryptography/DSAParameters.cs    |   6 +-
 .../Cryptography/DSASignatureDeformatter.cs   |   2 +-
 .../Cryptography/DSASignatureFormatter.cs     |   2 +-
 .../System/Security/Cryptography/ECCngKey.cs  |  13 +-
 .../System/Security/Cryptography/ECCurve.cs   |  10 +-
 .../Security/Cryptography/ECDiffieHellman.cs  |  16 +-
 .../Cryptography/ECDiffieHellmanCng.Derive.cs |   2 +-
 .../Cryptography/ECDiffieHellmanCng.Key.cs    |   4 +-
 .../ECDiffieHellmanCngPublicKey.cs            |   6 +-
 .../Cryptography/ECDiffieHellmanPublicKey.cs  |   4 +-
 .../src/System/Security/Cryptography/ECDsa.cs |  10 +-
 .../Security/Cryptography/ECDsaCng.Key.cs     |   2 +-
 .../Security/Cryptography/ECParameters.cs     |   4 +-
 .../System/Security/Cryptography/ECPoint.cs   |   2 +-
 .../src/System/Security/Cryptography/HKDF.cs  |   6 +-
 .../System/Security/Cryptography/HMACMD5.cs   |   4 +-
 .../System/Security/Cryptography/HMACSHA1.cs  |   4 +-
 .../Security/Cryptography/HMACSHA256.cs       |   4 +-
 .../Security/Cryptography/HMACSHA384.cs       |   4 +-
 .../Security/Cryptography/HMACSHA512.cs       |   4 +-
 .../Security/Cryptography/IncrementalHash.cs  |  10 +-
 .../src/System/Security/Cryptography/MD5.cs   |   2 +-
 .../Cryptography/PKCS1MaskGenerationMethod.cs |   4 +-
 .../src/System/Security/Cryptography/RC2.cs   |   4 +-
 .../System/Security/Cryptography/RSA.Xml.cs   |  14 +-
 .../src/System/Security/Cryptography/RSA.cs   |   7 +-
 .../System/Security/Cryptography/RSACng.cs    |   6 +-
 .../Cryptography/RSAEncryptionPadding.cs      |   8 +-
 .../RSAOAEPKeyExchangeDeformatter.cs          |   4 +-
 .../RSAOAEPKeyExchangeFormatter.cs            |  14 +-
 .../RSAPKCS1KeyExchangeDeformatter.cs         |   8 +-
 .../RSAPKCS1KeyExchangeFormatter.cs           |   8 +-
 .../RSAPKCS1SignatureDeformatter.cs           |   4 +-
 .../RSAPKCS1SignatureFormatter.cs             |   4 +-
 .../Security/Cryptography/RSAParameters.cs    |  12 +-
 .../Cryptography/RSASignaturePadding.cs       |   8 +-
 .../Cryptography/RandomNumberGenerator.cs     |   4 +-
 .../Cryptography/Rfc2898DeriveBytes.cs        |   4 +-
 .../System/Security/Cryptography/Rijndael.cs  |   4 +-
 .../src/System/Security/Cryptography/SHA1.cs  |   2 +-
 .../System/Security/Cryptography/SHA256.cs    |   2 +-
 .../System/Security/Cryptography/SHA384.cs    |   2 +-
 .../System/Security/Cryptography/SHA512.cs    |   2 +-
 .../Cryptography/SignatureDescription.cs      |  25 +--
 .../System/Security/Cryptography/TripleDES.cs |   4 +-
 .../Security/Cryptography/XmlKeyHelper.cs     |  44 +++---
 145 files changed, 536 insertions(+), 522 deletions(-)

diff --git a/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipher.cs b/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipher.cs
index f4cd17431d5b55..55fcb2bd8ac880 100644
--- a/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipher.cs
+++ b/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipher.cs
@@ -22,7 +22,7 @@ namespace Internal.Cryptography
     //
     internal abstract class BasicSymmetricCipher : IDisposable
     {
-        protected BasicSymmetricCipher(byte[] iv, int blockSizeInBytes)
+        protected BasicSymmetricCipher(byte[]? iv, int blockSizeInBytes)
         {
             IV = iv;
             BlockSizeInBytes = blockSizeInBytes;
@@ -52,6 +52,6 @@ protected virtual void Dispose(bool disposing)
             }
         }
 
-        protected byte[] IV { get; private set; }
+        protected byte[]? IV { get; private set; }
     }
 }
diff --git a/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipherBCrypt.cs b/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipherBCrypt.cs
index 47fd299ca62ed1..4ddb46101484f3 100644
--- a/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipherBCrypt.cs
+++ b/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipherBCrypt.cs
@@ -13,10 +13,10 @@ internal sealed class BasicSymmetricCipherBCrypt : BasicSymmetricCipher
     {
         private readonly bool _encrypting;
         private SafeKeyHandle _hKey;
-        private byte[] _currentIv;  // CNG mutates this with the updated IV for the next stage on each Encrypt/Decrypt call.
+        private byte[]? _currentIv;  // CNG mutates this with the updated IV for the next stage on each Encrypt/Decrypt call.
                                     // The base IV holds a copy of the original IV for Reset(), until it is cleared by Dispose().
 
-        public BasicSymmetricCipherBCrypt(SafeAlgorithmHandle algorithm, CipherMode cipherMode, int blockSizeInBytes, byte[] key, bool ownsParentHandle, byte[] iv, bool encrypting)
+        public BasicSymmetricCipherBCrypt(SafeAlgorithmHandle algorithm, CipherMode cipherMode, int blockSizeInBytes, byte[] key, bool ownsParentHandle, byte[]? iv, bool encrypting)
             : base(cipherMode.GetCipherIv(iv), blockSizeInBytes)
         {
             Debug.Assert(algorithm != null);
@@ -43,13 +43,13 @@ protected override void Dispose(bool disposing)
             if (disposing)
             {
                 SafeKeyHandle hKey = _hKey;
-                _hKey = null;
+                _hKey = null!;
                 if (hKey != null)
                 {
                     hKey.Dispose();
                 }
 
-                byte[] currentIv = _currentIv;
+                byte[]? currentIv = _currentIv;
                 _currentIv = null;
                 if (currentIv != null)
                 {
@@ -115,7 +115,7 @@ private void Reset()
         {
             if (IV != null)
             {
-                Buffer.BlockCopy(IV, 0, _currentIv, 0, IV.Length);
+                Buffer.BlockCopy(IV, 0, _currentIv!, 0, IV.Length);
             }
         }
     }
diff --git a/src/libraries/Common/src/Internal/Cryptography/HashProviderCng.cs b/src/libraries/Common/src/Internal/Cryptography/HashProviderCng.cs
index ce4e1f58aca3aa..29e29f4351789e 100644
--- a/src/libraries/Common/src/Internal/Cryptography/HashProviderCng.cs
+++ b/src/libraries/Common/src/Internal/Cryptography/HashProviderCng.cs
@@ -21,7 +21,7 @@ internal sealed class HashProviderCng : HashProvider
         //
         //   - "key" activates MAC hashing if present. If null, this HashProvider performs a regular old hash.
         //
-        public HashProviderCng(string hashAlgId, byte[] key) : this(hashAlgId, key, isHmac: key != null)
+        public HashProviderCng(string hashAlgId, byte[]? key) : this(hashAlgId, key, isHmac: key != null)
         {
         }
 
@@ -39,7 +39,7 @@ internal HashProviderCng(string hashAlgId, ReadOnlySpan<byte> key, bool isHmac)
             // Win7 won't set hHash, Win8+ will; and both will set _hHash.
             // So keep hHash trapped in this scope to prevent (mis-)use of it.
             {
-                SafeBCryptHashHandle hHash = null;
+                SafeBCryptHashHandle? hHash = null;
                 NTSTATUS ntStatus = Interop.BCrypt.BCryptCreateHash(_hAlgorithm, out hHash, IntPtr.Zero, 0, key, key == null ? 0 : key.Length, BCryptCreateHashFlags.BCRYPT_HASH_REUSABLE_FLAG);
                 if (ntStatus == NTSTATUS.STATUS_INVALID_PARAMETER)
                 {
@@ -62,6 +62,7 @@ internal HashProviderCng(string hashAlgId, ReadOnlySpan<byte> key, bool isHmac)
             {
                 int cbSizeOfHashSize;
                 int hashSize;
+                Debug.Assert(_hHash != null);
                 NTSTATUS ntStatus = Interop.BCrypt.BCryptGetProperty(_hHash, Interop.BCrypt.BCryptPropertyStrings.BCRYPT_HASH_LENGTH, &hashSize, sizeof(int), out cbSizeOfHashSize, 0);
                 if (ntStatus != NTSTATUS.STATUS_SUCCESS)
                     throw Interop.BCrypt.CreateCryptographicException(ntStatus);
@@ -71,6 +72,7 @@ internal HashProviderCng(string hashAlgId, ReadOnlySpan<byte> key, bool isHmac)
 
         public sealed override unsafe void AppendHashData(ReadOnlySpan<byte> source)
         {
+            Debug.Assert(_hHash != null);
             NTSTATUS ntStatus = Interop.BCrypt.BCryptHashData(_hHash, source, source.Length, 0);
             if (ntStatus != NTSTATUS.STATUS_SUCCESS)
             {
@@ -95,6 +97,7 @@ public override bool TryFinalizeHashAndReset(Span<byte> destination, out int byt
                 return false;
             }
 
+            Debug.Assert(_hHash != null);
             NTSTATUS ntStatus = Interop.BCrypt.BCryptFinishHash(_hHash, destination, _hashSize, 0);
             if (ntStatus != NTSTATUS.STATUS_SUCCESS)
             {
@@ -138,7 +141,7 @@ private void ResetHashObject()
 
         private void DestroyHash()
         {
-            SafeBCryptHashHandle hHash = _hHash;
+            SafeBCryptHashHandle? hHash = _hHash;
             _hHash = null;
             if (hHash != null)
             {
@@ -149,8 +152,8 @@ private void DestroyHash()
         }
 
         private readonly SafeBCryptAlgorithmHandle _hAlgorithm;
-        private SafeBCryptHashHandle _hHash;
-        private byte[] _key;
+        private SafeBCryptHashHandle? _hHash;
+        private byte[]? _key;
         private readonly bool _reusable;
 
         private readonly int _hashSize;
diff --git a/src/libraries/Common/src/Internal/Cryptography/UniversalCryptoDecryptor.cs b/src/libraries/Common/src/Internal/Cryptography/UniversalCryptoDecryptor.cs
index 5ca2be5a91aa06..4689e0cea0e13a 100644
--- a/src/libraries/Common/src/Internal/Cryptography/UniversalCryptoDecryptor.cs
+++ b/src/libraries/Common/src/Internal/Cryptography/UniversalCryptoDecryptor.cs
@@ -77,7 +77,7 @@ protected sealed override byte[] UncheckedTransformFinalBlock(byte[] inputBuffer
             // Otherwise the decryption buffer is just the input data.
             //
 
-            byte[] ciphertext = null;
+            byte[]? ciphertext = null;
 
             if (_heldoverCipher == null)
             {
@@ -123,7 +123,7 @@ protected sealed override void Dispose(bool disposing)
         {
             if (disposing)
             {
-                byte[] heldoverCipher = _heldoverCipher;
+                byte[]? heldoverCipher = _heldoverCipher;
                 _heldoverCipher = null;
                 if (heldoverCipher != null)
                 {
@@ -248,6 +248,6 @@ private byte[] DepadBlock(byte[] block, int offset, int count)
         // whether this is the final block that needs depadding. This block is held (in encrypted form) in _heldoverCipher. The next call to TransformBlock
         // or TransformFinalBlock must include the decryption of _heldoverCipher in the results.
         //
-        private byte[] _heldoverCipher;
+        private byte[]? _heldoverCipher;
     }
 }
diff --git a/src/libraries/Common/src/Interop/OSX/Interop.CoreFoundation.CFError.cs b/src/libraries/Common/src/Interop/OSX/Interop.CoreFoundation.CFError.cs
index af3b5cd4c3a63f..e3f104eb09a778 100644
--- a/src/libraries/Common/src/Interop/OSX/Interop.CoreFoundation.CFError.cs
+++ b/src/libraries/Common/src/Interop/OSX/Interop.CoreFoundation.CFError.cs
@@ -29,7 +29,7 @@ internal static int GetErrorCode(SafeCFErrorHandle cfError)
             }
         }
 
-        internal static string GetErrorDescription(SafeCFErrorHandle cfError)
+        internal static string? GetErrorDescription(SafeCFErrorHandle cfError)
         {
             Debug.Assert(cfError != null);
 
diff --git a/src/libraries/Common/src/Interop/OSX/Interop.CoreFoundation.CFString.cs b/src/libraries/Common/src/Interop/OSX/Interop.CoreFoundation.CFString.cs
index 17fb307d32d18b..98010faa6fa633 100644
--- a/src/libraries/Common/src/Interop/OSX/Interop.CoreFoundation.CFString.cs
+++ b/src/libraries/Common/src/Interop/OSX/Interop.CoreFoundation.CFString.cs
@@ -43,7 +43,7 @@ internal static string CFStringToString(SafeCFStringHandle cfString)
 
             if (interiorPointer != IntPtr.Zero)
             {
-                return Marshal.PtrToStringUTF8(interiorPointer);
+                return Marshal.PtrToStringUTF8(interiorPointer)!;
             }
 
             SafeCFDataHandle cfData = CFStringCreateExternalRepresentation(
diff --git a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.KeyAgree.cs b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.KeyAgree.cs
index e213670a95bac1..d6dd96d0bfbf17 100644
--- a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.KeyAgree.cs
+++ b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.KeyAgree.cs
@@ -20,7 +20,7 @@ private static extern int AppleCryptoNative_EcdhKeyAgree(
             out SafeCFDataHandle cfDataOut,
             out SafeCFErrorHandle cfErrorOut);
 
-        internal static byte[] EcdhKeyAgree(
+        internal static byte[]? EcdhKeyAgree(
             SafeSecKeyRefHandle privateKey,
             SafeSecKeyRefHandle publicKey,
             Span<byte> opportunisticDestination,
diff --git a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Keychain.cs b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Keychain.cs
index c58c98d44e5b75..9937e988b177bc 100644
--- a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Keychain.cs
+++ b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Keychain.cs
@@ -371,7 +371,7 @@ internal static void TrackItem(SafeKeychainItemHandle keychainItem)
 
                 lock (s_lookup)
                 {
-                    SafeTemporaryKeychainHandle temporaryHandle;
+                    SafeTemporaryKeychainHandle? temporaryHandle;
 
                     if (s_lookup.TryGetValue(keychain.DangerousGetHandle(), out temporaryHandle))
                     {
@@ -393,7 +393,7 @@ internal static void UntrackItem(IntPtr keychainItem)
 
                 lock (s_lookup)
                 {
-                    SafeTemporaryKeychainHandle temporaryHandle;
+                    SafeTemporaryKeychainHandle? temporaryHandle;
 
                     if (s_lookup.TryGetValue(keychain.DangerousGetHandle(), out temporaryHandle))
                     {
diff --git a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErr.cs b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErr.cs
index 48154a22883621..2faceaacddea60 100644
--- a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErr.cs
+++ b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErr.cs
@@ -10,7 +10,7 @@ internal static partial class AppleCrypto
     {
         internal static Exception CreateExceptionForOSStatus(int osStatus)
         {
-            string msg = GetSecErrorString(osStatus);
+            string? msg = GetSecErrorString(osStatus);
 
             if (msg == null)
             {
diff --git a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErrMessage.cs b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErrMessage.cs
index c8192f482d63ff..9748e407fbd07d 100644
--- a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErrMessage.cs
+++ b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErrMessage.cs
@@ -12,7 +12,7 @@ internal static partial class AppleCrypto
         [DllImport(Libraries.AppleCryptoNative)]
         private static extern SafeCFStringHandle AppleCryptoNative_SecCopyErrorMessageString(int osStatus);
 
-        internal static string GetSecErrorString(int osStatus)
+        internal static string? GetSecErrorString(int osStatus)
         {
             using (SafeCFStringHandle cfString = AppleCryptoNative_SecCopyErrorMessageString(osStatus))
             {
diff --git a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecKeyRef.Export.cs b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecKeyRef.Export.cs
index 2bf6bbe0170185..c9d5fc0f9cce62 100644
--- a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecKeyRef.Export.cs
+++ b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecKeyRef.Export.cs
@@ -17,14 +17,14 @@ internal static partial class AppleCrypto
 
         [DllImport(Libraries.AppleCryptoNative)]
         private static extern int AppleCryptoNative_SecKeyExport(
-            SafeSecKeyRefHandle key,
+            SafeSecKeyRefHandle? key,
             int exportPrivate,
             SafeCreateHandle cfExportPassphrase,
             out SafeCFDataHandle cfDataOut,
             out int pOSStatus);
 
         internal static SafeCFDataHandle SecKeyExportData(
-            SafeSecKeyRefHandle key,
+            SafeSecKeyRefHandle? key,
             bool exportPrivate,
             ReadOnlySpan<char> password)
         {
@@ -70,7 +70,7 @@ internal static SafeCFDataHandle SecKeyExportData(
         }
 
         internal static byte[] SecKeyExport(
-            SafeSecKeyRefHandle key,
+            SafeSecKeyRefHandle? key,
             bool exportPrivate,
             string password)
         {
diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Bignum.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Bignum.cs
index 6faf7f8915a6b4..9bb3f920c6eb88 100644
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Bignum.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Bignum.cs
@@ -3,6 +3,7 @@
 // See the LICENSE file in the project root for more information.
 
 using System;
+using System.Diagnostics.CodeAnalysis;
 using System.Runtime.InteropServices;
 using Microsoft.Win32.SafeHandles;
 
@@ -55,7 +56,8 @@ internal static byte[] ExtractBignum(IntPtr bignum, int targetSize)
             }
         }
 
-        private static unsafe byte[] ExtractBignum(SafeBignumHandle bignum, int targetSize)
+        [return: NotNullIfNotNull("bignum")]
+        private static unsafe byte[]? ExtractBignum(SafeBignumHandle? bignum, int targetSize)
         {
             if (bignum == null || bignum.IsInvalid)
             {
diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Dsa.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Dsa.cs
index d22c641e49c8ae..629a7d9a707ed5 100644
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Dsa.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Dsa.cs
@@ -167,7 +167,7 @@ internal static extern bool DsaKeyCreateByExplicitParameters(
             int gLength,
             byte[] y,
             int yLength,
-            byte[] x,
+            byte[]? x,
             int xLength);
     }
 }
diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs
index 578018400864dc..773e54dd55f801 100644
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs
@@ -18,13 +18,13 @@ private static extern int EcKeyCreateByKeyParameters(
             string oid,
             byte[] qx, int qxLength,
             byte[] qy, int qyLength,
-            byte[] d, int dLength);
+            byte[]? d, int dLength);
 
         internal static SafeEcKeyHandle EcKeyCreateByKeyParameters(
             string oid,
             byte[] qx, int qxLength,
             byte[] qy, int qyLength,
-            byte[] d, int dLength)
+            byte[]? d, int dLength)
         {
             SafeEcKeyHandle key;
             int rc = EcKeyCreateByKeyParameters(out key, oid, qx, qxLength, qy, qyLength, d, dLength);
@@ -41,17 +41,17 @@ internal static SafeEcKeyHandle EcKeyCreateByKeyParameters(
         [DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_EcKeyCreateByExplicitParameters")]
         internal static extern SafeEcKeyHandle EcKeyCreateByExplicitParameters(
             ECCurve.ECCurveType curveType,
-            byte[] qx, int qxLength,
-            byte[] qy, int qyLength,
-            byte[] d, int dLength,
+            byte[]? qx, int qxLength,
+            byte[]? qy, int qyLength,
+            byte[]? d, int dLength,
             byte[] p, int pLength,
             byte[] a, int aLength,
             byte[] b, int bLength,
             byte[] gx, int gxLength,
             byte[] gy, int gyLength,
             byte[] order, int nLength,
-            byte[] cofactor, int cofactorLength,
-            byte[] seed, int seedLength);
+            byte[]? cofactor, int cofactorLength,
+            byte[]? seed, int seedLength);
 
         internal static SafeEcKeyHandle EcKeyCreateByExplicitCurve(ECCurve curve)
         {
@@ -80,7 +80,7 @@ internal static SafeEcKeyHandle EcKeyCreateByExplicitCurve(ECCurve curve)
                 curve.G.X, curve.G.X.Length,
                 curve.G.Y, curve.G.Y.Length,
                 curve.Order, curve.Order.Length,
-                curve.Cofactor, curve.Cofactor.Length,
+                curve.Cofactor, curve.Cofactor!.Length,
                 curve.Seed, curve.Seed == null ? 0 : curve.Seed.Length);
 
             if (key == null || key.IsInvalid)
diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcKey.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcKey.cs
index b9e7c91d9e0cee..02b027eb67066d 100644
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcKey.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcKey.cs
@@ -13,7 +13,7 @@ internal static partial class Crypto
     {
         [DllImport(Libraries.CryptoNative, EntryPoint = "CryptoNative_EcKeyCreateByOid")]
         private static extern SafeEcKeyHandle CryptoNative_EcKeyCreateByOid(string oid);
-        internal static SafeEcKeyHandle EcKeyCreateByOid(string oid)
+        internal static SafeEcKeyHandle? EcKeyCreateByOid(string oid)
         {
             SafeEcKeyHandle handle = CryptoNative_EcKeyCreateByOid(oid);
             if (handle == null || handle.IsInvalid)
diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Rsa.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Rsa.cs
index bbf39bff0bfc65..0e443ff0ec7a61 100644
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Rsa.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Rsa.cs
@@ -197,17 +197,17 @@ internal static extern bool SetRsaParameters(
             int nLength,
             byte[] e,
             int eLength,
-            byte[] d,
+            byte[]? d,
             int dLength,
-            byte[] p,
+            byte[]? p,
             int pLength,
-            byte[] dmp1,
+            byte[]? dmp1,
             int dmp1Length,
-            byte[] q,
+            byte[]? q,
             int qLength,
-            byte[] dmq1,
+            byte[]? dmq1,
             int dmq1Length,
-            byte[] iqmp,
+            byte[]? iqmp,
             int iqmpLength);
 
         internal enum RsaPadding : int
diff --git a/src/libraries/Common/src/Interop/Windows/BCrypt/Cng.cs b/src/libraries/Common/src/Interop/Windows/BCrypt/Cng.cs
index df8835d355dd06..312bfa3da581de 100644
--- a/src/libraries/Common/src/Interop/Windows/BCrypt/Cng.cs
+++ b/src/libraries/Common/src/Interop/Windows/BCrypt/Cng.cs
@@ -69,7 +69,7 @@ public enum OpenAlgorithmProviderFlags : int
         public const string BCRYPT_CHAIN_MODE_GCM = "ChainingModeGCM";
         public const string BCRYPT_CHAIN_MODE_CCM = "ChainingModeCCM";
 
-        public static SafeAlgorithmHandle BCryptOpenAlgorithmProvider(string pszAlgId, string pszImplementation, OpenAlgorithmProviderFlags dwFlags)
+        public static SafeAlgorithmHandle BCryptOpenAlgorithmProvider(string pszAlgId, string? pszImplementation, OpenAlgorithmProviderFlags dwFlags)
         {
             SafeAlgorithmHandle hAlgorithm;
             NTSTATUS ntStatus = Interop.BCryptOpenAlgorithmProvider(out hAlgorithm, pszAlgId, pszImplementation, (int)dwFlags);
@@ -111,7 +111,7 @@ internal static partial class Cng
         internal static class Interop
         {
             [DllImport(Libraries.BCrypt, CharSet = CharSet.Unicode)]
-            public static extern NTSTATUS BCryptOpenAlgorithmProvider(out SafeAlgorithmHandle phAlgorithm, string pszAlgId, string pszImplementation, int dwFlags);
+            public static extern NTSTATUS BCryptOpenAlgorithmProvider(out SafeAlgorithmHandle phAlgorithm, string pszAlgId, string? pszImplementation, int dwFlags);
 
             [DllImport(Libraries.BCrypt, CharSet = CharSet.Unicode)]
             public static extern unsafe NTSTATUS BCryptSetProperty(SafeAlgorithmHandle hObject, string pszProperty, string pbInput, int cbInput, int dwFlags);
diff --git a/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptEncryptDecrypt.cs b/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptEncryptDecrypt.cs
index 572fcce0742aa1..5b0aca93c1d4cd 100644
--- a/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptEncryptDecrypt.cs
+++ b/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptEncryptDecrypt.cs
@@ -13,7 +13,7 @@ internal static partial class Interop
     internal static partial class BCrypt
     {
         // Note: input and output are allowed to be the same buffer. BCryptEncrypt will correctly do the encryption in place according to CNG documentation.
-        internal static int BCryptEncrypt(SafeKeyHandle hKey, byte[] input, int inputOffset, int inputCount, byte[] iv, byte[] output, int outputOffset, int outputCount)
+        internal static int BCryptEncrypt(SafeKeyHandle hKey, byte[] input, int inputOffset, int inputCount, byte[]? iv, byte[] output, int outputOffset, int outputCount)
         {
             Debug.Assert(input != null);
             Debug.Assert(inputOffset >= 0);
@@ -41,7 +41,7 @@ internal static int BCryptEncrypt(SafeKeyHandle hKey, byte[] input, int inputOff
         }
 
         // Note: input and output are allowed to be the same buffer. BCryptDecrypt will correctly do the decryption in place according to CNG documentation.
-        internal static int BCryptDecrypt(SafeKeyHandle hKey, byte[] input, int inputOffset, int inputCount, byte[] iv, byte[] output, int outputOffset, int outputCount)
+        internal static int BCryptDecrypt(SafeKeyHandle hKey, byte[] input, int inputOffset, int inputCount, byte[]? iv, byte[] output, int outputOffset, int outputCount)
         {
             Debug.Assert(input != null);
             Debug.Assert(inputOffset >= 0);
@@ -69,9 +69,9 @@ internal static int BCryptDecrypt(SafeKeyHandle hKey, byte[] input, int inputOff
         }
 
         [DllImport(Libraries.BCrypt, CharSet = CharSet.Unicode)]
-        public static extern unsafe NTSTATUS BCryptEncrypt(SafeKeyHandle hKey, byte* pbInput, int cbInput, IntPtr paddingInfo, [In, Out] byte[] pbIV, int cbIV, byte* pbOutput, int cbOutput, out int cbResult, int dwFlags);
+        public static extern unsafe NTSTATUS BCryptEncrypt(SafeKeyHandle hKey, byte* pbInput, int cbInput, IntPtr paddingInfo, [In, Out] byte[]? pbIV, int cbIV, byte* pbOutput, int cbOutput, out int cbResult, int dwFlags);
 
         [DllImport(Libraries.BCrypt, CharSet = CharSet.Unicode)]
-        public static extern unsafe NTSTATUS BCryptDecrypt(SafeKeyHandle hKey, byte* pbInput, int cbInput, IntPtr paddingInfo, [In, Out] byte[] pbIV, int cbIV, byte* pbOutput, int cbOutput, out int cbResult, int dwFlags);
+        public static extern unsafe NTSTATUS BCryptDecrypt(SafeKeyHandle hKey, byte* pbInput, int cbInput, IntPtr paddingInfo, [In, Out] byte[]? pbIV, int cbIV, byte* pbOutput, int cbOutput, out int cbResult, int dwFlags);
     }
 }
diff --git a/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptOpenAlgorithmProvider.cs b/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptOpenAlgorithmProvider.cs
index 829b6e356822b3..9ef01d5364c332 100644
--- a/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptOpenAlgorithmProvider.cs
+++ b/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptOpenAlgorithmProvider.cs
@@ -13,7 +13,7 @@ internal partial class Interop
     internal partial class BCrypt
     {
         [DllImport(Libraries.BCrypt, CharSet = CharSet.Unicode)]
-        internal static extern NTSTATUS BCryptOpenAlgorithmProvider(out SafeBCryptAlgorithmHandle phAlgorithm, string pszAlgId, string pszImplementation, BCryptOpenAlgorithmProviderFlags dwFlags);
+        internal static extern NTSTATUS BCryptOpenAlgorithmProvider(out SafeBCryptAlgorithmHandle phAlgorithm, string pszAlgId, string? pszImplementation, BCryptOpenAlgorithmProviderFlags dwFlags);
 
         [Flags]
         internal enum BCryptOpenAlgorithmProviderFlags : int
diff --git a/src/libraries/Common/src/Interop/Windows/NCrypt/Interop.Keys.cs b/src/libraries/Common/src/Interop/Windows/NCrypt/Interop.Keys.cs
index ee4f09cc64ed5a..ac816bdd1c946d 100644
--- a/src/libraries/Common/src/Interop/Windows/NCrypt/Interop.Keys.cs
+++ b/src/libraries/Common/src/Interop/Windows/NCrypt/Interop.Keys.cs
@@ -24,7 +24,7 @@ internal static partial class NCrypt
         internal static extern ErrorCode NCryptImportKey(SafeNCryptProviderHandle hProvider, IntPtr hImportKey, string pszBlobType, ref NCryptBufferDesc pParameterList, [Out] out SafeNCryptKeyHandle phKey, ref byte pbData, int cbData, int dwFlags);
 
         [DllImport(Interop.Libraries.NCrypt, CharSet = CharSet.Unicode)]
-        internal static extern ErrorCode NCryptExportKey(SafeNCryptKeyHandle hKey, IntPtr hExportKey, string pszBlobType, IntPtr pParameterList, [Out] byte[] pbOutput, int cbOutput, [Out] out int pcbResult, int dwFlags);
+        internal static extern ErrorCode NCryptExportKey(SafeNCryptKeyHandle hKey, IntPtr hExportKey, string pszBlobType, IntPtr pParameterList, [Out] byte[]? pbOutput, int cbOutput, [Out] out int pcbResult, int dwFlags);
 
         [DllImport(Interop.Libraries.NCrypt, CharSet = CharSet.Unicode)]
         internal static extern ErrorCode NCryptExportKey(SafeNCryptKeyHandle hKey, IntPtr hExportKey, string pszBlobType, IntPtr pParameterList, ref byte pbOutput, int cbOutput, [Out] out int pcbResult, int dwFlags);
@@ -36,7 +36,7 @@ internal static partial class NCrypt
         internal static extern ErrorCode NCryptDeleteKey(SafeNCryptKeyHandle hKey, int dwFlags);
 
         [DllImport(Interop.Libraries.NCrypt, CharSet = CharSet.Unicode)]
-        internal static extern ErrorCode NCryptCreatePersistedKey(SafeNCryptProviderHandle hProvider, out SafeNCryptKeyHandle phKey, string pszAlgId, string pszKeyName, int dwLegacyKeySpec, CngKeyCreationOptions dwFlags);
+        internal static extern ErrorCode NCryptCreatePersistedKey(SafeNCryptProviderHandle hProvider, out SafeNCryptKeyHandle phKey, string pszAlgId, string? pszKeyName, int dwLegacyKeySpec, CngKeyCreationOptions dwFlags);
 
         [DllImport(Interop.Libraries.NCrypt, CharSet = CharSet.Unicode)]
         internal static extern ErrorCode NCryptFinalizeKey(SafeNCryptKeyHandle hKey, int dwFlags);
diff --git a/src/libraries/Common/src/Interop/Windows/NCrypt/Interop.NCryptDeriveKeyMaterial.cs b/src/libraries/Common/src/Interop/Windows/NCrypt/Interop.NCryptDeriveKeyMaterial.cs
index 1aebafb6b2ba01..14e2c29e9e4df9 100644
--- a/src/libraries/Common/src/Interop/Windows/NCrypt/Interop.NCryptDeriveKeyMaterial.cs
+++ b/src/libraries/Common/src/Interop/Windows/NCrypt/Interop.NCryptDeriveKeyMaterial.cs
@@ -21,7 +21,7 @@ private static extern ErrorCode NCryptDeriveKey(
             SafeNCryptSecretHandle hSharedSecret,
             string pwszKDF,
             [In] ref NCryptBufferDesc pParameterList,
-            [Out, MarshalAs(UnmanagedType.LPArray)] byte[] pbDerivedKey,
+            [Out, MarshalAs(UnmanagedType.LPArray)] byte[]? pbDerivedKey,
             int cbDerivedKey,
             [Out] out int pcbResult,
             SecretAgreementFlags dwFlags);
@@ -34,9 +34,9 @@ private static byte[] DeriveKeyMaterial(
             SafeNCryptSecretHandle secretAgreement,
             string kdf,
             string hashAlgorithm,
-            byte[] hmacKey,
-            byte[] secretPrepend,
-            byte[] secretAppend,
+            byte[]? hmacKey,
+            byte[]? secretPrepend,
+            byte[]? secretAppend,
             SecretAgreementFlags flags)
         {
             // First marshal the hash algoritm
@@ -68,7 +68,7 @@ private static byte[] DeriveKeyMaterial(
                         if (pHmacKey != null)
                         {
                             NCryptBuffer hmacKeyBuffer = default;
-                            hmacKeyBuffer.cbBuffer = hmacKey.Length;
+                            hmacKeyBuffer.cbBuffer = hmacKey!.Length;
                             hmacKeyBuffer.BufferType = BufferType.KdfHmacKey;
                             hmacKeyBuffer.pvBuffer = new IntPtr(pHmacKey);
 
@@ -79,7 +79,7 @@ private static byte[] DeriveKeyMaterial(
                         if (pSecretPrepend != null)
                         {
                             NCryptBuffer secretPrependBuffer = default;
-                            secretPrependBuffer.cbBuffer = secretPrepend.Length;
+                            secretPrependBuffer.cbBuffer = secretPrepend!.Length;
                             secretPrependBuffer.BufferType = BufferType.KdfSecretPrepend;
                             secretPrependBuffer.pvBuffer = new IntPtr(pSecretPrepend);
 
@@ -90,7 +90,7 @@ private static byte[] DeriveKeyMaterial(
                         if (pSecretAppend != null)
                         {
                             NCryptBuffer secretAppendBuffer = default;
-                            secretAppendBuffer.cbBuffer = secretAppend.Length;
+                            secretAppendBuffer.cbBuffer = secretAppend!.Length;
                             secretAppendBuffer.BufferType = BufferType.KdfSecretAppend;
                             secretAppendBuffer.pvBuffer = new IntPtr(pSecretAppend);
 
@@ -175,8 +175,8 @@ private static unsafe byte[] DeriveKeyMaterial(
         internal static byte[] DeriveKeyMaterialHash(
             SafeNCryptSecretHandle secretAgreement,
             string hashAlgorithm,
-            byte[] secretPrepend,
-            byte[] secretAppend,
+            byte[]? secretPrepend,
+            byte[]? secretAppend,
             SecretAgreementFlags flags)
         {
             return DeriveKeyMaterial(
@@ -195,9 +195,9 @@ internal static byte[] DeriveKeyMaterialHash(
         internal static byte[] DeriveKeyMaterialHmac(
             SafeNCryptSecretHandle secretAgreement,
             string hashAlgorithm,
-            byte[] hmacKey,
-            byte[] secretPrepend,
-            byte[] secretAppend,
+            byte[]? hmacKey,
+            byte[]? secretPrepend,
+            byte[]? secretAppend,
             SecretAgreementFlags flags)
         {
             return DeriveKeyMaterial(
diff --git a/src/libraries/Common/src/Microsoft/Win32/SafeHandles/SafeHandleCache.cs b/src/libraries/Common/src/Microsoft/Win32/SafeHandles/SafeHandleCache.cs
index eea60acedbed46..37ee704c1d9619 100644
--- a/src/libraries/Common/src/Microsoft/Win32/SafeHandles/SafeHandleCache.cs
+++ b/src/libraries/Common/src/Microsoft/Win32/SafeHandles/SafeHandleCache.cs
@@ -13,7 +13,7 @@ namespace Microsoft.Win32.SafeHandles
     /// <typeparam name="T">Specifies the type of SafeHandle.</typeparam>
     internal static class SafeHandleCache<T> where T : SafeHandle
     {
-        private static T s_invalidHandle;
+        private static T? s_invalidHandle;
 
         /// <summary>
         /// Gets a cached, invalid handle.  As the instance is cached, it should either never be Disposed
@@ -22,7 +22,7 @@ internal static class SafeHandleCache<T> where T : SafeHandle
         /// </summary>
         internal static T GetInvalidHandle(Func<T> invalidHandleFactory)
         {
-            T currentHandle = Volatile.Read(ref s_invalidHandle);
+            T? currentHandle = Volatile.Read(ref s_invalidHandle);
             if (currentHandle == null)
             {
                 T newHandle = invalidHandleFactory();
diff --git a/src/libraries/Common/src/System/Security/Cryptography/Asn1/AlgorithmIdentifierAsn.manual.cs b/src/libraries/Common/src/System/Security/Cryptography/Asn1/AlgorithmIdentifierAsn.manual.cs
index f35038735b4659..7235166ab5bee5 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/Asn1/AlgorithmIdentifierAsn.manual.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/Asn1/AlgorithmIdentifierAsn.manual.cs
@@ -30,7 +30,7 @@ internal bool Equals(ref AlgorithmIdentifierAsn other)
                 return true;
             }
 
-            return Parameters.Value.Span.SequenceEqual(other.Parameters.Value.Span);
+            return Parameters!.Value.Span.SequenceEqual(other.Parameters!.Value.Span);
         }
 
         internal bool HasNullEquivalentParameters()
diff --git a/src/libraries/Common/src/System/Security/Cryptography/Asn1/ECDomainParameters.xml.cs b/src/libraries/Common/src/System/Security/Cryptography/Asn1/ECDomainParameters.xml.cs
index b0a82121b0a69f..f0870c5aa98858 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/Asn1/ECDomainParameters.xml.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/Asn1/ECDomainParameters.xml.cs
@@ -22,7 +22,7 @@ static ECDomainParameters()
             var usedTags = new System.Collections.Generic.Dictionary<Asn1Tag, string>();
             Action<Asn1Tag, string> ensureUniqueTag = (tag, fieldName) =>
             {
-                if (usedTags.TryGetValue(tag, out string existing))
+                if (usedTags.TryGetValue(tag, out string? existing))
                 {
                     throw new InvalidOperationException($"Tag '{tag}' is in use by both '{existing}' and '{fieldName}'");
                 }
diff --git a/src/libraries/Common/src/System/Security/Cryptography/Asn1/Pbkdf2SaltChoice.xml.cs b/src/libraries/Common/src/System/Security/Cryptography/Asn1/Pbkdf2SaltChoice.xml.cs
index 2c4ca85e9ac9b8..fe33ea331d1852 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/Asn1/Pbkdf2SaltChoice.xml.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/Asn1/Pbkdf2SaltChoice.xml.cs
@@ -22,7 +22,7 @@ static Pbkdf2SaltChoice()
             var usedTags = new System.Collections.Generic.Dictionary<Asn1Tag, string>();
             Action<Asn1Tag, string> ensureUniqueTag = (tag, fieldName) =>
             {
-                if (usedTags.TryGetValue(tag, out string existing))
+                if (usedTags.TryGetValue(tag, out string? existing))
                 {
                     throw new InvalidOperationException($"Tag '{tag}' is in use by both '{existing}' and '{fieldName}'");
                 }
diff --git a/src/libraries/Common/src/System/Security/Cryptography/CngPkcs8.cs b/src/libraries/Common/src/System/Security/Cryptography/CngPkcs8.cs
index 6316db7a815ed8..29c41cbc54d136 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/CngPkcs8.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/CngPkcs8.cs
@@ -151,7 +151,7 @@ internal static unsafe Pkcs8Response ImportEncryptedPkcs8PrivateKey(
                     finally
                     {
                         CryptographicOperations.ZeroMemory(decryptedSpan);
-                        CryptoPool.Return(decrypted.Array);
+                        CryptoPool.Return(decrypted.Array!);
                     }
                 }
             }
@@ -203,7 +203,7 @@ internal static unsafe Pkcs8Response ImportEncryptedPkcs8PrivateKey(
                     finally
                     {
                         CryptographicOperations.ZeroMemory(decryptedSpan);
-                        CryptoPool.Return(decrypted.Array, clearSize: 0);
+                        CryptoPool.Return(decrypted.Array!, clearSize: 0);
                     }
                 }
             }
diff --git a/src/libraries/Common/src/System/Security/Cryptography/DSACng.ImportExport.cs b/src/libraries/Common/src/System/Security/Cryptography/DSACng.ImportExport.cs
index 3f7a4ac203083f..d948132c50cd79 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/DSACng.ImportExport.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/DSACng.ImportExport.cs
@@ -43,7 +43,7 @@ public override void ImportParameters(DSAParameters parameters)
                 if (parameters.G.Length != keySizeInBytes || parameters.Y.Length != keySizeInBytes)
                     throw new ArgumentException(SR.Cryptography_InvalidDsaParameters_MismatchedPGY);
 
-                if (hasPrivateKey && parameters.X.Length != parameters.Q.Length)
+                if (hasPrivateKey && parameters.X!.Length != parameters.Q.Length)
                     throw new ArgumentException(SR.Cryptography_InvalidDsaParameters_MismatchedQX);
 
                 byte[] blob;
@@ -232,7 +232,7 @@ private static void GenerateV1DsaBlob(out byte[] blob, DSAParameters parameters,
                         Interop.BCrypt.Emit(blob, ref offset, parameters.Y);
                         if (includePrivate)
                         {
-                            Interop.BCrypt.Emit(blob, ref offset, parameters.X);
+                            Interop.BCrypt.Emit(blob, ref offset, parameters.X!);
                         }
 
                         Debug.Assert(offset == blobSize, $"Expected offset = blobSize, got {offset} != {blobSize}");
@@ -261,7 +261,7 @@ private static void GenerateV2DsaBlob(out byte[] blob, DSAParameters parameters,
                         parameters.P.Length +
                         parameters.G.Length +
                         parameters.Y.Length +
-                        (includePrivateParameters ? parameters.X.Length : 0);
+                        (includePrivateParameters ? parameters.X!.Length : 0);
 
                     blob = new byte[blobSize];
                     fixed (byte* pDsaBlob = &blob[0])
@@ -317,7 +317,7 @@ private static void GenerateV2DsaBlob(out byte[] blob, DSAParameters parameters,
 
                         if (includePrivateParameters)
                         {
-                            Interop.BCrypt.Emit(blob, ref offset, parameters.X);
+                            Interop.BCrypt.Emit(blob, ref offset, parameters.X!);
                         }
 
                         Debug.Assert(offset == blobSize, $"Expected offset = blobSize, got {offset} != {blobSize}");
diff --git a/src/libraries/Common/src/System/Security/Cryptography/DSACng.cs b/src/libraries/Common/src/System/Security/Cryptography/DSACng.cs
index f9e716ab952bac..98c96b9ad53ff0 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/DSACng.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/DSACng.cs
@@ -45,7 +45,7 @@ public override KeySizes[] LegalKeySizes
             }
 
             public override string SignatureAlgorithm => "DSA";
-            public override string KeyExchangeAlgorithm => null;
+            public override string? KeyExchangeAlgorithm => null;
 
             // Need to override since base methods throw a "override me" exception: makes SignData/VerifyData function.
             protected override byte[] HashData(byte[] data, int offset, int count, HashAlgorithmName hashAlgorithm) =>
diff --git a/src/libraries/Common/src/System/Security/Cryptography/DSAKeyFormatHelper.cs b/src/libraries/Common/src/System/Security/Cryptography/DSAKeyFormatHelper.cs
index 12a128e1dc090d..023c09fc60d31a 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/DSAKeyFormatHelper.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/DSAKeyFormatHelper.cs
@@ -183,7 +183,7 @@ private static void WriteAlgorithmId(AsnWriter writer, in DSAParameters dsaParam
             writer.PopSequence();
         }
 
-        private static void WriteKeyComponent(AsnWriter writer, byte[] component, bool bitString)
+        private static void WriteKeyComponent(AsnWriter writer, byte[]? component, bool bitString)
         {
             using (AsnWriter inner = new AsnWriter(AsnEncodingRules.DER))
             {
diff --git a/src/libraries/Common/src/System/Security/Cryptography/DSAOpenSsl.cs b/src/libraries/Common/src/System/Security/Cryptography/DSAOpenSsl.cs
index 90bad69c4e2013..fc0baf6beb4385 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/DSAOpenSsl.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/DSAOpenSsl.cs
@@ -103,7 +103,7 @@ public override void ImportParameters(DSAParameters parameters)
                 if (parameters.G.Length != keySize || parameters.Y.Length != keySize)
                     throw new ArgumentException(SR.Cryptography_InvalidDsaParameters_MismatchedPGY);
 
-                if (hasPrivateKey && parameters.X.Length != parameters.Q.Length)
+                if (hasPrivateKey && parameters.X!.Length != parameters.Q.Length)
                     throw new ArgumentException(SR.Cryptography_InvalidDsaParameters_MismatchedQX);
 
                 ThrowIfDisposed();
@@ -146,7 +146,7 @@ protected override void Dispose(bool disposing)
                 if (disposing)
                 {
                     FreeKey();
-                    _key = null;
+                    _key = null!;
                 }
 
                 base.Dispose(disposing);
diff --git a/src/libraries/Common/src/System/Security/Cryptography/DSASecurityTransforms.cs b/src/libraries/Common/src/System/Security/Cryptography/DSASecurityTransforms.cs
index 92177fa0f7e3f2..2192a8079ca746 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/DSASecurityTransforms.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/DSASecurityTransforms.cs
@@ -26,7 +26,7 @@ internal static partial class DSAImplementation
         {
             public sealed partial class DSASecurityTransforms : DSA
             {
-                private SecKeyPair _keys;
+                private SecKeyPair? _keys;
                 private bool _disposed;
 
                 public DSASecurityTransforms()
@@ -144,7 +144,7 @@ public override void ImportParameters(DSAParameters parameters)
                     if (parameters.G.Length != keySize || parameters.Y.Length != keySize)
                         throw new ArgumentException(SR.Cryptography_InvalidDsaParameters_MismatchedPGY);
 
-                    if (hasPrivateKey && parameters.X.Length != parameters.Q.Length)
+                    if (hasPrivateKey && parameters.X!.Length != parameters.Q.Length)
                         throw new ArgumentException(SR.Cryptography_InvalidDsaParameters_MismatchedQX);
 
                     if (!(8 * parameters.P.Length).IsLegalSize(LegalKeySizes))
@@ -353,7 +353,7 @@ internal SecKeyPair GetKeys()
                 {
                     ThrowIfDisposed();
 
-                    SecKeyPair current = _keys;
+                    SecKeyPair? current = _keys;
 
                     if (current != null)
                     {
@@ -372,7 +372,7 @@ private void SetKey(SecKeyPair newKeyPair)
                 {
                     ThrowIfDisposed();
 
-                    SecKeyPair current = _keys;
+                    SecKeyPair? current = _keys;
                     _keys = newKeyPair;
                     current?.Dispose();
 
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECCng.HashAlgorithm.cs b/src/libraries/Common/src/System/Security/Cryptography/ECCng.HashAlgorithm.cs
index 1ab060284e9b96..793435238124e1 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECCng.HashAlgorithm.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECCng.HashAlgorithm.cs
@@ -15,7 +15,7 @@ internal static partial class ECCng
         /// </summary>
         internal static Interop.BCrypt.ECC_CURVE_ALG_ID_ENUM GetHashAlgorithmId(HashAlgorithmName? name)
         {
-            if (name.HasValue == false || string.IsNullOrEmpty(name.Value.Name))
+            if (name.HasValue == false || string.IsNullOrEmpty(name!.Value.Name))
             {
                 return Interop.BCrypt.ECC_CURVE_ALG_ID_ENUM.BCRYPT_NO_CURVE_GENERATION_ALG_ID;
             }
@@ -52,7 +52,7 @@ internal static Interop.BCrypt.ECC_CURVE_ALG_ID_ENUM GetHashAlgorithmId(HashAlgo
         /// <summary>
         /// Is the curve named, or once of the special nist curves
         /// </summary>
-        internal static bool IsECNamedCurve(string algorithm)
+        internal static bool IsECNamedCurve(string? algorithm)
         {
             return (algorithm == BCryptNative.AlgorithmName.ECDH ||
                     algorithm == BCryptNative.AlgorithmName.ECDsa);
@@ -61,7 +61,7 @@ internal static bool IsECNamedCurve(string algorithm)
         /// <summary>
         /// Maps algorithm to curve name accounting for the special nist curves
         /// </summary>
-        internal static string SpecialNistAlgorithmToCurveName(string algorithm, out string oidValue)
+        internal static string SpecialNistAlgorithmToCurveName(string? algorithm, out string oidValue)
         {
             switch (algorithm)
             {
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECCng.ImportExport.cs b/src/libraries/Common/src/System/Security/Cryptography/ECCng.ImportExport.cs
index f1e98f9362316c..5ec3c9b72ddbbb 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECCng.ImportExport.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECCng.ImportExport.cs
@@ -38,7 +38,7 @@ internal static byte[] GetNamedCurveBlob(ref ECParameters parameters, bool ecdh)
                     parameters.Q.Y.Length;
                 if (includePrivateParameters)
                 {
-                    blobSize += parameters.D.Length;
+                    blobSize += parameters.D!.Length;
                 }
 
                 blob = new byte[blobSize];
@@ -57,7 +57,7 @@ internal static byte[] GetNamedCurveBlob(ref ECParameters parameters, bool ecdh)
                     Interop.BCrypt.Emit(blob, ref offset, parameters.Q.Y);
                     if (includePrivateParameters)
                     {
-                        Interop.BCrypt.Emit(blob, ref offset, parameters.D);
+                        Interop.BCrypt.Emit(blob, ref offset, parameters.D!);
                     }
 
                     // We better have computed the right allocation size above!
@@ -98,14 +98,14 @@ internal static byte[] GetPrimeCurveBlob(ref ECParameters parameters, bool ecdh)
                     curve.G.X.Length +
                     curve.G.Y.Length +
                     curve.Order.Length +
-                    curve.Cofactor.Length +
+                    curve.Cofactor!.Length +
                     (curve.Seed == null ? 0 : curve.Seed.Length) +
                     parameters.Q.X.Length +
                     parameters.Q.Y.Length;
 
                 if (includePrivateParameters)
                 {
-                    blobSize += parameters.D.Length;
+                    blobSize += parameters.D!.Length;
                 }
 
                 blob = new byte[blobSize];
@@ -141,7 +141,7 @@ internal static byte[] GetPrimeCurveBlob(ref ECParameters parameters, bool ecdh)
                     Interop.BCrypt.Emit(blob, ref offset, parameters.Q.Y);
                     if (includePrivateParameters)
                     {
-                        Interop.BCrypt.Emit(blob, ref offset, parameters.D);
+                        Interop.BCrypt.Emit(blob, ref offset, parameters.D!);
                     }
 
                     // We better have computed the right allocation size above!
@@ -284,7 +284,7 @@ internal static byte[] GetPrimeCurveParameterBlob(ref ECCurve curve)
                     curve.G.X.Length +
                     curve.G.Y.Length +
                     curve.Order.Length +
-                    curve.Cofactor.Length +
+                    curve.Cofactor!.Length +
                     (curve.Seed == null ? 0 : curve.Seed.Length);
 
                 byte[] blob = new byte[blobSize];
@@ -386,7 +386,7 @@ private static bool IsMagicValueOfKeyPublic(KeyBlobMagicNumber magic)
         /// to the pre-Win10 magic numbers to support import on pre-Win10 environments
         /// that don't have the named curve functionality.
         /// </summary>
-        private static KeyBlobMagicNumber EcdsaCurveNameToMagicNumber(string name, bool includePrivateParameters) =>
+        private static KeyBlobMagicNumber EcdsaCurveNameToMagicNumber(string? name, bool includePrivateParameters) =>
             EcdsaCurveNameToAlgorithm(name) switch
             {
                 AlgorithmName.ECDsaP256 => includePrivateParameters ?
@@ -411,7 +411,7 @@ private static KeyBlobMagicNumber EcdsaCurveNameToMagicNumber(string name, bool
         /// to the pre-Win10 magic numbers to support import on pre-Win10 environments
         /// that don't have the named curve functionality.
         /// </summary>
-        private static KeyBlobMagicNumber EcdhCurveNameToMagicNumber(string name, bool includePrivateParameters) =>
+        private static KeyBlobMagicNumber EcdhCurveNameToMagicNumber(string? name, bool includePrivateParameters) =>
             EcdhCurveNameToAlgorithm(name) switch
             {
                 AlgorithmName.ECDHP256 => includePrivateParameters ?
@@ -520,7 +520,7 @@ ref MemoryMarshal.GetReference(keyBlob),
         /// Map a curve name to algorithm. This enables curves that worked pre-Win10
         /// to work with newer APIs for import and export.
         /// </summary>
-        internal static string EcdsaCurveNameToAlgorithm(string algorithm)
+        internal static string EcdsaCurveNameToAlgorithm(string? algorithm)
         {
             switch (algorithm)
             {
@@ -545,7 +545,7 @@ internal static string EcdsaCurveNameToAlgorithm(string algorithm)
         /// Map a curve name to algorithm. This enables curves that worked pre-Win10
         /// to work with newer APIs for import and export.
         /// </summary>
-        internal static string EcdhCurveNameToAlgorithm(string algorithm)
+        internal static string EcdhCurveNameToAlgorithm(string? algorithm)
         {
             switch (algorithm)
             {
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanCng.ImportExport.cs b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanCng.ImportExport.cs
index ce4dae3ba98b72..962dc1254041f0 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanCng.ImportExport.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanCng.ImportExport.cs
@@ -64,8 +64,8 @@ public override ECParameters ExportParameters(bool includePrivateParameters)
             {
                 ECParameters ecparams = default;
 
-                string curveName = GetCurveName(out string oidValue);
-                byte[] blob = null;
+                string? curveName = GetCurveName(out string? oidValue);
+                byte[]? blob = null;
 
                 try
                 {
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanCng.cs b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanCng.cs
index 14622329fef2fa..989b7a58dffd33 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanCng.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanCng.cs
@@ -74,8 +74,8 @@ public override KeySizes[] LegalKeySizes
             public override byte[] DeriveKeyFromHash(
                 ECDiffieHellmanPublicKey otherPartyPublicKey,
                 HashAlgorithmName hashAlgorithm,
-                byte[] secretPrepend,
-                byte[] secretAppend)
+                byte[]? secretPrepend,
+                byte[]? secretAppend)
             {
                 if (otherPartyPublicKey == null)
                     throw new ArgumentNullException(nameof(otherPartyPublicKey));
@@ -96,9 +96,9 @@ public override byte[] DeriveKeyFromHash(
             public override byte[] DeriveKeyFromHmac(
                 ECDiffieHellmanPublicKey otherPartyPublicKey,
                 HashAlgorithmName hashAlgorithm,
-                byte[] hmacKey,
-                byte[] secretPrepend,
-                byte[] secretAppend)
+                byte[]? hmacKey,
+                byte[]? secretPrepend,
+                byte[]? secretAppend)
             {
                 if (otherPartyPublicKey == null)
                     throw new ArgumentNullException(nameof(otherPartyPublicKey));
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanDerivation.cs b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanDerivation.cs
index 636b26c2d22ea3..2f011385b13cd7 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanDerivation.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanDerivation.cs
@@ -12,7 +12,7 @@ internal static class ECDiffieHellmanDerivation
         /// <summary>
         /// Derive the raw ECDH value into <paramref name="hasher"/>, if present, otherwise returning the value.
         /// </summary>
-        internal delegate byte[] DeriveSecretAgreement(ECDiffieHellmanPublicKey otherPartyPublicKey, IncrementalHash hasher);
+        internal delegate byte[]? DeriveSecretAgreement(ECDiffieHellmanPublicKey otherPartyPublicKey, IncrementalHash? hasher);
 
         internal static byte[] DeriveKeyFromHash(
             ECDiffieHellmanPublicKey otherPartyPublicKey,
@@ -28,7 +28,7 @@ internal static byte[] DeriveKeyFromHash(
             {
                 hash.AppendData(secretPrepend);
 
-                byte[] secretAgreement = deriveSecretAgreement(otherPartyPublicKey, hash);
+                byte[]? secretAgreement = deriveSecretAgreement(otherPartyPublicKey, hash);
                 // We want the side effect, and it should not have returned the answer.
                 Debug.Assert(secretAgreement == null);
 
@@ -41,7 +41,7 @@ internal static byte[] DeriveKeyFromHash(
         internal static unsafe byte[] DeriveKeyFromHmac(
             ECDiffieHellmanPublicKey otherPartyPublicKey,
             HashAlgorithmName hashAlgorithm,
-            byte[] hmacKey,
+            byte[]? hmacKey,
             ReadOnlySpan<byte> secretPrepend,
             ReadOnlySpan<byte> secretAppend,
             DeriveSecretAgreement deriveSecretAgreement)
@@ -60,8 +60,8 @@ internal static unsafe byte[] DeriveKeyFromHmac(
             if (useSecretAsKey)
             {
                 hmacKey = deriveSecretAgreement(otherPartyPublicKey, null);
-                Debug.Assert(hmacKey != null);
             }
+            Debug.Assert(hmacKey != null);
 
             // Reduce the likelihood of the value getting copied during heap compaction.
             fixed (byte* pinnedHmacKey = hmacKey)
@@ -78,7 +78,7 @@ internal static unsafe byte[] DeriveKeyFromHmac(
                         }
                         else
                         {
-                            byte[] secretAgreement = deriveSecretAgreement(otherPartyPublicKey, hash);
+                            byte[]? secretAgreement = deriveSecretAgreement(otherPartyPublicKey, hash);
                             // We want the side effect, and it should not have returned the answer.
                             Debug.Assert(secretAgreement == null);
                         }
@@ -117,7 +117,7 @@ internal static unsafe byte[] DeriveKeyTls(
             const int Sha1Size = 20;
             const int Md5Size = 16;
 
-            byte[] secretAgreement = deriveSecretAgreement(otherPartyPublicKey, null);
+            byte[]? secretAgreement = deriveSecretAgreement(otherPartyPublicKey, null);
             Debug.Assert(secretAgreement != null);
 
             // Reduce the likelihood of the value getting copied during heap compaction.
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSsl.Derive.cs b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSsl.Derive.cs
index 30a81b6fb9c37f..c4eba4302fb26f 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSsl.Derive.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSsl.Derive.cs
@@ -22,8 +22,8 @@ public override byte[] DeriveKeyMaterial(ECDiffieHellmanPublicKey otherPartyPubl
             public override byte[] DeriveKeyFromHash(
                 ECDiffieHellmanPublicKey otherPartyPublicKey,
                 HashAlgorithmName hashAlgorithm,
-                byte[] secretPrepend,
-                byte[] secretAppend)
+                byte[]? secretPrepend,
+                byte[]? secretAppend)
             {
                 if (otherPartyPublicKey == null)
                     throw new ArgumentNullException(nameof(otherPartyPublicKey));
@@ -43,9 +43,9 @@ public override byte[] DeriveKeyFromHash(
             public override byte[] DeriveKeyFromHmac(
                 ECDiffieHellmanPublicKey otherPartyPublicKey,
                 HashAlgorithmName hashAlgorithm,
-                byte[] hmacKey,
-                byte[] secretPrepend,
-                byte[] secretAppend)
+                byte[]? hmacKey,
+                byte[]? secretPrepend,
+                byte[]? secretAppend)
             {
                 if (otherPartyPublicKey == null)
                     throw new ArgumentNullException(nameof(otherPartyPublicKey));
@@ -84,7 +84,7 @@ public override byte[] DeriveKeyTls(ECDiffieHellmanPublicKey otherPartyPublicKey
             /// <summary>
             /// Get the secret agreement generated between two parties
             /// </summary>
-            private byte[] DeriveSecretAgreement(ECDiffieHellmanPublicKey otherPartyPublicKey, IncrementalHash hasher)
+            private byte[]? DeriveSecretAgreement(ECDiffieHellmanPublicKey otherPartyPublicKey, IncrementalHash? hasher)
             {
                 Debug.Assert(otherPartyPublicKey != null);
 
@@ -92,7 +92,7 @@ private byte[] DeriveSecretAgreement(ECDiffieHellmanPublicKey otherPartyPublicKe
                 // which will throw an OpenSslCryptoException if no private key is available
                 ECParameters thisKeyExplicit = ExportExplicitParameters(true);
                 bool thisIsNamed = Interop.Crypto.EcKeyHasCurveName(_key.Value);
-                ECDiffieHellmanOpenSslPublicKey otherKey = otherPartyPublicKey as ECDiffieHellmanOpenSslPublicKey;
+                ECDiffieHellmanOpenSslPublicKey? otherKey = otherPartyPublicKey as ECDiffieHellmanOpenSslPublicKey;
                 bool disposeOtherKey = false;
 
                 if (otherKey == null)
@@ -109,9 +109,9 @@ private byte[] DeriveSecretAgreement(ECDiffieHellmanPublicKey otherPartyPublicKe
 
                 bool otherIsNamed = otherKey.HasCurveName;
 
-                SafeEvpPKeyHandle ourKey = null;
-                SafeEvpPKeyHandle theirKey = null;
-                byte[] rented = null;
+                SafeEvpPKeyHandle? ourKey = null;
+                SafeEvpPKeyHandle? theirKey = null;
+                byte[]? rented = null;
                 int secretLength = 0;
 
                 try
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSsl.cs b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSsl.cs
index c82ece03658ff5..ffb24db56d42b3 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSsl.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSsl.cs
@@ -42,7 +42,7 @@ protected override void Dispose(bool disposing)
                 if (disposing)
                 {
                     _key?.Dispose();
-                    _key = null;
+                    _key = null!;
                 }
 
                 base.Dispose(disposing);
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSslPublicKey.cs b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSslPublicKey.cs
index 3bde2dd38957e5..3977421402050b 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSslPublicKey.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSslPublicKey.cs
@@ -70,7 +70,7 @@ protected override void Dispose(bool disposing)
                 if (disposing)
                 {
                     _key?.Dispose();
-                    _key = null;
+                    _key = null!;
                 }
 
                 base.Dispose(disposing);
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanSecurityTransforms.cs b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanSecurityTransforms.cs
index 347c55d59f3dfe..6c02379fd19be2 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanSecurityTransforms.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanSecurityTransforms.cs
@@ -126,8 +126,8 @@ public override byte[] DeriveKeyMaterial(ECDiffieHellmanPublicKey otherPartyPubl
             public override byte[] DeriveKeyFromHash(
                 ECDiffieHellmanPublicKey otherPartyPublicKey,
                 HashAlgorithmName hashAlgorithm,
-                byte[] secretPrepend,
-                byte[] secretAppend)
+                byte[]? secretPrepend,
+                byte[]? secretAppend)
             {
                 if (otherPartyPublicKey == null)
                     throw new ArgumentNullException(nameof(otherPartyPublicKey));
@@ -147,9 +147,9 @@ public override byte[] DeriveKeyFromHash(
             public override byte[] DeriveKeyFromHmac(
                 ECDiffieHellmanPublicKey otherPartyPublicKey,
                 HashAlgorithmName hashAlgorithm,
-                byte[] hmacKey,
-                byte[] secretPrepend,
-                byte[] secretAppend)
+                byte[]? hmacKey,
+                byte[]? secretPrepend,
+                byte[]? secretAppend)
             {
                 if (otherPartyPublicKey == null)
                     throw new ArgumentNullException(nameof(otherPartyPublicKey));
@@ -186,7 +186,7 @@ public override byte[] DeriveKeyTls(ECDiffieHellmanPublicKey otherPartyPublicKey
                     (pubKey, hasher) => DeriveSecretAgreement(pubKey, hasher));
             }
 
-            private byte[] DeriveSecretAgreement(ECDiffieHellmanPublicKey otherPartyPublicKey, IncrementalHash hasher)
+            private byte[]? DeriveSecretAgreement(ECDiffieHellmanPublicKey otherPartyPublicKey, IncrementalHash? hasher)
             {
                 if (!(otherPartyPublicKey is ECDiffieHellmanSecurityTransformsPublicKey secTransPubKey))
                 {
@@ -205,7 +205,7 @@ private byte[] DeriveSecretAgreement(ECDiffieHellmanPublicKey otherPartyPublicKe
                             nameof(otherPartyPublicKey));
                     }
 
-                    SafeSecKeyRefHandle thisPrivate = GetKeys().PrivateKey;
+                    SafeSecKeyRefHandle? thisPrivate = GetKeys().PrivateKey;
 
                     if (thisPrivate == null)
                     {
@@ -216,7 +216,7 @@ private byte[] DeriveSecretAgreement(ECDiffieHellmanPublicKey otherPartyPublicKe
                     // 66 bytes ((521 + 7) / 8), the Span path will always succeed.
                     Span<byte> secretSpan = stackalloc byte[66];
 
-                    byte[] secret = Interop.AppleCrypto.EcdhKeyAgree(
+                    byte[]? secret = Interop.AppleCrypto.EcdhKeyAgree(
                         thisPrivate,
                         otherPublic,
                         secretSpan,
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECDsaCng.ImportExport.cs b/src/libraries/Common/src/System/Security/Cryptography/ECDsaCng.ImportExport.cs
index 03814d89b9d6ec..068b7fdb1e6799 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECDsaCng.ImportExport.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECDsaCng.ImportExport.cs
@@ -44,7 +44,7 @@ public override void ImportParameters(ECParameters parameters)
                 {
                     // FriendlyName is required; an attempt was already made to default it in ECCurve
                     if (string.IsNullOrEmpty(curve.Oid.FriendlyName))
-                        throw new PlatformNotSupportedException(SR.Format(SR.Cryptography_InvalidCurveOid, curve.Oid.Value.ToString()));
+                        throw new PlatformNotSupportedException(SR.Format(SR.Cryptography_InvalidCurveOid, curve.Oid.Value!.ToString()));
 
                     byte[] ecNamedCurveBlob = ECCng.GetNamedCurveBlob(ref parameters, ecdh: false);
                     ImportKeyBlob(ecNamedCurveBlob, curve.Oid.FriendlyName, includePrivateParameters);
@@ -85,7 +85,7 @@ public override ECParameters ExportParameters(bool includePrivateParameters)
             {
                 ECParameters ecparams = default;
 
-                string curveName = GetCurveName(out string oidValue);
+                string? curveName = GetCurveName(out string? oidValue);
 
                 if (string.IsNullOrEmpty(curveName))
                 {
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECDsaOpenSsl.cs b/src/libraries/Common/src/System/Security/Cryptography/ECDsaOpenSsl.cs
index a87059ac1b63fb..a95b3dbb90142f 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECDsaOpenSsl.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECDsaOpenSsl.cs
@@ -169,7 +169,7 @@ protected override void Dispose(bool disposing)
                 if (disposing)
                 {
                     _key?.Dispose();
-                    _key = null;
+                    _key = null!;
                 }
 
                 base.Dispose(disposing);
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.ImportExport.cs b/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.ImportExport.cs
index f6b4bcb8493acb..2ea1cf9f9602f6 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.ImportExport.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.ImportExport.cs
@@ -109,7 +109,7 @@ private static SafeEcKeyHandle ImportNamedCurveParameters(ECParameters parameter
 
             // Use oid Value first if present, otherwise FriendlyName
             string oid = !string.IsNullOrEmpty(parameters.Curve.Oid.Value) ?
-                parameters.Curve.Oid.Value : parameters.Curve.Oid.FriendlyName;
+                parameters.Curve.Oid.Value : parameters.Curve.Oid.FriendlyName!;
 
             SafeEcKeyHandle key = Interop.Crypto.EcKeyCreateByKeyParameters(
                 oid,
@@ -134,7 +134,7 @@ private static SafeEcKeyHandle ImportPrimeCurveParameters(ECParameters parameter
                 parameters.Curve.G.X, parameters.Curve.G.X.Length,
                 parameters.Curve.G.Y, parameters.Curve.G.Y.Length,
                 parameters.Curve.Order, parameters.Curve.Order.Length,
-                parameters.Curve.Cofactor, parameters.Curve.Cofactor.Length,
+                parameters.Curve.Cofactor, parameters.Curve.Cofactor!.Length,
                 parameters.Curve.Seed, parameters.Curve.Seed == null ? 0 : parameters.Curve.Seed.Length);
 
             return key;
@@ -154,7 +154,7 @@ private static SafeEcKeyHandle ImportCharacteristic2CurveParameters(ECParameters
                 parameters.Curve.G.X, parameters.Curve.G.X.Length,
                 parameters.Curve.G.Y, parameters.Curve.G.Y.Length,
                 parameters.Curve.Order, parameters.Curve.Order.Length,
-                parameters.Curve.Cofactor, parameters.Curve.Cofactor.Length,
+                parameters.Curve.Cofactor, parameters.Curve.Cofactor!.Length,
                 parameters.Curve.Seed, parameters.Curve.Seed == null ? 0 : parameters.Curve.Seed.Length);
 
             return key;
@@ -170,7 +170,7 @@ private static void CheckInvalidKey(SafeEcKeyHandle key)
 
         public static SafeEcKeyHandle GenerateKeyByKeySize(int keySize)
         {
-            string oid = null;
+            string oid;
             switch (keySize)
             {
                 case 256: oid = ECDSA_P256_OID_VALUE; break;
@@ -181,7 +181,7 @@ public static SafeEcKeyHandle GenerateKeyByKeySize(int keySize)
                     throw new InvalidOperationException(SR.Cryptography_InvalidKeySize);
             }
 
-            SafeEcKeyHandle key = Interop.Crypto.EcKeyCreateByOid(oid);
+            SafeEcKeyHandle? key = Interop.Crypto.EcKeyCreateByOid(oid);
 
             if (key == null || key.IsInvalid)
                 throw new PlatformNotSupportedException(SR.Format(SR.Cryptography_CurveNotSupported, oid));
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.cs b/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.cs
index b2e2eb4edf447c..c64e6765dfc064 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.cs
@@ -9,7 +9,7 @@ namespace System.Security.Cryptography
 {
     internal sealed partial class ECOpenSsl : IDisposable
     {
-        private Lazy<SafeEcKeyHandle> _key;
+        private Lazy<SafeEcKeyHandle> _key = null!; // Always initialized
 
         public ECOpenSsl(ECCurve curve)
         {
@@ -86,12 +86,12 @@ internal int GenerateKey(ECCurve curve)
 
             if (curve.IsNamed)
             {
-                string oid = null;
+                string oid;
                 // Use oid Value first if present, otherwise FriendlyName because Oid maintains a hard-coded
                 // cache that may have different casing for FriendlyNames than OpenSsl
-                oid = !string.IsNullOrEmpty(curve.Oid.Value) ? curve.Oid.Value : curve.Oid.FriendlyName;
+                oid = !string.IsNullOrEmpty(curve.Oid.Value) ? curve.Oid.Value : curve.Oid.FriendlyName!;
 
-                SafeEcKeyHandle key = Interop.Crypto.EcKeyCreateByOid(oid);
+                SafeEcKeyHandle? key = Interop.Crypto.EcKeyCreateByOid(oid);
 
                 if (key == null || key.IsInvalid)
                 {
@@ -132,7 +132,7 @@ private void FreeKey()
                     _key.Value?.Dispose();
                 }
 
-                _key = null;
+                _key = null!;
             }
         }
     }
diff --git a/src/libraries/Common/src/System/Security/Cryptography/EccKeyFormatHelper.cs b/src/libraries/Common/src/System/Security/Cryptography/EccKeyFormatHelper.cs
index cae5d7c10f2f48..38844f204f191b 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/EccKeyFormatHelper.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/EccKeyFormatHelper.cs
@@ -138,7 +138,7 @@ internal static void FromECPrivateKey(
             }
             else
             {
-                domainParameters = ECDomainParameters.Decode(algId.Parameters.Value, AsnEncodingRules.DER);
+                domainParameters = ECDomainParameters.Decode(algId.Parameters!.Value, AsnEncodingRules.DER);
             }
 
             ret = new ECParameters
@@ -488,10 +488,11 @@ private static void WriteEcParameters(ECParameters ecParameters, AsnWriter write
                 // On Windows the FriendlyName is populated in places where the Value mightn't be.
                 if (string.IsNullOrEmpty(oid.Value))
                 {
+                    Debug.Assert(oid.FriendlyName != null);
                     oid = Oid.FromFriendlyName(oid.FriendlyName, OidGroup.All);
                 }
 
-                writer.WriteObjectIdentifier(oid.Value);
+                writer.WriteObjectIdentifier(oid.Value!);
             }
             else if (ecParameters.Curve.IsExplicit)
             {
diff --git a/src/libraries/Common/src/System/Security/Cryptography/EccSecurityTransforms.cs b/src/libraries/Common/src/System/Security/Cryptography/EccSecurityTransforms.cs
index 97f2369c717ed4..3965e4ccd18755 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/EccSecurityTransforms.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/EccSecurityTransforms.cs
@@ -12,7 +12,7 @@ namespace System.Security.Cryptography
 {
     internal sealed class EccSecurityTransforms : IDisposable
     {
-        private SecKeyPair _keys;
+        private SecKeyPair? _keys;
         private bool _disposed;
         private readonly string _disposedName;
 
@@ -90,7 +90,7 @@ internal SecKeyPair GetOrGenerateKeys(int keySizeInBits)
         {
             ThrowIfDisposed();
 
-            SecKeyPair current = _keys;
+            SecKeyPair? current = _keys;
 
             if (current != null)
             {
@@ -111,7 +111,7 @@ private void SetKey(SecKeyPair keyPair)
         {
             ThrowIfDisposed();
 
-            SecKeyPair current = _keys;
+            SecKeyPair? current = _keys;
             _keys = keyPair;
             current?.Dispose();
         }
diff --git a/src/libraries/Common/src/System/Security/Cryptography/KeyFormatHelper.cs b/src/libraries/Common/src/System/Security/Cryptography/KeyFormatHelper.cs
index d1b5d68e99d28b..d05b204dc95640 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/KeyFormatHelper.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/KeyFormatHelper.cs
@@ -233,7 +233,7 @@ private static void ReadEncryptedPkcs8<TRet>(
 
                 if (innerRead != decryptedMemory.Length)
                 {
-                    ret = default;
+                    ret = default!;
                     throw new CryptographicException(SR.Cryptography_Der_Invalid_Encoding);
                 }
 
@@ -329,9 +329,9 @@ private static unsafe AsnWriter WriteEncryptedPkcs8(
                 out string encryptionAlgorithmOid,
                 out bool isPkcs12);
 
-            byte[] encryptedRent = null;
+            byte[]? encryptedRent = null;
             Span<byte> encryptedSpan = default;
-            AsnWriter writer = null;
+            AsnWriter? writer = null;
 
             try
             {
@@ -385,7 +385,7 @@ private static unsafe AsnWriter WriteEncryptedPkcs8(
             finally
             {
                 CryptographicOperations.ZeroMemory(encryptedSpan);
-                CryptoPool.Return(encryptedRent, clearSize: 0);
+                CryptoPool.Return(encryptedRent!, clearSize: 0);
 
                 writer?.Dispose();
                 cipher.Dispose();
@@ -485,7 +485,7 @@ internal static AsnWriter ReencryptPkcs8(
             finally
             {
                 CryptographicOperations.ZeroMemory(decrypted);
-                CryptoPool.Return(decrypted.Array, clearSize: 0);
+                CryptoPool.Return(decrypted.Array!, clearSize: 0);
             }
         }
 
@@ -524,7 +524,7 @@ internal static AsnWriter ReencryptPkcs8(
             finally
             {
                 CryptographicOperations.ZeroMemory(decrypted);
-                CryptoPool.Return(decrypted.Array, clearSize: 0);
+                CryptoPool.Return(decrypted.Array!, clearSize: 0);
             }
         }
     }
diff --git a/src/libraries/Common/src/System/Security/Cryptography/PasswordBasedEncryption.cs b/src/libraries/Common/src/System/Security/Cryptography/PasswordBasedEncryption.cs
index c5af8f15ac1b6f..0eba8394c44f40 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/PasswordBasedEncryption.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/PasswordBasedEncryption.cs
@@ -77,7 +77,7 @@ internal static unsafe int Decrypt(
             // Maybe some future PBES3 will have one with a default.
 
             HashAlgorithmName digestAlgorithmName;
-            SymmetricAlgorithm cipher = null;
+            SymmetricAlgorithm? cipher = null;
 
             bool pkcs12 = false;
 
@@ -161,8 +161,8 @@ internal static unsafe int Decrypt(
                 {
                     Span<byte> buf = stackalloc byte[128];
                     ReadOnlySpan<byte> effectivePasswordBytes = stackalloc byte[0];
-                    byte[] rented = null;
-                    System.Text.Encoding encoding = null;
+                    byte[]? rented = null;
+                    System.Text.Encoding? encoding = null;
 
                     if (passwordBytes.Length > 0 || password.Length == 0)
                     {
@@ -299,7 +299,7 @@ internal static unsafe int Encrypt(
             byte[] destination,
             Span<byte> ivDest)
         {
-            byte[] pwdTmpBytes = null;
+            byte[]? pwdTmpBytes = null;
             byte[] derivedKey;
             byte[] iv = cipher.IV;
 
@@ -356,14 +356,14 @@ internal static unsafe int Encrypt(
                 {
                     if (passwordBytes.Length > 0)
                     {
-                        Debug.Assert(pwdTmpBytes.Length == passwordBytes.Length);
+                        Debug.Assert(pwdTmpBytes!.Length == passwordBytes.Length);
                         passwordBytes.CopyTo(pwdTmpBytes);
                     }
                     else if (password.Length > 0)
                     {
                         int length = encoding.GetBytes(password, pwdTmpBytes);
 
-                        if (length != pwdTmpBytes.Length)
+                        if (length != pwdTmpBytes!.Length)
                         {
                             Debug.Fail($"UTF-8 encoding size changed between GetByteCount and GetBytes");
                             throw new CryptographicException();
@@ -371,7 +371,7 @@ internal static unsafe int Encrypt(
                     }
                     else
                     {
-                        Debug.Assert(pwdTmpBytes.Length == 0);
+                        Debug.Assert(pwdTmpBytes!.Length == 0);
                     }
 
                     using (var pbkdf2 = new Rfc2898DeriveBytes(pwdTmpBytes, salt.ToArray(), iterationCount, prf))
@@ -436,8 +436,8 @@ private static unsafe int Pbes2Decrypt(
         {
             Span<byte> buf = stackalloc byte[128];
             ReadOnlySpan<byte> effectivePasswordBytes = stackalloc byte[0];
-            byte[] rented = null;
-            System.Text.Encoding encoding = null;
+            byte[]? rented = null;
+            System.Text.Encoding? encoding = null;
 
             if (passwordBytes.Length > 0 || password.Length == 0)
             {
@@ -547,7 +547,7 @@ private static SymmetricAlgorithm OpenCipher(
             byte? requestedKeyLength,
             ref Span<byte> iv)
         {
-            string algId = encryptionScheme.Algorithm.Value;
+            string? algId = encryptionScheme.Algorithm.Value;
 
             if (algId == Oids.Aes128Cbc ||
                 algId == Oids.Aes192Cbc ||
diff --git a/src/libraries/Common/src/System/Security/Cryptography/Pkcs12Kdf.cs b/src/libraries/Common/src/System/Security/Cryptography/Pkcs12Kdf.cs
index f7f76871fee800..7f41b376d21709 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/Pkcs12Kdf.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/Pkcs12Kdf.cs
@@ -85,7 +85,7 @@ private static void Derive(
             // https://tools.ietf.org/html/rfc7292#appendix-B.2
             Debug.Assert(iterationCount >= 1);
 
-            if (!s_uvLookup.TryGetValue(hashAlgorithm, out Tuple<int, int> uv))
+            if (!s_uvLookup.TryGetValue(hashAlgorithm, out Tuple<int, int>? uv))
             {
                 throw new CryptographicException(SR.Cryptography_UnknownHashAlgorithm, hashAlgorithm.Name);
             }
@@ -128,7 +128,7 @@ private static void Derive(
             // 4.  Set I=S||P to be the concatenation of S and P.
             int ILen = SLen + PLen;
             Span<byte> I = stackalloc byte[0];
-            byte[] IRented = null;
+            byte[]? IRented = null;
 
             if (ILen <= 1024)
             {
diff --git a/src/libraries/Common/src/System/Security/Cryptography/RSACng.ImportExport.cs b/src/libraries/Common/src/System/Security/Cryptography/RSACng.ImportExport.cs
index 79fe528b3516dd..86950a2179739b 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/RSACng.ImportExport.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/RSACng.ImportExport.cs
@@ -104,8 +104,8 @@ public override void ImportParameters(RSAParameters parameters)
                                parameters.Modulus.Length;
                 if (includePrivate)
                 {
-                    blobSize += parameters.P.Length +
-                                parameters.Q.Length;
+                    blobSize += parameters.P!.Length +
+                                parameters.Q!.Length;
                 }
 
                 byte[] rsaBlob = new byte[blobSize];
@@ -120,8 +120,8 @@ public override void ImportParameters(RSAParameters parameters)
 
                     if (includePrivate)
                     {
-                        pBcryptBlob->cbPrime1 = parameters.P.Length;
-                        pBcryptBlob->cbPrime2 = parameters.Q.Length;
+                        pBcryptBlob->cbPrime1 = parameters.P!.Length;
+                        pBcryptBlob->cbPrime2 = parameters.Q!.Length;
                     }
 
                     int offset = sizeof(BCRYPT_RSAKEY_BLOB);
@@ -131,8 +131,8 @@ public override void ImportParameters(RSAParameters parameters)
 
                     if (includePrivate)
                     {
-                        Interop.BCrypt.Emit(rsaBlob, ref offset, parameters.P);
-                        Interop.BCrypt.Emit(rsaBlob, ref offset, parameters.Q);
+                        Interop.BCrypt.Emit(rsaBlob, ref offset, parameters.P!);
+                        Interop.BCrypt.Emit(rsaBlob, ref offset, parameters.Q!);
                     }
 
                     // We better have computed the right allocation size above!
diff --git a/src/libraries/Common/src/System/Security/Cryptography/RSACng.SignVerify.cs b/src/libraries/Common/src/System/Security/Cryptography/RSACng.SignVerify.cs
index 3560eff152ba9c..eca48a1319a07e 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/RSACng.SignVerify.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/RSACng.SignVerify.cs
@@ -35,7 +35,7 @@ private static int GetHashSizeInBytes(HashAlgorithmName hashAlgorithm)
                 hashAlgorithm,
                 alg =>
                 {
-                    using (HashProviderCng hashProvider = new HashProviderCng(alg.Name, null))
+                    using (HashProviderCng hashProvider = new HashProviderCng(alg.Name!, null))
                     {
                         return hashProvider.HashSizeInBytes;
                     }
@@ -52,7 +52,7 @@ public override byte[] SignHash(byte[] hash, HashAlgorithmName hashAlgorithm, RS
                 throw new ArgumentNullException(nameof(hash));
             }
 
-            string hashAlgorithmName = hashAlgorithm.Name;
+            string? hashAlgorithmName = hashAlgorithm.Name;
             if (string.IsNullOrEmpty(hashAlgorithmName))
             {
                 throw new ArgumentException(SR.Cryptography_HashAlgorithmNameNullOrEmpty, nameof(hashAlgorithm));
@@ -99,7 +99,7 @@ public override byte[] SignHash(byte[] hash, HashAlgorithmName hashAlgorithm, RS
 
         public override unsafe bool TrySignHash(ReadOnlySpan<byte> hash, Span<byte> destination, HashAlgorithmName hashAlgorithm, RSASignaturePadding padding, out int bytesWritten)
         {
-            string hashAlgorithmName = hashAlgorithm.Name;
+            string? hashAlgorithmName = hashAlgorithm.Name;
             if (string.IsNullOrEmpty(hashAlgorithmName))
             {
                 throw new ArgumentException(SR.Cryptography_HashAlgorithmNameNullOrEmpty, nameof(hashAlgorithm));
@@ -159,7 +159,7 @@ public override bool VerifyHash(byte[] hash, byte[] signature, HashAlgorithmName
 
         public override unsafe bool VerifyHash(ReadOnlySpan<byte> hash, ReadOnlySpan<byte> signature, HashAlgorithmName hashAlgorithm, RSASignaturePadding padding)
         {
-            string hashAlgorithmName = hashAlgorithm.Name;
+            string? hashAlgorithmName = hashAlgorithm.Name;
             if (string.IsNullOrEmpty(hashAlgorithmName))
             {
                 throw new ArgumentException(SR.Cryptography_HashAlgorithmNameNullOrEmpty, nameof(hashAlgorithm));
diff --git a/src/libraries/Common/src/System/Security/Cryptography/RSAOpenSsl.cs b/src/libraries/Common/src/System/Security/Cryptography/RSAOpenSsl.cs
index cb0b92fd0b9741..cdb2f70d8a28a8 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/RSAOpenSsl.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/RSAOpenSsl.cs
@@ -88,11 +88,11 @@ public override byte[] Decrypt(byte[] data, RSAEncryptionPadding padding)
             if (padding == null)
                 throw new ArgumentNullException(nameof(padding));
 
-            Interop.Crypto.RsaPadding rsaPadding = GetInteropPadding(padding, out RsaPaddingProcessor oaepProcessor);
+            Interop.Crypto.RsaPadding rsaPadding = GetInteropPadding(padding, out RsaPaddingProcessor? oaepProcessor);
             SafeRsaHandle key = GetKey();
 
             int rsaSize = Interop.Crypto.RsaSize(key);
-            byte[] buf = null;
+            byte[]? buf = null;
             Span<byte> destination = default;
 
             try
@@ -111,7 +111,7 @@ public override byte[] Decrypt(byte[] data, RSAEncryptionPadding padding)
             finally
             {
                 CryptographicOperations.ZeroMemory(destination);
-                CryptoPool.Return(buf, clearSize: 0);
+                CryptoPool.Return(buf!, clearSize: 0);
             }
         }
 
@@ -126,7 +126,7 @@ public override bool TryDecrypt(
                 throw new ArgumentNullException(nameof(padding));
             }
 
-            Interop.Crypto.RsaPadding rsaPadding = GetInteropPadding(padding, out RsaPaddingProcessor oaepProcessor);
+            Interop.Crypto.RsaPadding rsaPadding = GetInteropPadding(padding, out RsaPaddingProcessor? oaepProcessor);
             SafeRsaHandle key = GetKey();
 
             int keySizeBytes = Interop.Crypto.RsaSize(key);
@@ -136,7 +136,7 @@ public override bool TryDecrypt(
             if (destination.Length < keySizeBytes)
             {
                 Span<byte> tmp = stackalloc byte[0];
-                byte[] rent = null;
+                byte[]? rent = null;
 
                 // RSA up through 4096 stackalloc
                 if (keySizeBytes <= 512)
@@ -185,7 +185,7 @@ private static bool TryDecrypt(
             ReadOnlySpan<byte> data,
             Span<byte> destination,
             Interop.Crypto.RsaPadding rsaPadding,
-            RsaPaddingProcessor rsaPaddingProcessor,
+            RsaPaddingProcessor? rsaPaddingProcessor,
             out int bytesWritten)
         {
             // If rsaPadding is PKCS1 or OAEP-SHA1 then no depadding method should be present.
@@ -211,7 +211,7 @@ private static bool TryDecrypt(
             }
 
             Span<byte> decryptBuf = destination;
-            byte[] paddingBuf = null;
+            byte[]? paddingBuf = null;
 
             if (rsaPaddingProcessor != null)
             {
@@ -259,7 +259,7 @@ public override byte[] Encrypt(byte[] data, RSAEncryptionPadding padding)
             if (padding == null)
                 throw new ArgumentNullException(nameof(padding));
 
-            Interop.Crypto.RsaPadding rsaPadding = GetInteropPadding(padding, out RsaPaddingProcessor oaepProcessor);
+            Interop.Crypto.RsaPadding rsaPadding = GetInteropPadding(padding, out RsaPaddingProcessor? oaepProcessor);
             SafeRsaHandle key = GetKey();
 
             byte[] buf = new byte[Interop.Crypto.RsaSize(key)];
@@ -288,7 +288,7 @@ public override bool TryEncrypt(ReadOnlySpan<byte> data, Span<byte> destination,
                 throw new ArgumentNullException(nameof(padding));
             }
 
-            Interop.Crypto.RsaPadding rsaPadding = GetInteropPadding(padding, out RsaPaddingProcessor oaepProcessor);
+            Interop.Crypto.RsaPadding rsaPadding = GetInteropPadding(padding, out RsaPaddingProcessor? oaepProcessor);
             SafeRsaHandle key = GetKey();
 
             return TryEncrypt(key, data, destination, rsaPadding, oaepProcessor, out bytesWritten);
@@ -299,7 +299,7 @@ private static bool TryEncrypt(
             ReadOnlySpan<byte> data,
             Span<byte> destination,
             Interop.Crypto.RsaPadding rsaPadding,
-            RsaPaddingProcessor rsaPaddingProcessor,
+            RsaPaddingProcessor? rsaPaddingProcessor,
             out int bytesWritten)
         {
             int rsaSize = Interop.Crypto.RsaSize(key);
@@ -346,7 +346,7 @@ private static bool TryEncrypt(
 
         private static Interop.Crypto.RsaPadding GetInteropPadding(
             RSAEncryptionPadding padding,
-            out RsaPaddingProcessor rsaPaddingProcessor)
+            out RsaPaddingProcessor? rsaPaddingProcessor)
         {
             if (padding == RSAEncryptionPadding.Pkcs1)
             {
@@ -487,7 +487,7 @@ protected override void Dispose(bool disposing)
             if (disposing)
             {
                 FreeKey();
-                _key = null;
+                _key = null!;
             }
 
             base.Dispose(disposing);
@@ -641,7 +641,7 @@ public override byte[] SignHash(byte[] hash, HashAlgorithmName hashAlgorithm, RS
                 hashAlgorithm, padding,
                 true,
                 out int bytesWritten,
-                out byte[] signature))
+                out byte[]? signature))
             {
                 Debug.Fail("TrySignHash should not return false in allocation mode");
                 throw new CryptographicException();
@@ -674,7 +674,7 @@ public override bool TrySignHash(
                 padding,
                 false,
                 out bytesWritten,
-                out byte[] alloced);
+                out byte[]? alloced);
 
             Debug.Assert(alloced == null);
             return ret;
@@ -687,7 +687,7 @@ private bool TrySignHash(
             RSASignaturePadding padding,
             bool allocateSignature,
             out int bytesWritten,
-            out byte[] signature)
+            out byte[]? signature)
         {
             Debug.Assert(!string.IsNullOrEmpty(hashAlgorithm.Name));
             Debug.Assert(padding != null);
@@ -851,7 +851,7 @@ private static int GetAlgorithmNid(HashAlgorithmName hashAlgorithmName)
         {
             // All of the current HashAlgorithmName values correspond to the SN values in OpenSSL 0.9.8.
             // If there's ever a new one that doesn't, translate it here.
-            string sn = hashAlgorithmName.Name;
+            string sn = hashAlgorithmName.Name!;
 
             int nid = Interop.Crypto.ObjSn2Nid(sn);
 
diff --git a/src/libraries/Common/src/System/Security/Cryptography/RSASecurityTransforms.cs b/src/libraries/Common/src/System/Security/Cryptography/RSASecurityTransforms.cs
index 683086e6ae9d05..7041e89708d61a 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/RSASecurityTransforms.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/RSASecurityTransforms.cs
@@ -27,7 +27,7 @@ internal static partial class RSAImplementation
     {
         public sealed partial class RSASecurityTransforms : RSA
         {
-            private SecKeyPair _keys;
+            private SecKeyPair?_keys;
 
             public RSASecurityTransforms()
                 : this(2048)
@@ -326,7 +326,7 @@ public override bool TryEncrypt(ReadOnlySpan<byte> data, Span<byte> destination,
                         out bytesWritten);
                 }
 
-                RsaPaddingProcessor processor;
+                RsaPaddingProcessor? processor;
 
                 switch (padding.Mode)
                 {
@@ -558,7 +558,7 @@ public override bool TrySignHash(ReadOnlySpan<byte> hash, Span<byte> destination
 
                 ThrowIfDisposed();
 
-                RsaPaddingProcessor processor = null;
+                RsaPaddingProcessor? processor = null;
 
                 if (padding.Mode == RSASignaturePaddingMode.Pss)
                 {
@@ -774,7 +774,7 @@ private static Interop.AppleCrypto.PAL_HashAlgorithm PalAlgorithmFromAlgorithmNa
 
             private void ThrowIfDisposed()
             {
-                SecKeyPair current = _keys;
+                SecKeyPair? current = _keys;
 
                 if (current != null && current.PublicKey == null)
                 {
@@ -785,7 +785,7 @@ private void ThrowIfDisposed()
             internal SecKeyPair GetKeys()
             {
                 ThrowIfDisposed();
-                SecKeyPair current = _keys;
+                SecKeyPair? current = _keys;
 
                 if (current != null)
                 {
@@ -806,7 +806,7 @@ private void SetKey(SecKeyPair newKeyPair)
             {
                 ThrowIfDisposed();
 
-                SecKeyPair current = _keys;
+                SecKeyPair? current = _keys;
                 _keys = newKeyPair;
                 current?.Dispose();
 
diff --git a/src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.cs b/src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.cs
index 2f54f033c64b1c..3644eab3740b2d 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.cs
@@ -87,7 +87,7 @@ internal void PadOaep(
         {
             // https://tools.ietf.org/html/rfc3447#section-7.1.1
 
-            byte[] dbMask = null;
+            byte[]? dbMask = null;
             Span<byte> dbMaskSpan = Span<byte>.Empty;
 
             try
diff --git a/src/libraries/Common/src/System/Security/Cryptography/SecKeyPair.cs b/src/libraries/Common/src/System/Security/Cryptography/SecKeyPair.cs
index 45719a680b7192..a0e3238fd6d701 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/SecKeyPair.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/SecKeyPair.cs
@@ -9,9 +9,9 @@ namespace System.Security.Cryptography
     internal sealed class SecKeyPair : IDisposable
     {
         internal SafeSecKeyRefHandle PublicKey { get; private set; }
-        internal SafeSecKeyRefHandle PrivateKey { get; private set; }
+        internal SafeSecKeyRefHandle? PrivateKey { get; private set; }
 
-        private SecKeyPair(SafeSecKeyRefHandle publicKey, SafeSecKeyRefHandle privateKey)
+        private SecKeyPair(SafeSecKeyRefHandle publicKey, SafeSecKeyRefHandle? privateKey)
         {
             PublicKey = publicKey;
             PrivateKey = privateKey;
@@ -22,7 +22,7 @@ public void Dispose()
             PrivateKey?.Dispose();
             PrivateKey = null;
             PublicKey?.Dispose();
-            PublicKey = null;
+            PublicKey = null!;
         }
 
         internal static SecKeyPair PublicPrivatePair(SafeSecKeyRefHandle publicKey, SafeSecKeyRefHandle privateKey)
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/System.Security.Cryptography.Algorithms.sln b/src/libraries/System.Security.Cryptography.Algorithms/System.Security.Cryptography.Algorithms.sln
index 932d7771b141e9..35ea2d5bb13710 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/System.Security.Cryptography.Algorithms.sln
+++ b/src/libraries/System.Security.Cryptography.Algorithms/System.Security.Cryptography.Algorithms.sln
@@ -1,6 +1,6 @@
 Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 15
-VisualStudioVersion = 15.0.27213.1
+# Visual Studio Version 16
+VisualStudioVersion = 16.0.29720.21
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "System.Security.Cryptography.Algorithms.Tests", "tests\System.Security.Cryptography.Algorithms.Tests.csproj", "{508A7D81-6462-459C-9F8F-B58FCCCFC8E7}"
 	ProjectSection(ProjectDependencies) = postProject
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.cs b/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.cs
index f60d0ed0cd17a3..a0bd4256156b65 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.cs
@@ -11,7 +11,7 @@ public abstract partial class Aes : System.Security.Cryptography.SymmetricAlgori
     {
         protected Aes() { }
         public static new System.Security.Cryptography.Aes Create() { throw null; }
-        public static new System.Security.Cryptography.Aes Create(string algorithmName) { throw null; }
+        public static new System.Security.Cryptography.Aes? Create(string algorithmName) { throw null; }
     }
     public sealed partial class AesCcm : System.IDisposable
     {
@@ -19,10 +19,10 @@ public AesCcm(byte[] key) { }
         public AesCcm(System.ReadOnlySpan<byte> key) { }
         public static System.Security.Cryptography.KeySizes NonceByteSizes { get { throw null; } }
         public static System.Security.Cryptography.KeySizes TagByteSizes { get { throw null; } }
-        public void Decrypt(byte[] nonce, byte[] ciphertext, byte[] tag, byte[] plaintext, byte[] associatedData = null) { }
+        public void Decrypt(byte[] nonce, byte[] ciphertext, byte[] tag, byte[] plaintext, byte[]? associatedData = null) { }
         public void Decrypt(System.ReadOnlySpan<byte> nonce, System.ReadOnlySpan<byte> ciphertext, System.ReadOnlySpan<byte> tag, System.Span<byte> plaintext, System.ReadOnlySpan<byte> associatedData = default(System.ReadOnlySpan<byte>)) { }
         public void Dispose() { }
-        public void Encrypt(byte[] nonce, byte[] plaintext, byte[] ciphertext, byte[] tag, byte[] associatedData = null) { }
+        public void Encrypt(byte[] nonce, byte[] plaintext, byte[] ciphertext, byte[] tag, byte[]? associatedData = null) { }
         public void Encrypt(System.ReadOnlySpan<byte> nonce, System.ReadOnlySpan<byte> plaintext, System.Span<byte> ciphertext, System.Span<byte> tag, System.ReadOnlySpan<byte> associatedData = default(System.ReadOnlySpan<byte>)) { }
     }
     public sealed partial class AesGcm : System.IDisposable
@@ -31,10 +31,10 @@ public AesGcm(byte[] key) { }
         public AesGcm(System.ReadOnlySpan<byte> key) { }
         public static System.Security.Cryptography.KeySizes NonceByteSizes { get { throw null; } }
         public static System.Security.Cryptography.KeySizes TagByteSizes { get { throw null; } }
-        public void Decrypt(byte[] nonce, byte[] ciphertext, byte[] tag, byte[] plaintext, byte[] associatedData = null) { }
+        public void Decrypt(byte[] nonce, byte[] ciphertext, byte[] tag, byte[] plaintext, byte[]? associatedData = null) { }
         public void Decrypt(System.ReadOnlySpan<byte> nonce, System.ReadOnlySpan<byte> ciphertext, System.ReadOnlySpan<byte> tag, System.Span<byte> plaintext, System.ReadOnlySpan<byte> associatedData = default(System.ReadOnlySpan<byte>)) { }
         public void Dispose() { }
-        public void Encrypt(byte[] nonce, byte[] plaintext, byte[] ciphertext, byte[] tag, byte[] associatedData = null) { }
+        public void Encrypt(byte[] nonce, byte[] plaintext, byte[] ciphertext, byte[] tag, byte[]? associatedData = null) { }
         public void Encrypt(System.ReadOnlySpan<byte> nonce, System.ReadOnlySpan<byte> plaintext, System.Span<byte> ciphertext, System.Span<byte> tag, System.ReadOnlySpan<byte> associatedData = default(System.ReadOnlySpan<byte>)) { }
     }
     [System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
@@ -61,16 +61,16 @@ public override void GenerateKey() { }
     public abstract partial class AsymmetricKeyExchangeDeformatter
     {
         protected AsymmetricKeyExchangeDeformatter() { }
-        public abstract string Parameters { get; set; }
+        public abstract string? Parameters { get; set; }
         public abstract byte[] DecryptKeyExchange(byte[] rgb);
         public abstract void SetKey(System.Security.Cryptography.AsymmetricAlgorithm key);
     }
     public abstract partial class AsymmetricKeyExchangeFormatter
     {
         protected AsymmetricKeyExchangeFormatter() { }
-        public abstract string Parameters { get; }
+        public abstract string? Parameters { get; }
         public abstract byte[] CreateKeyExchange(byte[] data);
-        public abstract byte[] CreateKeyExchange(byte[] data, System.Type symAlgType);
+        public abstract byte[] CreateKeyExchange(byte[] data, System.Type? symAlgType);
         public abstract void SetKey(System.Security.Cryptography.AsymmetricAlgorithm key);
     }
     public abstract partial class AsymmetricSignatureDeformatter
@@ -95,10 +95,10 @@ public CryptoConfig() { }
         public static bool AllowOnlyFipsAlgorithms { get { throw null; } }
         public static void AddAlgorithm(System.Type algorithm, params string[] names) { }
         public static void AddOID(string oid, params string[] names) { }
-        public static object CreateFromName(string name) { throw null; }
-        public static object CreateFromName(string name, params object[] args) { throw null; }
+        public static object? CreateFromName(string name) { throw null; }
+        public static object? CreateFromName(string name, params object?[]? args) { throw null; }
         public static byte[] EncodeOID(string str) { throw null; }
-        public static string MapNameToOID(string name) { throw null; }
+        public static string? MapNameToOID(string name) { throw null; }
     }
     public abstract partial class DeriveBytes : System.IDisposable
     {
@@ -114,7 +114,7 @@ public abstract partial class DES : System.Security.Cryptography.SymmetricAlgori
         protected DES() { }
         public override byte[] Key { get { throw null; } set { } }
         public static new System.Security.Cryptography.DES Create() { throw null; }
-        public static new System.Security.Cryptography.DES Create(string algName) { throw null; }
+        public static new System.Security.Cryptography.DES? Create(string algName) { throw null; }
         public static bool IsSemiWeakKey(byte[] rgbKey) { throw null; }
         public static bool IsWeakKey(byte[] rgbKey) { throw null; }
     }
@@ -124,7 +124,7 @@ protected DSA() { }
         public static new System.Security.Cryptography.DSA Create() { throw null; }
         public static System.Security.Cryptography.DSA Create(int keySizeInBits) { throw null; }
         public static System.Security.Cryptography.DSA Create(System.Security.Cryptography.DSAParameters parameters) { throw null; }
-        public static new System.Security.Cryptography.DSA Create(string algName) { throw null; }
+        public static new System.Security.Cryptography.DSA? Create(string algName) { throw null; }
         public abstract byte[] CreateSignature(byte[] rgbHash);
         public abstract System.Security.Cryptography.DSAParameters ExportParameters(bool includePrivateParameters);
         public override void FromXmlString(string xmlString) { }
@@ -157,11 +157,11 @@ public partial struct DSAParameters
     {
         public int Counter;
         public byte[] G;
-        public byte[] J;
+        public byte[]? J;
         public byte[] P;
         public byte[] Q;
-        public byte[] Seed;
-        public byte[] X;
+        public byte[]? Seed;
+        public byte[]? X;
         public byte[] Y;
     }
     public partial class DSASignatureDeformatter : System.Security.Cryptography.AsymmetricSignatureDeformatter
@@ -186,14 +186,14 @@ public partial struct ECCurve
         private int _dummyPrimitive;
         public byte[] A;
         public byte[] B;
-        public byte[] Cofactor;
+        public byte[]? Cofactor;
         public System.Security.Cryptography.ECCurve.ECCurveType CurveType;
         public System.Security.Cryptography.ECPoint G;
         public System.Security.Cryptography.HashAlgorithmName? Hash;
         public byte[] Order;
         public byte[] Polynomial;
         public byte[] Prime;
-        public byte[] Seed;
+        public byte[]? Seed;
         public bool IsCharacteristic2 { get { throw null; } }
         public bool IsExplicit { get { throw null; } }
         public bool IsNamed { get { throw null; } }
@@ -238,15 +238,15 @@ public abstract partial class ECDiffieHellman : System.Security.Cryptography.Asy
         protected ECDiffieHellman() { }
         public override string KeyExchangeAlgorithm { get { throw null; } }
         public abstract System.Security.Cryptography.ECDiffieHellmanPublicKey PublicKey { get; }
-        public override string SignatureAlgorithm { get { throw null; } }
+        public override string? SignatureAlgorithm { get { throw null; } }
         public static new System.Security.Cryptography.ECDiffieHellman Create() { throw null; }
         public static System.Security.Cryptography.ECDiffieHellman Create(System.Security.Cryptography.ECCurve curve) { throw null; }
         public static System.Security.Cryptography.ECDiffieHellman Create(System.Security.Cryptography.ECParameters parameters) { throw null; }
-        public static new System.Security.Cryptography.ECDiffieHellman Create(string algorithm) { throw null; }
+        public static new System.Security.Cryptography.ECDiffieHellman? Create(string algorithm) { throw null; }
         public byte[] DeriveKeyFromHash(System.Security.Cryptography.ECDiffieHellmanPublicKey otherPartyPublicKey, System.Security.Cryptography.HashAlgorithmName hashAlgorithm) { throw null; }
-        public virtual byte[] DeriveKeyFromHash(System.Security.Cryptography.ECDiffieHellmanPublicKey otherPartyPublicKey, System.Security.Cryptography.HashAlgorithmName hashAlgorithm, byte[] secretPrepend, byte[] secretAppend) { throw null; }
-        public byte[] DeriveKeyFromHmac(System.Security.Cryptography.ECDiffieHellmanPublicKey otherPartyPublicKey, System.Security.Cryptography.HashAlgorithmName hashAlgorithm, byte[] hmacKey) { throw null; }
-        public virtual byte[] DeriveKeyFromHmac(System.Security.Cryptography.ECDiffieHellmanPublicKey otherPartyPublicKey, System.Security.Cryptography.HashAlgorithmName hashAlgorithm, byte[] hmacKey, byte[] secretPrepend, byte[] secretAppend) { throw null; }
+        public virtual byte[] DeriveKeyFromHash(System.Security.Cryptography.ECDiffieHellmanPublicKey otherPartyPublicKey, System.Security.Cryptography.HashAlgorithmName hashAlgorithm, byte[]? secretPrepend, byte[]? secretAppend) { throw null; }
+        public byte[] DeriveKeyFromHmac(System.Security.Cryptography.ECDiffieHellmanPublicKey otherPartyPublicKey, System.Security.Cryptography.HashAlgorithmName hashAlgorithm, byte[]? hmacKey) { throw null; }
+        public virtual byte[] DeriveKeyFromHmac(System.Security.Cryptography.ECDiffieHellmanPublicKey otherPartyPublicKey, System.Security.Cryptography.HashAlgorithmName hashAlgorithm, byte[]? hmacKey, byte[]? secretPrepend, byte[]? secretAppend) { throw null; }
         public virtual byte[] DeriveKeyMaterial(System.Security.Cryptography.ECDiffieHellmanPublicKey otherPartyPublicKey) { throw null; }
         public virtual byte[] DeriveKeyTls(System.Security.Cryptography.ECDiffieHellmanPublicKey otherPartyPublicKey, byte[] prfLabel, byte[] prfSeed) { throw null; }
         public virtual byte[] ExportECPrivateKey() { throw null; }
@@ -281,12 +281,12 @@ protected virtual void Dispose(bool disposing) { }
     public abstract partial class ECDsa : System.Security.Cryptography.AsymmetricAlgorithm
     {
         protected ECDsa() { }
-        public override string KeyExchangeAlgorithm { get { throw null; } }
+        public override string? KeyExchangeAlgorithm { get { throw null; } }
         public override string SignatureAlgorithm { get { throw null; } }
         public static new System.Security.Cryptography.ECDsa Create() { throw null; }
         public static System.Security.Cryptography.ECDsa Create(System.Security.Cryptography.ECCurve curve) { throw null; }
         public static System.Security.Cryptography.ECDsa Create(System.Security.Cryptography.ECParameters parameters) { throw null; }
-        public static new System.Security.Cryptography.ECDsa Create(string algorithm) { throw null; }
+        public static new System.Security.Cryptography.ECDsa? Create(string algorithm) { throw null; }
         public virtual byte[] ExportECPrivateKey() { throw null; }
         public virtual System.Security.Cryptography.ECParameters ExportExplicitParameters(bool includePrivateParameters) { throw null; }
         public virtual System.Security.Cryptography.ECParameters ExportParameters(bool includePrivateParameters) { throw null; }
@@ -323,7 +323,7 @@ public virtual void ImportParameters(System.Security.Cryptography.ECParameters p
     public partial struct ECParameters
     {
         public System.Security.Cryptography.ECCurve Curve;
-        public byte[] D;
+        public byte[]? D;
         public System.Security.Cryptography.ECPoint Q;
         public void Validate() { }
     }
@@ -334,18 +334,18 @@ public partial struct ECPoint
     }
     public static class HKDF
     {
-        public static byte[] Extract(HashAlgorithmName hashAlgorithmName, byte[] ikm, byte[] salt = null) { throw null; }
+        public static byte[] Extract(HashAlgorithmName hashAlgorithmName, byte[] ikm, byte[]? salt = null) { throw null; }
         public static int Extract(HashAlgorithmName hashAlgorithmName, ReadOnlySpan<byte> ikm, ReadOnlySpan<byte> salt, Span<byte> prk) { throw null; }
-        public static byte[] Expand(HashAlgorithmName hashAlgorithmName, byte[] prk, int outputLength, byte[] info = null) { throw null; }
+        public static byte[] Expand(HashAlgorithmName hashAlgorithmName, byte[] prk, int outputLength, byte[]? info = null) { throw null; }
         public static void Expand(HashAlgorithmName hashAlgorithmName, ReadOnlySpan<byte> prk, Span<byte> output, ReadOnlySpan<byte> info) { throw null; }
-        public static byte[] DeriveKey(HashAlgorithmName hashAlgorithmName, byte[] ikm, int outputLength, byte[] salt = null, byte[] info = null) { throw null; }
+        public static byte[] DeriveKey(HashAlgorithmName hashAlgorithmName, byte[] ikm, int outputLength, byte[]? salt = null, byte[]? info = null) { throw null; }
         public static void DeriveKey(HashAlgorithmName hashAlgorithmName, ReadOnlySpan<byte> ikm, Span<byte> output, ReadOnlySpan<byte> salt, ReadOnlySpan<byte> info) { throw null; }
     }
     public partial class HMACMD5 : System.Security.Cryptography.HMAC
     {
         public HMACMD5() { }
         public HMACMD5(byte[] key) { }
-        public override byte[] Key { get { throw null; } set { } }
+        public override byte[]? Key { get { throw null; } set { } }
         protected override void Dispose(bool disposing) { }
         protected override void HashCore(byte[] rgb, int ib, int cb) { }
         protected override void HashCore(System.ReadOnlySpan<byte> source) { }
@@ -359,7 +359,7 @@ public HMACSHA1() { }
         public HMACSHA1(byte[] key) { }
         [System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
         public HMACSHA1(byte[] key, bool useManagedSha1) { }
-        public override byte[] Key { get { throw null; } set { } }
+        public override byte[]? Key { get { throw null; } set { } }
         protected override void Dispose(bool disposing) { }
         protected override void HashCore(byte[] rgb, int ib, int cb) { }
         protected override void HashCore(System.ReadOnlySpan<byte> source) { }
@@ -371,7 +371,7 @@ public partial class HMACSHA256 : System.Security.Cryptography.HMAC
     {
         public HMACSHA256() { }
         public HMACSHA256(byte[] key) { }
-        public override byte[] Key { get { throw null; } set { } }
+        public override byte[]? Key { get { throw null; } set { } }
         protected override void Dispose(bool disposing) { }
         protected override void HashCore(byte[] rgb, int ib, int cb) { }
         protected override void HashCore(System.ReadOnlySpan<byte> source) { }
@@ -383,7 +383,7 @@ public partial class HMACSHA384 : System.Security.Cryptography.HMAC
     {
         public HMACSHA384() { }
         public HMACSHA384(byte[] key) { }
-        public override byte[] Key { get { throw null; } set { } }
+        public override byte[]? Key { get { throw null; } set { } }
         public bool ProduceLegacyHmacValues { get { throw null; } set { } }
         protected override void Dispose(bool disposing) { }
         protected override void HashCore(byte[] rgb, int ib, int cb) { }
@@ -396,7 +396,7 @@ public partial class HMACSHA512 : System.Security.Cryptography.HMAC
     {
         public HMACSHA512() { }
         public HMACSHA512(byte[] key) { }
-        public override byte[] Key { get { throw null; } set { } }
+        public override byte[]? Key { get { throw null; } set { } }
         public bool ProduceLegacyHmacValues { get { throw null; } set { } }
         protected override void Dispose(bool disposing) { }
         protected override void HashCore(byte[] rgb, int ib, int cb) { }
@@ -427,7 +427,7 @@ public abstract partial class MD5 : System.Security.Cryptography.HashAlgorithm
     {
         protected MD5() { }
         public static new System.Security.Cryptography.MD5 Create() { throw null; }
-        public static new System.Security.Cryptography.MD5 Create(string algName) { throw null; }
+        public static new System.Security.Cryptography.MD5? Create(string algName) { throw null; }
     }
     public partial class PKCS1MaskGenerationMethod : System.Security.Cryptography.MaskGenerationMethod
     {
@@ -439,7 +439,7 @@ public abstract partial class RandomNumberGenerator : System.IDisposable
     {
         protected RandomNumberGenerator() { }
         public static System.Security.Cryptography.RandomNumberGenerator Create() { throw null; }
-        public static System.Security.Cryptography.RandomNumberGenerator Create(string rngName) { throw null; }
+        public static System.Security.Cryptography.RandomNumberGenerator? Create(string rngName) { throw null; }
         public void Dispose() { }
         protected virtual void Dispose(bool disposing) { }
         public static void Fill(System.Span<byte> data) { }
@@ -459,7 +459,7 @@ protected RC2() { }
         public virtual int EffectiveKeySize { get { throw null; } set { } }
         public override int KeySize { get { throw null; } set { } }
         public static new System.Security.Cryptography.RC2 Create() { throw null; }
-        public static new System.Security.Cryptography.RC2 Create(string AlgName) { throw null; }
+        public static new System.Security.Cryptography.RC2? Create(string AlgName) { throw null; }
     }
     public partial class Rfc2898DeriveBytes : System.Security.Cryptography.DeriveBytes
     {
@@ -484,7 +484,7 @@ public abstract partial class Rijndael : System.Security.Cryptography.SymmetricA
     {
         protected Rijndael() { }
         public static new System.Security.Cryptography.Rijndael Create() { throw null; }
-        public static new System.Security.Cryptography.Rijndael Create(string algName) { throw null; }
+        public static new System.Security.Cryptography.Rijndael? Create(string algName) { throw null; }
     }
     [System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
     public sealed partial class RijndaelManaged : System.Security.Cryptography.Rijndael
@@ -513,7 +513,7 @@ protected RSA() { }
         public static new System.Security.Cryptography.RSA Create() { throw null; }
         public static System.Security.Cryptography.RSA Create(int keySizeInBits) { throw null; }
         public static System.Security.Cryptography.RSA Create(System.Security.Cryptography.RSAParameters parameters) { throw null; }
-        public static new System.Security.Cryptography.RSA Create(string algName) { throw null; }
+        public static new System.Security.Cryptography.RSA? Create(string algName) { throw null; }
         public virtual byte[] Decrypt(byte[] data, System.Security.Cryptography.RSAEncryptionPadding padding) { throw null; }
         public virtual byte[] DecryptValue(byte[] rgb) { throw null; }
         public virtual byte[] Encrypt(byte[] data, System.Security.Cryptography.RSAEncryptionPadding padding) { throw null; }
@@ -565,11 +565,11 @@ internal RSAEncryptionPadding() { }
         public static System.Security.Cryptography.RSAEncryptionPadding OaepSHA512 { get { throw null; } }
         public static System.Security.Cryptography.RSAEncryptionPadding Pkcs1 { get { throw null; } }
         public static System.Security.Cryptography.RSAEncryptionPadding CreateOaep(System.Security.Cryptography.HashAlgorithmName hashAlgorithm) { throw null; }
-        public override bool Equals(object obj) { throw null; }
-        public bool Equals(System.Security.Cryptography.RSAEncryptionPadding other) { throw null; }
+        public override bool Equals(object? obj) { throw null; }
+        public bool Equals(System.Security.Cryptography.RSAEncryptionPadding? other) { throw null; }
         public override int GetHashCode() { throw null; }
-        public static bool operator ==(System.Security.Cryptography.RSAEncryptionPadding left, System.Security.Cryptography.RSAEncryptionPadding right) { throw null; }
-        public static bool operator !=(System.Security.Cryptography.RSAEncryptionPadding left, System.Security.Cryptography.RSAEncryptionPadding right) { throw null; }
+        public static bool operator ==(System.Security.Cryptography.RSAEncryptionPadding? left, System.Security.Cryptography.RSAEncryptionPadding? right) { throw null; }
+        public static bool operator !=(System.Security.Cryptography.RSAEncryptionPadding? left, System.Security.Cryptography.RSAEncryptionPadding? right) { throw null; }
         public override string ToString() { throw null; }
     }
     public enum RSAEncryptionPaddingMode
@@ -581,7 +581,7 @@ public partial class RSAOAEPKeyExchangeDeformatter : System.Security.Cryptograph
     {
         public RSAOAEPKeyExchangeDeformatter() { }
         public RSAOAEPKeyExchangeDeformatter(System.Security.Cryptography.AsymmetricAlgorithm key) { }
-        public override string Parameters { get { throw null; } set { } }
+        public override string? Parameters { get { throw null; } set { } }
         public override byte[] DecryptKeyExchange(byte[] rgbData) { throw null; }
         public override void SetKey(System.Security.Cryptography.AsymmetricAlgorithm key) { }
     }
@@ -589,30 +589,30 @@ public partial class RSAOAEPKeyExchangeFormatter : System.Security.Cryptography.
     {
         public RSAOAEPKeyExchangeFormatter() { }
         public RSAOAEPKeyExchangeFormatter(System.Security.Cryptography.AsymmetricAlgorithm key) { }
-        public byte[] Parameter { get { throw null; } set { } }
-        public override string Parameters { get { throw null; } }
-        public System.Security.Cryptography.RandomNumberGenerator Rng { get { throw null; } set { } }
+        public byte[]? Parameter { get { throw null; } set { } }
+        public override string? Parameters { get { throw null; } }
+        public System.Security.Cryptography.RandomNumberGenerator? Rng { get { throw null; } set { } }
         public override byte[] CreateKeyExchange(byte[] rgbData) { throw null; }
-        public override byte[] CreateKeyExchange(byte[] rgbData, System.Type symAlgType) { throw null; }
+        public override byte[] CreateKeyExchange(byte[] rgbData, System.Type? symAlgType) { throw null; }
         public override void SetKey(System.Security.Cryptography.AsymmetricAlgorithm key) { }
     }
     public partial struct RSAParameters
     {
-        public byte[] D;
-        public byte[] DP;
-        public byte[] DQ;
+        public byte[]? D;
+        public byte[]? DP;
+        public byte[]? DQ;
         public byte[] Exponent;
-        public byte[] InverseQ;
+        public byte[]? InverseQ;
         public byte[] Modulus;
-        public byte[] P;
-        public byte[] Q;
+        public byte[]? P;
+        public byte[]? Q;
     }
     public partial class RSAPKCS1KeyExchangeDeformatter : System.Security.Cryptography.AsymmetricKeyExchangeDeformatter
     {
         public RSAPKCS1KeyExchangeDeformatter() { }
         public RSAPKCS1KeyExchangeDeformatter(System.Security.Cryptography.AsymmetricAlgorithm key) { }
-        public override string Parameters { get { throw null; } set { } }
-        public System.Security.Cryptography.RandomNumberGenerator RNG { get { throw null; } set { } }
+        public override string? Parameters { get { throw null; } set { } }
+        public System.Security.Cryptography.RandomNumberGenerator? RNG { get { throw null; } set { } }
         public override byte[] DecryptKeyExchange(byte[] rgbIn) { throw null; }
         public override void SetKey(System.Security.Cryptography.AsymmetricAlgorithm key) { }
     }
@@ -621,9 +621,9 @@ public partial class RSAPKCS1KeyExchangeFormatter : System.Security.Cryptography
         public RSAPKCS1KeyExchangeFormatter() { }
         public RSAPKCS1KeyExchangeFormatter(System.Security.Cryptography.AsymmetricAlgorithm key) { }
         public override string Parameters { get { throw null; } }
-        public System.Security.Cryptography.RandomNumberGenerator Rng { get { throw null; } set { } }
+        public System.Security.Cryptography.RandomNumberGenerator? Rng { get { throw null; } set { } }
         public override byte[] CreateKeyExchange(byte[] rgbData) { throw null; }
-        public override byte[] CreateKeyExchange(byte[] rgbData, System.Type symAlgType) { throw null; }
+        public override byte[] CreateKeyExchange(byte[] rgbData, System.Type? symAlgType) { throw null; }
         public override void SetKey(System.Security.Cryptography.AsymmetricAlgorithm key) { }
     }
     public partial class RSAPKCS1SignatureDeformatter : System.Security.Cryptography.AsymmetricSignatureDeformatter
@@ -648,11 +648,11 @@ internal RSASignaturePadding() { }
         public System.Security.Cryptography.RSASignaturePaddingMode Mode { get { throw null; } }
         public static System.Security.Cryptography.RSASignaturePadding Pkcs1 { get { throw null; } }
         public static System.Security.Cryptography.RSASignaturePadding Pss { get { throw null; } }
-        public override bool Equals(object obj) { throw null; }
-        public bool Equals(System.Security.Cryptography.RSASignaturePadding other) { throw null; }
+        public override bool Equals(object? obj) { throw null; }
+        public bool Equals(System.Security.Cryptography.RSASignaturePadding? other) { throw null; }
         public override int GetHashCode() { throw null; }
-        public static bool operator ==(System.Security.Cryptography.RSASignaturePadding left, System.Security.Cryptography.RSASignaturePadding right) { throw null; }
-        public static bool operator !=(System.Security.Cryptography.RSASignaturePadding left, System.Security.Cryptography.RSASignaturePadding right) { throw null; }
+        public static bool operator ==(System.Security.Cryptography.RSASignaturePadding? left, System.Security.Cryptography.RSASignaturePadding? right) { throw null; }
+        public static bool operator !=(System.Security.Cryptography.RSASignaturePadding? left, System.Security.Cryptography.RSASignaturePadding? right) { throw null; }
         public override string ToString() { throw null; }
     }
     public enum RSASignaturePaddingMode
@@ -664,7 +664,7 @@ public abstract partial class SHA1 : System.Security.Cryptography.HashAlgorithm
     {
         protected SHA1() { }
         public static new System.Security.Cryptography.SHA1 Create() { throw null; }
-        public static new System.Security.Cryptography.SHA1 Create(string hashName) { throw null; }
+        public static new System.Security.Cryptography.SHA1? Create(string hashName) { throw null; }
     }
     [System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
     public sealed partial class SHA1Managed : System.Security.Cryptography.SHA1
@@ -681,7 +681,7 @@ public abstract partial class SHA256 : System.Security.Cryptography.HashAlgorith
     {
         protected SHA256() { }
         public static new System.Security.Cryptography.SHA256 Create() { throw null; }
-        public static new System.Security.Cryptography.SHA256 Create(string hashName) { throw null; }
+        public static new System.Security.Cryptography.SHA256? Create(string hashName) { throw null; }
     }
     [System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
     public sealed partial class SHA256Managed : System.Security.Cryptography.SHA256
@@ -698,7 +698,7 @@ public abstract partial class SHA384 : System.Security.Cryptography.HashAlgorith
     {
         protected SHA384() { }
         public static new System.Security.Cryptography.SHA384 Create() { throw null; }
-        public static new System.Security.Cryptography.SHA384 Create(string hashName) { throw null; }
+        public static new System.Security.Cryptography.SHA384? Create(string hashName) { throw null; }
     }
     [System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
     public sealed partial class SHA384Managed : System.Security.Cryptography.SHA384
@@ -715,7 +715,7 @@ public abstract partial class SHA512 : System.Security.Cryptography.HashAlgorith
     {
         protected SHA512() { }
         public static new System.Security.Cryptography.SHA512 Create() { throw null; }
-        public static new System.Security.Cryptography.SHA512 Create(string hashName) { throw null; }
+        public static new System.Security.Cryptography.SHA512? Create(string hashName) { throw null; }
     }
     [System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
     public sealed partial class SHA512Managed : System.Security.Cryptography.SHA512
@@ -732,12 +732,12 @@ public partial class SignatureDescription
     {
         public SignatureDescription() { }
         public SignatureDescription(System.Security.SecurityElement el) { }
-        public string DeformatterAlgorithm { get { throw null; } set { } }
-        public string DigestAlgorithm { get { throw null; } set { } }
-        public string FormatterAlgorithm { get { throw null; } set { } }
-        public string KeyAlgorithm { get { throw null; } set { } }
+        public string? DeformatterAlgorithm { get { throw null; } set { } }
+        public string? DigestAlgorithm { get { throw null; } set { } }
+        public string? FormatterAlgorithm { get { throw null; } set { } }
+        public string? KeyAlgorithm { get { throw null; } set { } }
         public virtual System.Security.Cryptography.AsymmetricSignatureDeformatter CreateDeformatter(System.Security.Cryptography.AsymmetricAlgorithm key) { throw null; }
-        public virtual System.Security.Cryptography.HashAlgorithm CreateDigest() { throw null; }
+        public virtual System.Security.Cryptography.HashAlgorithm? CreateDigest() { throw null; }
         public virtual System.Security.Cryptography.AsymmetricSignatureFormatter CreateFormatter(System.Security.Cryptography.AsymmetricAlgorithm key) { throw null; }
     }
     public abstract partial class TripleDES : System.Security.Cryptography.SymmetricAlgorithm
@@ -745,7 +745,7 @@ public abstract partial class TripleDES : System.Security.Cryptography.Symmetric
         protected TripleDES() { }
         public override byte[] Key { get { throw null; } set { } }
         public static new System.Security.Cryptography.TripleDES Create() { throw null; }
-        public static new System.Security.Cryptography.TripleDES Create(string str) { throw null; }
+        public static new System.Security.Cryptography.TripleDES? Create(string str) { throw null; }
         public static bool IsWeakKey(byte[] rgbKey) { throw null; }
     }
 }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.csproj b/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.csproj
index f1ac1e0504a897..b2f66748ea1de5 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.csproj
+++ b/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.csproj
@@ -1,6 +1,7 @@
 <Project Sdk="Microsoft.NET.Sdk">
   <PropertyGroup>
     <Configurations>$(NetCoreAppCurrent)-Debug;$(NetCoreAppCurrent)-Release</Configurations>
+    <Nullable>enable</Nullable>
   </PropertyGroup>
   <ItemGroup>
     <Compile Include="System.Security.Cryptography.Algorithms.cs" />
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AesImplementation.OSX.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AesImplementation.OSX.cs
index 410e2003ac5aa6..ab83849cf1d259 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AesImplementation.OSX.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AesImplementation.OSX.cs
@@ -12,7 +12,7 @@ private static ICryptoTransform CreateTransformCore(
             CipherMode cipherMode,
             PaddingMode paddingMode,
             byte[] key,
-            byte[] iv,
+            byte[]? iv,
             int blockSize,
             bool encrypting)
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AesImplementation.Unix.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AesImplementation.Unix.cs
index 9cedcc8b89258e..51b4ff1d2db0e5 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AesImplementation.Unix.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AesImplementation.Unix.cs
@@ -13,7 +13,7 @@ private static ICryptoTransform CreateTransformCore(
             CipherMode cipherMode,
             PaddingMode paddingMode,
             byte[] key,
-            byte[] iv,
+            byte[]? iv,
             int blockSize,
             bool encrypting)
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AesImplementation.Windows.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AesImplementation.Windows.cs
index 0da257af182083..b911377c8bb2f9 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AesImplementation.Windows.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AesImplementation.Windows.cs
@@ -13,7 +13,7 @@ private static ICryptoTransform CreateTransformCore(
             CipherMode cipherMode,
             PaddingMode paddingMode,
             byte[] key,
-            byte[] iv,
+            byte[]? iv,
             int blockSize,
             bool encrypting)
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AesImplementation.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AesImplementation.cs
index 569afeaf07d92a..6eec09cdb8e166 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AesImplementation.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AesImplementation.cs
@@ -14,7 +14,7 @@ public sealed override ICryptoTransform CreateDecryptor()
             return CreateTransform(Key, IV, encrypting: false);
         }
 
-        public sealed override ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[] rgbIV)
+        public sealed override ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[]? rgbIV)
         {
             return CreateTransform(rgbKey, rgbIV.CloneByteArray(), encrypting: false);
         }
@@ -24,7 +24,7 @@ public sealed override ICryptoTransform CreateEncryptor()
             return CreateTransform(Key, IV, encrypting: true);
         }
 
-        public sealed override ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[] rgbIV)
+        public sealed override ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[]? rgbIV)
         {
             return CreateTransform(rgbKey, rgbIV.CloneByteArray(), encrypting: true);
         }
@@ -48,7 +48,7 @@ protected sealed override void Dispose(bool disposing)
             base.Dispose(disposing);
         }
 
-        private ICryptoTransform CreateTransform(byte[] rgbKey, byte[] rgbIV, bool encrypting)
+        private ICryptoTransform CreateTransform(byte[] rgbKey, byte[]? rgbIV, bool encrypting)
         {
             // note: rbgIV is guaranteed to be cloned before this method, so no need to clone it again
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AppleCCCryptor.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AppleCCCryptor.cs
index 8c1813b5e62772..fec06f96676bee 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AppleCCCryptor.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/AppleCCCryptor.cs
@@ -11,14 +11,14 @@ namespace Internal.Cryptography
     internal sealed class AppleCCCryptor : BasicSymmetricCipher
     {
         private readonly bool _encrypting;
-        private SafeAppleCryptorHandle _cryptor;
+        private SafeAppleCryptorHandle _cryptor = null!;
 
         public AppleCCCryptor(
             Interop.AppleCrypto.PAL_SymmetricAlgorithm algorithm,
             CipherMode cipherMode,
             int blockSizeInBytes,
             byte[] key,
-            byte[] iv,
+            byte[]? iv,
             bool encrypting)
             : base(cipherMode.GetCipherIv(iv), blockSizeInBytes)
         {
@@ -32,7 +32,7 @@ protected override void Dispose(bool disposing)
             if (disposing)
             {
                 _cryptor?.Dispose();
-                _cryptor = null;
+                _cryptor = null!;
             }
 
             base.Dispose(disposing);
@@ -149,7 +149,7 @@ private unsafe void OpenCryptor(
             int ret;
             int ccStatus;
 
-            byte[] iv = IV;
+            byte[]? iv = IV;
 
             fixed (byte* pbKey = key)
             fixed (byte* pbIv = iv)
@@ -190,7 +190,7 @@ private unsafe void Reset()
             int ret;
             int ccStatus;
 
-            byte[] iv = IV;
+            byte[]? iv = IV;
 
             fixed (byte* pbIv = iv)
             {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/DesImplementation.OSX.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/DesImplementation.OSX.cs
index e52ab6bbbd219b..560de5e48391a8 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/DesImplementation.OSX.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/DesImplementation.OSX.cs
@@ -12,7 +12,7 @@ private static ICryptoTransform CreateTransformCore(
             CipherMode cipherMode,
             PaddingMode paddingMode,
             byte[] key,
-            byte[] iv,
+            byte[]? iv,
             int blockSize,
             bool encrypting)
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/DesImplementation.Unix.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/DesImplementation.Unix.cs
index 24de90935c5ed2..5da0d0c885bf6d 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/DesImplementation.Unix.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/DesImplementation.Unix.cs
@@ -13,7 +13,7 @@ private static ICryptoTransform CreateTransformCore(
             CipherMode cipherMode,
             PaddingMode paddingMode,
             byte[] key,
-            byte[] iv,
+            byte[]? iv,
             int blockSize,
             bool encrypting)
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/DesImplementation.Windows.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/DesImplementation.Windows.cs
index 047f0acb0fd731..df950323da701a 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/DesImplementation.Windows.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/DesImplementation.Windows.cs
@@ -13,7 +13,7 @@ private static ICryptoTransform CreateTransformCore(
             CipherMode cipherMode,
             PaddingMode paddingMode,
             byte[] key,
-            byte[] iv,
+            byte[]? iv,
             int blockSize,
             bool encrypting)
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/DesImplementation.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/DesImplementation.cs
index 11ab5f917794aa..cf6142adc3291e 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/DesImplementation.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/DesImplementation.cs
@@ -17,7 +17,7 @@ public override ICryptoTransform CreateDecryptor()
             return CreateTransform(Key, IV, encrypting: false);
         }
 
-        public override ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[] rgbIV)
+        public override ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[]? rgbIV)
         {
             return CreateTransform(rgbKey, rgbIV.CloneByteArray(), encrypting: false);
         }
@@ -27,7 +27,7 @@ public override ICryptoTransform CreateEncryptor()
             return CreateTransform(Key, IV, encrypting: true);
         }
 
-        public override ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[] rgbIV)
+        public override ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[]? rgbIV)
         {
             return CreateTransform(rgbKey, rgbIV.CloneByteArray(), encrypting: true);
         }
@@ -51,7 +51,7 @@ public sealed override void GenerateKey()
             KeyValue = key;
         }
 
-        private ICryptoTransform CreateTransform(byte[] rgbKey, byte[] rgbIV, bool encrypting)
+        private ICryptoTransform CreateTransform(byte[] rgbKey, byte[]? rgbIV, bool encrypting)
         {
             // note: rgbIV is guaranteed to be cloned before this method, so no need to clone it again
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/HMACCommon.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/HMACCommon.cs
index 63f3b8b7d83876..ea08db672a11a1 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/HMACCommon.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/HMACCommon.cs
@@ -41,7 +41,7 @@ private HMACCommon(string hashAlgorithmId, int blockSize)
 
         public int HashSizeInBits => _hMacProvider.HashSizeInBytes * 8;
 
-        public void ChangeKey(byte[] key)
+        public void ChangeKey(byte[]? key)
         {
             ActualKey = ChangeKeyImpl(key) ?? key;
         }
@@ -52,9 +52,9 @@ internal void ChangeKey(ReadOnlySpan<byte> key)
             ActualKey = ChangeKeyImpl(key);
         }
 
-        private byte[] ChangeKeyImpl(ReadOnlySpan<byte> key)
+        private byte[]? ChangeKeyImpl(ReadOnlySpan<byte> key)
         {
-            byte[] modifiedKey = null;
+            byte[]? modifiedKey = null;
 
             // If _blockSize is -1 the key isn't going to be extractable by the object holder,
             // so there's no point in recalculating it in managed code.
@@ -70,7 +70,7 @@ private byte[] ChangeKeyImpl(ReadOnlySpan<byte> key)
             }
 
             HashProvider oldHashProvider = _hMacProvider;
-            _hMacProvider = null;
+            _hMacProvider = null!;
             oldHashProvider?.Dispose(true);
             _hMacProvider = HashProviderDispenser.CreateMacProvider(_hashAlgorithmId, key);
 
@@ -79,7 +79,7 @@ private byte[] ChangeKeyImpl(ReadOnlySpan<byte> key)
 
         // The actual key used for hashing. This will not be the same as the original key passed to ChangeKey() if the original key exceeded the
         // hash algorithm's block size. (See RFC 2104, section 2)
-        public byte[] ActualKey { get; private set; }
+        public byte[]? ActualKey { get; private set; }
 
         // Adds new data to be hashed. This can be called repeatedly in order to hash data from noncontiguous sources.
         public void AppendHashData(byte[] data, int offset, int count) =>
@@ -100,13 +100,13 @@ public void Dispose(bool disposing)
             if (disposing && _hMacProvider != null)
             {
                 _hMacProvider.Dispose(true);
-                _hMacProvider = null;
+                _hMacProvider = null!;
             }
         }
 
         private readonly string _hashAlgorithmId;
-        private HashProvider _hMacProvider;
-        private volatile HashProvider _lazyHashProvider;
+        private HashProvider _hMacProvider = null!; // Initialized in helper
+        private volatile HashProvider? _lazyHashProvider;
         private readonly int _blockSize;
     }
 }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/HashAlgorithmNames.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/HashAlgorithmNames.cs
index 5da5e17c58c1e1..a7a3e385702298 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/HashAlgorithmNames.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/HashAlgorithmNames.cs
@@ -22,7 +22,7 @@ internal static class HashAlgorithmNames
         /// <summary>
         /// Map HashAlgorithm type to string; .NET Framework uses CryptoConfig functionality.
         /// </summary>
-        public static string ToAlgorithmName(this HashAlgorithm hashAlgorithm)
+        public static string? ToAlgorithmName(this HashAlgorithm hashAlgorithm)
         {
             if (hashAlgorithm is SHA1)
                 return HashAlgorithmNames.SHA1;
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/HashProviderDispenser.Unix.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/HashProviderDispenser.Unix.cs
index 1c85f79e48a682..6216dbee4f6c7a 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/HashProviderDispenser.Unix.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/HashProviderDispenser.Unix.cs
@@ -171,7 +171,7 @@ public override void Dispose(bool disposing)
                 if (disposing && _hmacCtx != null)
                 {
                     _hmacCtx.Dispose();
-                    _hmacCtx = null;
+                    _hmacCtx = null!;
                 }
             }
         }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/Helpers.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/Helpers.cs
index 19bdfd8fcbc2d5..5ca3a10cf788f3 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/Helpers.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/Helpers.cs
@@ -17,7 +17,7 @@ public static bool UsesIv(this CipherMode cipherMode)
             return cipherMode != CipherMode.ECB;
         }
 
-        public static byte[] GetCipherIv(this CipherMode cipherMode, byte[] iv)
+        public static byte[]? GetCipherIv(this CipherMode cipherMode, byte[]? iv)
         {
             if (cipherMode.UsesIv())
             {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/OpenSslCipher.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/OpenSslCipher.cs
index f625574e0b053e..b43bfbcc138ac5 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/OpenSslCipher.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/OpenSslCipher.cs
@@ -14,9 +14,9 @@ namespace Internal.Cryptography
     internal class OpenSslCipher : BasicSymmetricCipher
     {
         private readonly bool _encrypting;
-        private SafeEvpCipherCtxHandle _ctx;
+        private SafeEvpCipherCtxHandle _ctx = null!;
 
-        public OpenSslCipher(IntPtr algorithm, CipherMode cipherMode, int blockSizeInBytes, byte[] key, int effectiveKeyLength, byte[] iv, bool encrypting)
+        public OpenSslCipher(IntPtr algorithm, CipherMode cipherMode, int blockSizeInBytes, byte[] key, int effectiveKeyLength, byte[]? iv, bool encrypting)
             : base(cipherMode.GetCipherIv(iv), blockSizeInBytes)
         {
             Debug.Assert(algorithm != IntPtr.Zero);
@@ -33,7 +33,7 @@ protected override void Dispose(bool disposing)
                 if (_ctx != null)
                 {
                     _ctx.Dispose();
-                    _ctx = null;
+                    _ctx = null!;
                 }
             }
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RC2Implementation.OSX.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RC2Implementation.OSX.cs
index 3e0012d093a112..2cfc98b3576fba 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RC2Implementation.OSX.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RC2Implementation.OSX.cs
@@ -13,7 +13,7 @@ private static ICryptoTransform CreateTransformCore(
             PaddingMode paddingMode,
             byte[] key,
             int effectiveKeyLength,
-            byte[] iv,
+            byte[]? iv,
             int blockSize,
             bool encrypting)
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RC2Implementation.Unix.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RC2Implementation.Unix.cs
index 30118f4d972a52..efd6cbe80c0ef2 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RC2Implementation.Unix.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RC2Implementation.Unix.cs
@@ -15,7 +15,7 @@ private static ICryptoTransform CreateTransformCore(
             PaddingMode paddingMode,
             byte[] key,
             int effectiveKeyLength,
-            byte[] iv,
+            byte[]? iv,
             int blockSize,
             bool encrypting)
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RC2Implementation.Windows.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RC2Implementation.Windows.cs
index fe0f2dd7094d54..e5c04cb3f7a9ae 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RC2Implementation.Windows.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RC2Implementation.Windows.cs
@@ -15,7 +15,7 @@ private static ICryptoTransform CreateTransformCore(
             PaddingMode paddingMode,
             byte[] key,
             int effectiveKeyLength,
-            byte[] iv,
+            byte[]? iv,
             int blockSize,
             bool encrypting)
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RC2Implementation.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RC2Implementation.cs
index 74f333bf747fbd..43ab0284465876 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RC2Implementation.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RC2Implementation.cs
@@ -30,7 +30,7 @@ public override ICryptoTransform CreateDecryptor()
             return CreateTransform(Key, IV, encrypting: false);
         }
 
-        public override ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[] rgbIV)
+        public override ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[]? rgbIV)
         {
             return CreateTransform(rgbKey, rgbIV.CloneByteArray(), encrypting: false);
         }
@@ -40,7 +40,7 @@ public override ICryptoTransform CreateEncryptor()
             return CreateTransform(Key, IV, encrypting: true);
         }
 
-        public override ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[] rgbIV)
+        public override ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[]? rgbIV)
         {
             return CreateTransform(rgbKey, rgbIV.CloneByteArray(), encrypting: true);
         }
@@ -59,7 +59,7 @@ public sealed override void GenerateKey()
             Key = key;
         }
 
-        private ICryptoTransform CreateTransform(byte[] rgbKey, byte[] rgbIV, bool encrypting)
+        private ICryptoTransform CreateTransform(byte[] rgbKey, byte[]? rgbIV, bool encrypting)
         {
             // note: rgbIV is guaranteed to be cloned before this method, so no need to clone it again
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/TripleDesImplementation.OSX.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/TripleDesImplementation.OSX.cs
index 126ae376479326..b52479fff1327e 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/TripleDesImplementation.OSX.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/TripleDesImplementation.OSX.cs
@@ -12,7 +12,7 @@ private static ICryptoTransform CreateTransformCore(
             CipherMode cipherMode,
             PaddingMode paddingMode,
             byte[] key,
-            byte[] iv,
+            byte[]? iv,
             int blockSize,
             bool encrypting)
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/TripleDesImplementation.Unix.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/TripleDesImplementation.Unix.cs
index 0cbb3251fb0ea0..1d5c6b6c877aa5 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/TripleDesImplementation.Unix.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/TripleDesImplementation.Unix.cs
@@ -13,7 +13,7 @@ private static ICryptoTransform CreateTransformCore(
             CipherMode cipherMode,
             PaddingMode paddingMode,
             byte[] key,
-            byte[] iv,
+            byte[]? iv,
             int blockSize,
             bool encrypting)
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/TripleDesImplementation.Windows.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/TripleDesImplementation.Windows.cs
index ca80377d64c69b..c43cb9e28d6ee5 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/TripleDesImplementation.Windows.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/TripleDesImplementation.Windows.cs
@@ -13,7 +13,7 @@ private static ICryptoTransform CreateTransformCore(
             CipherMode cipherMode,
             PaddingMode paddingMode,
             byte[] key,
-            byte[] iv,
+            byte[]? iv,
             int blockSize,
             bool encrypting)
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/TripleDesImplementation.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/TripleDesImplementation.cs
index da1d4d04ae72ba..c4c42f542d50a3 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/TripleDesImplementation.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/TripleDesImplementation.cs
@@ -17,7 +17,7 @@ public override ICryptoTransform CreateDecryptor()
             return CreateTransform(Key, IV, encrypting: false);
         }
 
-        public override ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[] rgbIV)
+        public override ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[]? rgbIV)
         {
             return CreateTransform(rgbKey, rgbIV.CloneByteArray(), encrypting: false);
         }
@@ -27,7 +27,7 @@ public override ICryptoTransform CreateEncryptor()
             return CreateTransform(Key, IV, encrypting: true);
         }
 
-        public override ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[] rgbIV)
+        public override ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[]? rgbIV)
         {
             return CreateTransform(rgbKey, rgbIV.CloneByteArray(), encrypting: true);
         }
@@ -46,7 +46,7 @@ public sealed override void GenerateKey()
             Key = key;
         }
 
-        private ICryptoTransform CreateTransform(byte[] rgbKey, byte[] rgbIV, bool encrypting)
+        private ICryptoTransform CreateTransform(byte[] rgbKey, byte[]? rgbIV, bool encrypting)
         {
             // note: rgbIV is guaranteed to be cloned before this method, so no need to clone it again
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System.Security.Cryptography.Algorithms.csproj b/src/libraries/System.Security.Cryptography.Algorithms/src/System.Security.Cryptography.Algorithms.csproj
index 4b29dd05417894..3f4a8a1968092d 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System.Security.Cryptography.Algorithms.csproj
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System.Security.Cryptography.Algorithms.csproj
@@ -4,6 +4,7 @@
     <DefineConstants>$(DefineConstants);INTERNAL_ASYMMETRIC_IMPLEMENTATIONS</DefineConstants>
     <NoWarn>CS1573;CS3016;CA5350;CA5351;CA5379;CA5384;CA5385;$(NoWarn)</NoWarn>
     <Configurations>$(NetCoreAppCurrent)-OSX-Debug;$(NetCoreAppCurrent)-OSX-Release;$(NetCoreAppCurrent)-Unix-Debug;$(NetCoreAppCurrent)-Unix-Release;$(NetCoreAppCurrent)-Windows_NT-Debug;$(NetCoreAppCurrent)-Windows_NT-Release</Configurations>
+    <Nullable>enable</Nullable>
   </PropertyGroup>
   <Import Project="$(CommonPath)System\Security\Cryptography\Asn1\AsnXml.targets"/>
   <Import Project="$(CommonPath)System\Security\Cryptography\Asn1Reader\System.Security.Cryptography.Asn1Reader.Shared.projitems" />
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/Aes.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/Aes.cs
index d3f1d759f995f9..a1d785fb3e9b91 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/Aes.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/Aes.cs
@@ -24,9 +24,9 @@ protected Aes()
             return new AesImplementation();
         }
 
-        public static new Aes Create(string algorithmName)
+        public static new Aes? Create(string algorithmName)
         {
-            return (Aes)CryptoConfig.CreateFromName(algorithmName);
+            return (Aes?)CryptoConfig.CreateFromName(algorithmName);
         }
 
         private static readonly KeySizes[] s_legalBlockSizes = { new KeySizes(128, 128, 0) };
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesCcm.Unix.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesCcm.Unix.cs
index 835048ac6de3b5..3c61b09154dce6 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesCcm.Unix.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesCcm.Unix.cs
@@ -9,7 +9,7 @@ namespace System.Security.Cryptography
 {
     public sealed partial class AesCcm
     {
-        private byte[] _key;
+        private byte[] _key = null!;
 
         private void ImportKey(ReadOnlySpan<byte> key)
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesCcm.Windows.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesCcm.Windows.cs
index b16acd348e21ea..451a80af2ec9c1 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesCcm.Windows.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesCcm.Windows.cs
@@ -10,7 +10,7 @@ namespace System.Security.Cryptography
     public sealed partial class AesCcm
     {
         private static readonly SafeAlgorithmHandle s_aesCcm = AesBCryptModes.OpenAesAlgorithm(Cng.BCRYPT_CHAIN_MODE_CCM);
-        private SafeKeyHandle _keyHandle;
+        private SafeKeyHandle _keyHandle = null!; // Always initialized in helper
 
         private void ImportKey(ReadOnlySpan<byte> key)
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesCcm.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesCcm.cs
index 21d55e3808d324..f9f00bce2e179f 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesCcm.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesCcm.cs
@@ -26,7 +26,7 @@ public AesCcm(byte[] key)
             ImportKey(key);
         }
 
-        public void Encrypt(byte[] nonce, byte[] plaintext, byte[] ciphertext, byte[] tag, byte[] associatedData = null)
+        public void Encrypt(byte[] nonce, byte[] plaintext, byte[] ciphertext, byte[] tag, byte[]? associatedData = null)
         {
             AesAEAD.CheckArgumentsForNull(nonce, plaintext, ciphertext, tag);
             Encrypt((ReadOnlySpan<byte>)nonce, plaintext, ciphertext, tag, associatedData);
@@ -43,7 +43,7 @@ public void Encrypt(
             EncryptInternal(nonce, plaintext, ciphertext, tag, associatedData);
         }
 
-        public void Decrypt(byte[] nonce, byte[] ciphertext, byte[] tag, byte[] plaintext, byte[] associatedData = null)
+        public void Decrypt(byte[] nonce, byte[] ciphertext, byte[] tag, byte[] plaintext, byte[]? associatedData = null)
         {
             AesAEAD.CheckArgumentsForNull(nonce, plaintext, ciphertext, tag);
             Decrypt((ReadOnlySpan<byte>)nonce, ciphertext, tag, plaintext, associatedData);
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesGcm.Unix.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesGcm.Unix.cs
index 702d5a6db5d4a2..bf04741e86390a 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesGcm.Unix.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesGcm.Unix.cs
@@ -9,7 +9,7 @@ namespace System.Security.Cryptography
 {
     public sealed partial class AesGcm
     {
-        private SafeEvpCipherCtxHandle _ctxHandle;
+        private SafeEvpCipherCtxHandle _ctxHandle = null!;
 
         private void ImportKey(ReadOnlySpan<byte> key)
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesGcm.Windows.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesGcm.Windows.cs
index 9ee976d9bfcc93..ca5b4354470283 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesGcm.Windows.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesGcm.Windows.cs
@@ -10,7 +10,7 @@ namespace System.Security.Cryptography
     public partial class AesGcm
     {
         private static readonly SafeAlgorithmHandle s_aesGcm = AesBCryptModes.OpenAesAlgorithm(Cng.BCRYPT_CHAIN_MODE_GCM);
-        private SafeKeyHandle _keyHandle;
+        private SafeKeyHandle _keyHandle = null!; // Always initialized in helper
 
         private void ImportKey(ReadOnlySpan<byte> key)
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesGcm.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesGcm.cs
index 5295d05d99015f..bbda05e94923fe 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesGcm.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesGcm.cs
@@ -27,7 +27,7 @@ public AesGcm(byte[] key)
             ImportKey(key);
         }
 
-        public void Encrypt(byte[] nonce, byte[] plaintext, byte[] ciphertext, byte[] tag, byte[] associatedData = null)
+        public void Encrypt(byte[] nonce, byte[] plaintext, byte[] ciphertext, byte[] tag, byte[]? associatedData = null)
         {
             AesAEAD.CheckArgumentsForNull(nonce, plaintext, ciphertext, tag);
             Encrypt((ReadOnlySpan<byte>)nonce, plaintext, ciphertext, tag, associatedData);
@@ -44,7 +44,7 @@ public void Encrypt(
             EncryptInternal(nonce, plaintext, ciphertext, tag, associatedData);
         }
 
-        public void Decrypt(byte[] nonce, byte[] ciphertext, byte[] tag, byte[] plaintext, byte[] associatedData = null)
+        public void Decrypt(byte[] nonce, byte[] ciphertext, byte[] tag, byte[] plaintext, byte[]? associatedData = null)
         {
             AesAEAD.CheckArgumentsForNull(nonce, plaintext, ciphertext, tag);
             Decrypt((ReadOnlySpan<byte>)nonce, ciphertext, tag, plaintext, associatedData);
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AsymmetricKeyExchangeDeformatter.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AsymmetricKeyExchangeDeformatter.cs
index da3dfac2eaeaa5..bef8420d910d12 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AsymmetricKeyExchangeDeformatter.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AsymmetricKeyExchangeDeformatter.cs
@@ -7,7 +7,7 @@ namespace System.Security.Cryptography
     public abstract class AsymmetricKeyExchangeDeformatter
     {
         protected AsymmetricKeyExchangeDeformatter() { }
-        public abstract string Parameters { get; set; }
+        public abstract string? Parameters { get; set; }
         public abstract void SetKey(AsymmetricAlgorithm key);
         public abstract byte[] DecryptKeyExchange(byte[] rgb);
     }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AsymmetricKeyExchangeFormatter.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AsymmetricKeyExchangeFormatter.cs
index a1022a40640f13..5c3eb017019c23 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AsymmetricKeyExchangeFormatter.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AsymmetricKeyExchangeFormatter.cs
@@ -8,12 +8,12 @@ public abstract class AsymmetricKeyExchangeFormatter
     {
         protected AsymmetricKeyExchangeFormatter() { }
 
-        public abstract string Parameters { get; }
+        public abstract string? Parameters { get; }
 
         public abstract void SetKey(AsymmetricAlgorithm key);
         public abstract byte[] CreateKeyExchange(byte[] data);
 
         // For .NET Framework compat, keep this even though symAlgType is not used.
-        public abstract byte[] CreateKeyExchange(byte[] data, Type symAlgType);
+        public abstract byte[] CreateKeyExchange(byte[] data, Type? symAlgType);
     }
 }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AsymmetricSignatureDeformatter.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AsymmetricSignatureDeformatter.cs
index 91feca94172007..4e216e4ff36238 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AsymmetricSignatureDeformatter.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AsymmetricSignatureDeformatter.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+using System.Diagnostics;
 using Internal.Cryptography;
 
 namespace System.Security.Cryptography
@@ -18,7 +19,8 @@ public virtual bool VerifySignature(HashAlgorithm hash, byte[] rgbSignature)
             if (hash == null)
                 throw new ArgumentNullException(nameof(hash));
 
-            SetHashAlgorithm(hash.ToAlgorithmName());
+            SetHashAlgorithm(hash.ToAlgorithmName()!);
+            Debug.Assert(hash.Hash != null);
             return VerifySignature(hash.Hash, rgbSignature);
         }
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AsymmetricSignatureFormatter.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AsymmetricSignatureFormatter.cs
index ec2bcbdb03651c..81c3e05d6f112d 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AsymmetricSignatureFormatter.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AsymmetricSignatureFormatter.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+using System.Diagnostics;
 using Internal.Cryptography;
 
 namespace System.Security.Cryptography
@@ -18,7 +19,8 @@ public virtual byte[] CreateSignature(HashAlgorithm hash)
             if (hash == null)
                 throw new ArgumentNullException(nameof(hash));
 
-            SetHashAlgorithm(hash.ToAlgorithmName());
+            SetHashAlgorithm(hash.ToAlgorithmName()!);
+            Debug.Assert(hash.Hash != null);
             return CreateSignature(hash.Hash);
         }
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/CngKeyLite.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/CngKeyLite.cs
index 28cab7270817aa..dede9e0ae49468 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/CngKeyLite.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/CngKeyLite.cs
@@ -4,6 +4,7 @@
 
 using System;
 using System.Diagnostics;
+using System.Diagnostics.CodeAnalysis;
 using System.Runtime.InteropServices;
 using System.Security.Cryptography;
 using Internal.Cryptography;
@@ -239,10 +240,10 @@ internal static byte[] ExportPkcs8KeyBlob(
                 kdfCount,
                 Span<byte>.Empty,
                 out _,
-                out byte[] allocated);
+                out byte[]? allocated);
 
             Debug.Assert(ret);
-            return allocated;
+            return allocated!;
         }
 
         internal static bool TryExportPkcs8KeyBlob(
@@ -273,7 +274,7 @@ internal static unsafe bool ExportPkcs8KeyBlob(
             int kdfCount,
             Span<byte> destination,
             out int bytesWritten,
-            out byte[] allocated)
+            [NotNullWhen(true)] out byte[]? allocated)
         {
             using (SafeUnicodeStringHandle stringHandle = new SafeUnicodeStringHandle(password))
             {
@@ -568,7 +569,7 @@ private static SafeNCryptProviderHandle OpenNCryptProvider(string providerName)
         /// null - if property not defined on key.
         /// throws - for any other type of error.
         /// </returns>
-        private static byte[] GetProperty(SafeNCryptHandle ncryptHandle, string propertyName, CngPropertyOptions options)
+        private static byte[]? GetProperty(SafeNCryptHandle ncryptHandle, string propertyName, CngPropertyOptions options)
         {
             Debug.Assert(!ncryptHandle.IsInvalid);
             unsafe
@@ -599,10 +600,10 @@ private static byte[] GetProperty(SafeNCryptHandle ncryptHandle, string property
         /// Retrieve a well-known CNG string property. (Note: .NET Framework compat: this helper likes to return special values rather than throw exceptions for missing
         /// or ill-formatted property values. Only use it for well-known properties that are unlikely to be ill-formatted.)
         /// </summary>
-        internal static string GetPropertyAsString(SafeNCryptHandle ncryptHandle, string propertyName, CngPropertyOptions options)
+        internal static string? GetPropertyAsString(SafeNCryptHandle ncryptHandle, string propertyName, CngPropertyOptions options)
         {
             Debug.Assert(!ncryptHandle.IsInvalid);
-            byte[] value = GetProperty(ncryptHandle, propertyName, options);
+            byte[]? value = GetProperty(ncryptHandle, propertyName, options);
             if (value == null)
                 return null;   // .NET Framework compat: return null if key not present.
             if (value.Length == 0)
@@ -612,13 +613,13 @@ internal static string GetPropertyAsString(SafeNCryptHandle ncryptHandle, string
             {
                 fixed (byte* pValue = &value[0])
                 {
-                    string valueAsString = Marshal.PtrToStringUni((IntPtr)pValue);
+                    string valueAsString = Marshal.PtrToStringUni((IntPtr)pValue)!;
                     return valueAsString;
                 }
             }
         }
 
-        internal static string GetCurveName(SafeNCryptHandle ncryptHandle)
+        internal static string? GetCurveName(SafeNCryptHandle ncryptHandle)
         {
             Debug.Assert(!ncryptHandle.IsInvalid);
             return GetPropertyAsString(ncryptHandle, KeyPropertyName.ECCCurveName, CngPropertyOptions.None);
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/CngPkcs8.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/CngPkcs8.cs
index 88bc955ac664a3..8037b656eb2b00 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/CngPkcs8.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/CngPkcs8.cs
@@ -12,7 +12,7 @@ internal struct Pkcs8Response
         {
             internal SafeNCryptKeyHandle KeyHandle;
 
-            internal string GetAlgorithmGroup()
+            internal string? GetAlgorithmGroup()
             {
                 return CngKeyLite.GetPropertyAsString(
                     KeyHandle,
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/CryptoConfig.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/CryptoConfig.cs
index da12745404615e..3d9583c02f76f5 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/CryptoConfig.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/CryptoConfig.cs
@@ -33,8 +33,8 @@ public class CryptoConfig
 
         private const string ECDsaIdentifier = "ECDsa";
 
-        private static volatile Dictionary<string, string> s_defaultOidHT;
-        private static volatile Dictionary<string, object> s_defaultNameHT;
+        private static volatile Dictionary<string, string>? s_defaultOidHT;
+        private static volatile Dictionary<string, object>? s_defaultNameHT;
         private static readonly ConcurrentDictionary<string, Type> appNameHT = new ConcurrentDictionary<string, Type>(StringComparer.OrdinalIgnoreCase);
         private static readonly ConcurrentDictionary<string, string> appOidHT = new ConcurrentDictionary<string, string>(StringComparer.OrdinalIgnoreCase);
 
@@ -326,18 +326,18 @@ public static void AddAlgorithm(Type algorithm, params string[] names)
             }
         }
 
-        public static object CreateFromName(string name, params object[] args)
+        public static object? CreateFromName(string name, params object?[]? args)
         {
             if (name == null)
                 throw new ArgumentNullException(nameof(name));
 
             // Check to see if we have an application defined mapping
-            appNameHT.TryGetValue(name, out Type retvalType);
+            appNameHT.TryGetValue(name, out Type? retvalType);
 
             // We allow the default table to Types and Strings
             // Types get used for types in .Algorithms assembly.
             // strings get used for delay-loaded stuff in other assemblies such as .Csp.
-            if (retvalType == null && DefaultNameHT.TryGetValue(name, out object retvalObj))
+            if (retvalType == null && DefaultNameHT.TryGetValue(name, out object? retvalObj))
             {
                 retvalType = retvalObj as Type;
 
@@ -419,14 +419,14 @@ public static object CreateFromName(string name, params object[] args)
             cons = candidates.ToArray();
 
             // Bind to matching ctor.
-            ConstructorInfo rci = Type.DefaultBinder.BindToMethod(
+            ConstructorInfo? rci = Type.DefaultBinder.BindToMethod(
                 ConstructorDefault,
                 cons,
                 ref args,
                 null,
                 null,
                 null,
-                out object state) as ConstructorInfo;
+                out object? state) as ConstructorInfo;
 
             // Check for ctor we don't like (non-existent, delegate or decorated with declarative linktime demand).
             if (rci == null || typeof(Delegate).IsAssignableFrom(rci.DeclaringType))
@@ -446,7 +446,7 @@ public static object CreateFromName(string name, params object[] args)
             return retval;
         }
 
-        public static object CreateFromName(string name)
+        public static object? CreateFromName(string name)
         {
             return CreateFromName(name, null);
         }
@@ -478,12 +478,12 @@ public static void AddOID(string oid, params string[] names)
             }
         }
 
-        public static string MapNameToOID(string name)
+        public static string? MapNameToOID(string name)
         {
             if (name == null)
                 throw new ArgumentNullException(nameof(name));
 
-            appOidHT.TryGetValue(name, out string oidName);
+            appOidHT.TryGetValue(name, out string? oidName);
 
             if (string.IsNullOrEmpty(oidName) && !DefaultOidHT.TryGetValue(name, out oidName))
             {
@@ -547,7 +547,7 @@ public static byte[] EncodeOID(string str)
             return encodedOidNums;
         }
 
-        private static void EncodeSingleOidNum(uint value, byte[] destination, ref int index)
+        private static void EncodeSingleOidNum(uint value, byte[]? destination, ref int index)
         {
             // Write directly to destination starting at index, and update index based on how many bytes written.
             // If destination is null, just return updated index.
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DES.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DES.cs
index 5bc00889833311..443cc84d79b757 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DES.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DES.cs
@@ -24,9 +24,9 @@ protected DES()
             return new DesImplementation();
         }
 
-        public static new DES Create(string algName)
+        public static new DES? Create(string algName)
         {
-            return (DES)CryptoConfig.CreateFromName(algName);
+            return (DES?)CryptoConfig.CreateFromName(algName);
         }
 
         public override byte[] Key
@@ -103,7 +103,7 @@ public static bool IsSemiWeakKey(byte[] rgbKey)
             return false;
         }
 
-        private static bool IsLegalKeySize(byte[] rgbKey)
+        private static bool IsLegalKeySize(byte[]? rgbKey)
         {
             if (rgbKey != null && rgbKey.Length == 8)
                 return true;
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSA.Xml.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSA.Xml.cs
index 2cab2ac3b66813..bb64cd20d0c545 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSA.Xml.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSA.Xml.cs
@@ -15,7 +15,7 @@ private static byte[] ReadRequiredElement(
             string name,
             int sizeHint = -1)
         {
-            byte[] ret = XmlKeyHelper.ReadCryptoBinary(ref state, name, sizeHint);
+            byte[]? ret = XmlKeyHelper.ReadCryptoBinary(ref state, name, sizeHint);
 
             if (ret == null)
             {
@@ -35,10 +35,10 @@ public override void FromXmlString(string xmlString)
             byte[] q = ReadRequiredElement(ref state, nameof(DSAParameters.Q));
             byte[] g = ReadRequiredElement(ref state, nameof(DSAParameters.G), p.Length);
             byte[] y = ReadRequiredElement(ref state, nameof(DSAParameters.Y), p.Length);
-            byte[] j = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(DSAParameters.J));
-            byte[] seed = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(DSAParameters.Seed));
+            byte[]? j = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(DSAParameters.J));
+            byte[]? seed = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(DSAParameters.Seed));
             int counter = 0;
-            byte[] x = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(DSAParameters.X), q.Length);
+            byte[]? x = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(DSAParameters.X), q.Length);
 
             if (seed != null)
             {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSA.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSA.cs
index bf67d516d7b95e..23391a0fb7a34a 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSA.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSA.cs
@@ -20,9 +20,9 @@ public abstract partial class DSA : AsymmetricAlgorithm
 
         protected DSA() { }
 
-        public static new DSA Create(string algName)
+        public static new DSA? Create(string algName)
         {
-            return (DSA)CryptoConfig.CreateFromName(algName);
+            return (DSA?)CryptoConfig.CreateFromName(algName);
         }
 
         public static DSA Create(int keySizeInBits)
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSACng.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSACng.cs
index 6c056387b4b85a..f689c20877b683 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSACng.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSACng.cs
@@ -19,7 +19,7 @@ internal static partial class DSAImplementation
     {
         public sealed partial class DSACng : DSA
         {
-            private SafeNCryptKeyHandle _keyHandle;
+            private SafeNCryptKeyHandle? _keyHandle;
             private int _lastKeySize;
             private bool _disposed;
 
@@ -50,7 +50,7 @@ private SafeNCryptKeyHandle GetDuplicatedKeyHandle()
                     _lastKeySize = keySize;
                 }
 
-                return new DuplicateSafeNCryptKeyHandle(_keyHandle);
+                return new DuplicateSafeNCryptKeyHandle(_keyHandle!);
             }
 
             private byte[] ExportKeyBlob(bool includePrivateParameters)
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSAParameters.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSAParameters.cs
index 1c1225717ca7ad..87734d4178dbf3 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSAParameters.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSAParameters.cs
@@ -13,9 +13,9 @@ public struct DSAParameters
         public byte[] Q;
         public byte[] G;
         public byte[] Y;
-        public byte[] J;
-        public byte[] X;
-        public byte[] Seed;
+        public byte[]? J;
+        public byte[]? X;
+        public byte[]? Seed;
         public int Counter;
     }
 }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSASignatureDeformatter.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSASignatureDeformatter.cs
index eec79188b8238b..64c45669098fea 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSASignatureDeformatter.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSASignatureDeformatter.cs
@@ -8,7 +8,7 @@ namespace System.Security.Cryptography
 {
     public class DSASignatureDeformatter : AsymmetricSignatureDeformatter
     {
-        private DSA _dsaKey;
+        private DSA? _dsaKey;
 
         public DSASignatureDeformatter() { }
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSASignatureFormatter.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSASignatureFormatter.cs
index d14d38d4a2c667..8da44200581810 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSASignatureFormatter.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSASignatureFormatter.cs
@@ -8,7 +8,7 @@ namespace System.Security.Cryptography
 {
     public class DSASignatureFormatter : AsymmetricSignatureFormatter
     {
-        private DSA _dsaKey;
+        private DSA? _dsaKey;
 
         public DSASignatureFormatter() { }
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECCngKey.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECCngKey.cs
index 47dc3a25251371..8ae034d1ffd99c 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECCngKey.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECCngKey.cs
@@ -10,9 +10,9 @@ namespace System.Security.Cryptography
 {
     internal sealed partial class ECCngKey
     {
-        private SafeNCryptKeyHandle _keyHandle;
+        private SafeNCryptKeyHandle? _keyHandle;
         private int _lastKeySize;
-        private string _lastAlgorithm;
+        private string? _lastAlgorithm;
         private bool _disposed;
         private readonly string _algorithmGroup;
         private readonly string _disposedName;
@@ -29,12 +29,12 @@ internal ECCngKey(string algorithmGroup, string disposedName)
 
         internal int KeySize { get; private set; }
 
-        internal string GetCurveName(int callerKeySizeProperty, out string oidValue)
+        internal string? GetCurveName(int callerKeySizeProperty, out string? oidValue)
         {
             // Ensure key\handle is created
             using (SafeNCryptKeyHandle keyHandle = GetDuplicatedKeyHandle(callerKeySizeProperty))
             {
-                string algorithm = _lastAlgorithm;
+                string? algorithm = _lastAlgorithm;
 
                 if (ECCng.IsECNamedCurve(algorithm))
                 {
@@ -51,6 +51,7 @@ internal SafeNCryptKeyHandle GetDuplicatedKeyHandle(int callerKeySizeProperty)
         {
             ThrowIfDisposed();
 
+            Debug.Assert(_keyHandle != null);
             if (ECCng.IsECNamedCurve(_lastAlgorithm))
             {
                 // Curve was previously created, so use that
@@ -112,7 +113,7 @@ internal void GenerateKey(ECCurve curve)
                 DisposeKey();
             }
 
-            string algorithm = null;
+            string algorithm;
             int keySize = 0;
 
             if (curve.IsNamed)
@@ -216,7 +217,7 @@ internal void DisposeKey()
             _lastKeySize = 0;
         }
 
-        internal void SetHandle(SafeNCryptKeyHandle keyHandle, string algorithmName)
+        internal void SetHandle(SafeNCryptKeyHandle keyHandle, string? algorithmName)
         {
             ThrowIfDisposed();
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECCurve.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECCurve.cs
index 40b7683a103880..8bc7603aafe66f 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECCurve.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECCurve.cs
@@ -39,12 +39,12 @@ public partial struct ECCurve
         /// <summary>
         /// Cofactor (optional). Applies only to Explicit curves.
         /// </summary>
-        public byte[] Cofactor;
+        public byte[]? Cofactor;
 
         /// <summary>
         /// Seed of the curve (optional). Applies only to Explicit curves.
         /// </summary>
-        public byte[] Seed;
+        public byte[]? Seed;
 
         /// <summary>
         /// Curve Type.
@@ -140,9 +140,9 @@ public static ECCurve CreateFromValue(string oidValue)
             return ECCurve.CreateFromValueAndName(oidValue, null);
         }
 
-        private static ECCurve CreateFromValueAndName(string oidValue, string oidFriendlyName)
+        private static ECCurve CreateFromValueAndName(string? oidValue, string? oidFriendlyName)
         {
-            Oid oid = null;
+            Oid? oid = null;
 
             if (oidValue == null && oidFriendlyName != null)
             {
@@ -232,7 +232,7 @@ public void Validate()
                 {
                     if (!hasErrors)
                     {
-                        if (Prime == null || Prime.Length != A.Length)
+                        if (Prime == null || Prime.Length != A!.Length)
                         {
                             hasErrors = true;
                         }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellman.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellman.cs
index 780405582c5285..6109ae344db207 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellman.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellman.cs
@@ -23,12 +23,12 @@ public override string KeyExchangeAlgorithm
             get { return "ECDiffieHellman"; }
         }
 
-        public override string SignatureAlgorithm
+        public override string? SignatureAlgorithm
         {
             get { return null; }
         }
 
-        public static new ECDiffieHellman Create(string algorithm)
+        public static new ECDiffieHellman? Create(string algorithm)
         {
             if (algorithm == null)
             {
@@ -71,8 +71,8 @@ public byte[] DeriveKeyFromHash(ECDiffieHellmanPublicKey otherPartyPublicKey, Ha
         public virtual byte[] DeriveKeyFromHash(
             ECDiffieHellmanPublicKey otherPartyPublicKey,
             HashAlgorithmName hashAlgorithm,
-            byte[] secretPrepend,
-            byte[] secretAppend)
+            byte[]? secretPrepend,
+            byte[]? secretAppend)
         {
             throw DerivedClassMustOverride();
         }
@@ -89,7 +89,7 @@ public virtual byte[] DeriveKeyFromHash(
         public byte[] DeriveKeyFromHmac(
             ECDiffieHellmanPublicKey otherPartyPublicKey,
             HashAlgorithmName hashAlgorithm,
-            byte[] hmacKey)
+            byte[]? hmacKey)
         {
             return DeriveKeyFromHmac(otherPartyPublicKey, hashAlgorithm, hmacKey, null, null);
         }
@@ -108,9 +108,9 @@ public byte[] DeriveKeyFromHmac(
         public virtual byte[] DeriveKeyFromHmac(
             ECDiffieHellmanPublicKey otherPartyPublicKey,
             HashAlgorithmName hashAlgorithm,
-            byte[] hmacKey,
-            byte[] secretPrepend,
-            byte[] secretAppend)
+            byte[]? hmacKey,
+            byte[]? secretPrepend,
+            byte[]? secretAppend)
         {
             throw DerivedClassMustOverride();
         }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellmanCng.Derive.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellmanCng.Derive.cs
index 71d99dc8d5c5ec..dedd7910f44f2d 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellmanCng.Derive.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellmanCng.Derive.cs
@@ -45,7 +45,7 @@ private SafeNCryptSecretHandle DeriveSecretAgreementHandle(ECDiffieHellmanPublic
                 using (ECDiffieHellmanCng otherPartyCng = (ECDiffieHellmanCng)Create(otherPartyParameters))
                 using (SafeNCryptKeyHandle otherPartyHandle = otherPartyCng.GetDuplicatedKeyHandle())
                 {
-                    string importedKeyAlgorithmGroup =
+                    string? importedKeyAlgorithmGroup =
                         CngKeyLite.GetPropertyAsString(
                             otherPartyHandle,
                             CngKeyLite.KeyPropertyName.AlgorithmGroup,
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellmanCng.Key.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellmanCng.Key.cs
index 0c6f09b17f0094..a41d0555432ed8 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellmanCng.Key.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellmanCng.Key.cs
@@ -13,7 +13,7 @@ public sealed partial class ECDiffieHellmanCng : ECDiffieHellman
         {
             private readonly ECCngKey _key = new ECCngKey(BCryptNative.AlgorithmName.ECDH, nameof(ECDiffieHellman));
 
-            private string GetCurveName(out string oidValue) => _key.GetCurveName(KeySize, out oidValue);
+            private string? GetCurveName(out string? oidValue) => _key.GetCurveName(KeySize, out oidValue);
 
             public override void GenerateKey(ECCurve curve)
             {
@@ -32,7 +32,7 @@ public override ECDiffieHellmanPublicKey PublicKey
             {
                 get
                 {
-                    string curveName = GetCurveName(out _);
+                    string? curveName = GetCurveName(out _);
 
                     return new ECDiffieHellmanCngPublicKey(
                         curveName == null
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellmanCngPublicKey.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellmanCngPublicKey.cs
index e355c85794d103..499030927fddb2 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellmanCngPublicKey.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellmanCngPublicKey.cs
@@ -11,11 +11,11 @@ internal static partial class ECDiffieHellmanImplementation
         public sealed partial class ECDiffieHellmanCngPublicKey : ECDiffieHellmanPublicKey
         {
             private byte[] _keyBlob;
-            internal string _curveName;
+            internal string? _curveName;
 
             protected override void Dispose(bool disposing)
             {
-                _keyBlob = null;
+                _keyBlob = null!;
                 base.Dispose(disposing);
             }
 
@@ -29,7 +29,7 @@ public static ECDiffieHellmanCngPublicKey FromXmlString(string xml)
                 throw new PlatformNotSupportedException();
             }
 
-            internal ECDiffieHellmanCngPublicKey(byte[] keyBlob, string curveName) : base(keyBlob)
+            internal ECDiffieHellmanCngPublicKey(byte[] keyBlob, string? curveName) : base(keyBlob)
             {
                 Debug.Assert(keyBlob != null);
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellmanPublicKey.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellmanPublicKey.cs
index a8ac3411e59b5f..a07f99ff88a367 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellmanPublicKey.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDiffieHellmanPublicKey.cs
@@ -23,7 +23,7 @@ protected ECDiffieHellmanPublicKey(byte[] keyBlob)
                 throw new ArgumentNullException(nameof(keyBlob));
             }
 
-            _keyBlob = keyBlob.Clone() as byte[];
+            _keyBlob = (byte[])keyBlob.Clone();
         }
 
         public void Dispose()
@@ -35,7 +35,7 @@ protected virtual void Dispose(bool disposing) { }
 
         public virtual byte[] ToByteArray()
         {
-            return _keyBlob.Clone() as byte[];
+            return (byte[])_keyBlob.Clone();
         }
 
         // This method must be implemented by derived classes. In order to conform to the contract, it cannot be abstract.
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDsa.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDsa.cs
index 2e1fae773f7f3f..0b55b614457427 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDsa.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDsa.cs
@@ -18,7 +18,7 @@ public abstract partial class ECDsa : AsymmetricAlgorithm
 
         protected ECDsa() { }
 
-        public static new ECDsa Create(string algorithm)
+        public static new ECDsa? Create(string algorithm)
         {
             if (algorithm == null)
             {
@@ -69,9 +69,6 @@ public virtual void GenerateKey(ECCurve curve)
 
         public virtual byte[] SignData(byte[] data, HashAlgorithmName hashAlgorithm)
         {
-            if (data == null)
-                throw new ArgumentNullException(nameof(data));
-
             return SignData(data, 0, data.Length, hashAlgorithm);
         }
 
@@ -120,9 +117,6 @@ public virtual byte[] SignData(Stream data, HashAlgorithmName hashAlgorithm)
 
         public bool VerifyData(byte[] data, byte[] signature, HashAlgorithmName hashAlgorithm)
         {
-            if (data == null)
-                throw new ArgumentNullException(nameof(data));
-
             return VerifyData(data, 0, data.Length, signature, hashAlgorithm);
         }
 
@@ -196,7 +190,7 @@ public bool VerifyData(Stream data, byte[] signature, HashAlgorithmName hashAlgo
         public abstract byte[] SignHash(byte[] hash);
         public abstract bool VerifyHash(byte[] hash, byte[] signature);
 
-        public override string KeyExchangeAlgorithm => null;
+        public override string? KeyExchangeAlgorithm => null;
         public override string SignatureAlgorithm => "ECDsa";
 
         protected virtual byte[] HashData(byte[] data, int offset, int count, HashAlgorithmName hashAlgorithm)
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDsaCng.Key.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDsaCng.Key.cs
index 96b7503d782b27..83f50f9c22b37a 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDsaCng.Key.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDsaCng.Key.cs
@@ -13,7 +13,7 @@ public sealed partial class ECDsaCng : ECDsa
         {
             private readonly ECCngKey _key = new ECCngKey(AlgorithmName.ECDsa, nameof(ECDsa));
 
-            private string GetCurveName(out string oidValue) => _key.GetCurveName(KeySize, out oidValue);
+            private string? GetCurveName(out string? oidValue) => _key.GetCurveName(KeySize, out oidValue);
 
             public override void GenerateKey(ECCurve curve)
             {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECParameters.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECParameters.cs
index ee305ce613f84d..fd74c8dc76b9e1 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECParameters.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECParameters.cs
@@ -21,7 +21,7 @@ public struct ECParameters
         /// <summary>
         /// Private Key. Not always present.
         /// </summary>
-        public byte[] D;
+        public byte[]? D;
 
         /// <summary>
         /// The Curve.
@@ -55,7 +55,7 @@ public void Validate()
                 else if (Curve.IsNamed)
                 {
                     // Named curves require D length to match Q.X and Q.Y
-                    hasErrors = (D != null && (D.Length != Q.X.Length));
+                    hasErrors = (D != null && (D.Length != Q.X!.Length));
                 }
             }
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECPoint.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECPoint.cs
index 71439d1a7c2fb7..0ab176682271b2 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECPoint.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECPoint.cs
@@ -9,7 +9,7 @@ namespace System.Security.Cryptography
     /// </summary>
     public struct ECPoint
     {
-        public byte[] X;
+        public byte[] X; // TODO not sure if it should be nullabe
         public byte[] Y;
     }
 }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HKDF.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HKDF.cs
index 23edddc444c9b7..45a15b226605a5 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HKDF.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HKDF.cs
@@ -24,7 +24,7 @@ public static class HKDF
         /// <param name="ikm">The input keying material.</param>
         /// <param name="salt">The optional salt value (a non-secret random value). If not provided it defaults to a byte array of <see cref="HashLength"/> zeros.</param>
         /// <returns>The pseudo random key (prk).</returns>
-        public static byte[] Extract(HashAlgorithmName hashAlgorithmName, byte[] ikm, byte[] salt = null)
+        public static byte[] Extract(HashAlgorithmName hashAlgorithmName, byte[] ikm, byte[]? salt = null)
         {
             if (ikm == null)
                 throw new ArgumentNullException(nameof(ikm));
@@ -83,7 +83,7 @@ private static void Extract(HashAlgorithmName hashAlgorithmName, int hashLength,
         /// <param name="outputLength">The length of the output keying material.</param>
         /// <param name="info">The optional context and application specific information.</param>
         /// <returns>The output keying material.</returns>
-        public static byte[] Expand(HashAlgorithmName hashAlgorithmName, byte[] prk, int outputLength, byte[] info = null)
+        public static byte[] Expand(HashAlgorithmName hashAlgorithmName, byte[] prk, int outputLength, byte[]? info = null)
         {
             if (prk == null)
                 throw new ArgumentNullException(nameof(prk));
@@ -173,7 +173,7 @@ private static void Expand(HashAlgorithmName hashAlgorithmName, int hashLength,
         /// <param name="salt">The optional salt value (a non-secret random value). If not provided it defaults to a byte array of <see cref="HashLength"/> zeros.</param>
         /// <param name="info">The optional context and application specific information.</param>
         /// <returns>The output keying material.</returns>
-        public static byte[] DeriveKey(HashAlgorithmName hashAlgorithmName, byte[] ikm, int outputLength, byte[] salt = null, byte[] info = null)
+        public static byte[] DeriveKey(HashAlgorithmName hashAlgorithmName, byte[] ikm, int outputLength, byte[]? salt = null, byte[]? info = null)
         {
             if (ikm == null)
                 throw new ArgumentNullException(nameof(ikm));
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACMD5.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACMD5.cs
index 840dad093ee82d..129628dd269ef3 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACMD5.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACMD5.cs
@@ -29,7 +29,7 @@ public HMACMD5(byte[] key)
             HashSizeValue = _hMacCommon.HashSizeInBits;
         }
 
-        public override byte[] Key
+        public override byte[]? Key
         {
             get
             {
@@ -67,7 +67,7 @@ protected override void Dispose(bool disposing)
                 HMACCommon hMacCommon = _hMacCommon;
                 if (hMacCommon != null)
                 {
-                    _hMacCommon = null;
+                    _hMacCommon = null!;
                     hMacCommon.Dispose(disposing);
                 }
             }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA1.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA1.cs
index dff929bb76cc4e..a273f9ac25c8ba 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA1.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA1.cs
@@ -36,7 +36,7 @@ public HMACSHA1(byte[] key, bool useManagedSha1) : this(key)
             // useManagedSha1 is ignored
         }
 
-        public override byte[] Key
+        public override byte[]? Key
         {
             get
             {
@@ -74,7 +74,7 @@ protected override void Dispose(bool disposing)
                 HMACCommon hMacCommon = _hMacCommon;
                 if (hMacCommon != null)
                 {
-                    _hMacCommon = null;
+                    _hMacCommon = null!;
                     hMacCommon.Dispose(disposing);
                 }
             }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA256.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA256.cs
index f97ad15853e586..fb57f2adc729e6 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA256.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA256.cs
@@ -33,7 +33,7 @@ public HMACSHA256(byte[] key)
             HashSizeValue = _hMacCommon.HashSizeInBits;
         }
 
-        public override byte[] Key
+        public override byte[]? Key
         {
             get
             {
@@ -71,7 +71,7 @@ protected override void Dispose(bool disposing)
                 HMACCommon hMacCommon = _hMacCommon;
                 if (hMacCommon != null)
                 {
-                    _hMacCommon = null;
+                    _hMacCommon = null!;
                     hMacCommon.Dispose(disposing);
                 }
             }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA384.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA384.cs
index f242879ad96a11..3cea132703e8a5 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA384.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA384.cs
@@ -49,7 +49,7 @@ public bool ProduceLegacyHmacValues
             }
         }
 
-        public override byte[] Key
+        public override byte[]? Key
         {
             get
             {
@@ -87,7 +87,7 @@ protected override void Dispose(bool disposing)
                 HMACCommon hMacCommon = _hMacCommon;
                 if (hMacCommon != null)
                 {
-                    _hMacCommon = null;
+                    _hMacCommon = null!;
                     hMacCommon.Dispose(disposing);
                 }
             }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA512.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA512.cs
index abb0ee7afa63cc..9b4d7faddd7a4d 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA512.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA512.cs
@@ -47,7 +47,7 @@ public bool ProduceLegacyHmacValues
             }
         }
 
-        public override byte[] Key
+        public override byte[]? Key
         {
             get
             {
@@ -85,7 +85,7 @@ protected override void Dispose(bool disposing)
                 HMACCommon hMacCommon = _hMacCommon;
                 if (hMacCommon != null)
                 {
-                    _hMacCommon = null;
+                    _hMacCommon = null!;
                     hMacCommon.Dispose(disposing);
                 }
             }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/IncrementalHash.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/IncrementalHash.cs
index 709c56062695ee..a6060261c6a5e2 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/IncrementalHash.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/IncrementalHash.cs
@@ -13,8 +13,8 @@ namespace System.Security.Cryptography
     public sealed class IncrementalHash : IDisposable
     {
         private readonly HashAlgorithmName _algorithmName;
-        private HashProvider _hash;
-        private HMACCommon _hmac;
+        private HashProvider? _hash;
+        private HMACCommon? _hmac;
         private bool _disposed;
 
         private IncrementalHash(HashAlgorithmName name, HashProvider hash)
@@ -104,7 +104,7 @@ public void AppendData(ReadOnlySpan<byte> data)
             }
             else
             {
-                _hmac.AppendHashData(data);
+                _hmac!.AppendHashData(data);
             }
         }
 
@@ -125,7 +125,7 @@ public byte[] GetHashAndReset()
             Debug.Assert((_hash != null) ^ (_hmac != null));
             return _hash != null ?
                 _hash.FinalizeHashAndReset() :
-                _hmac.FinalizeHashAndReset();
+                _hmac!.FinalizeHashAndReset();
         }
 
         public bool TryGetHashAndReset(Span<byte> destination, out int bytesWritten)
@@ -138,7 +138,7 @@ public bool TryGetHashAndReset(Span<byte> destination, out int bytesWritten)
             Debug.Assert((_hash != null) ^ (_hmac != null));
             return _hash != null ?
                 _hash.TryFinalizeHashAndReset(destination, out bytesWritten) :
-                _hmac.TryFinalizeHashAndReset(destination, out bytesWritten);
+                _hmac!.TryFinalizeHashAndReset(destination, out bytesWritten);
         }
 
         /// <summary>
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/MD5.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/MD5.cs
index 44544bea49a67c..de027650a7d29c 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/MD5.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/MD5.cs
@@ -18,7 +18,7 @@ protected MD5() { }
 
         public static new MD5 Create() => new Implementation();
 
-        public static new MD5 Create(string algName) => (MD5)CryptoConfig.CreateFromName(algName);
+        public static new MD5? Create(string algName) => (MD5?)CryptoConfig.CreateFromName(algName);
 
         private sealed class Implementation : MD5
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/PKCS1MaskGenerationMethod.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/PKCS1MaskGenerationMethod.cs
index d5f34204b741dc..d8cfb35f159a5b 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/PKCS1MaskGenerationMethod.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/PKCS1MaskGenerationMethod.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+using System.Diagnostics;
 using Internal.Cryptography;
 
 namespace System.Security.Cryptography
@@ -24,7 +25,7 @@ public string HashName
 
         public override byte[] GenerateMask(byte[] rgbSeed, int cbReturn)
         {
-            using (HashAlgorithm hasher = CryptoConfig.CreateFromName(_hashNameValue) as HashAlgorithm)
+            using (HashAlgorithm? hasher = CryptoConfig.CreateFromName(_hashNameValue) as HashAlgorithm)
             {
                 if (hasher is null)
                 {
@@ -41,6 +42,7 @@ public override byte[] GenerateMask(byte[] rgbSeed, int cbReturn)
                     Helpers.ConvertIntToByteArray(counter++, rgbCounter);
                     hasher.TransformBlock(rgbSeed, 0, rgbSeed.Length, rgbSeed, 0);
                     hasher.TransformFinalBlock(rgbCounter, 0, 4);
+                    Debug.Assert(hasher.Hash != null);
                     byte[] hash = hasher.Hash;
                     hasher.Initialize();
                     Buffer.BlockCopy(hash, 0, rgbT, ib, Math.Min(rgbT.Length - ib, hash.Length));
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RC2.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RC2.cs
index 918db08b5db0ca..1300ff48e5ab69 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RC2.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RC2.cs
@@ -26,9 +26,9 @@ protected RC2()
             return new RC2Implementation();
         }
 
-        public static new RC2 Create(string AlgName)
+        public static new RC2? Create(string AlgName)
         {
-            return (RC2)CryptoConfig.CreateFromName(AlgName);
+            return (RC2?)CryptoConfig.CreateFromName(AlgName);
         }
 
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSA.Xml.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSA.Xml.cs
index cdccc5e4e2d191..8db68a5cb57d6c 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSA.Xml.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSA.Xml.cs
@@ -13,7 +13,7 @@ private static byte[] ReadRequiredElement(
             string name,
             int sizeHint = -1)
         {
-            byte[] ret = XmlKeyHelper.ReadCryptoBinary(ref state, name, sizeHint);
+            byte[]? ret = XmlKeyHelper.ReadCryptoBinary(ref state, name, sizeHint);
 
             if (ret == null)
             {
@@ -36,12 +36,12 @@ public override void FromXmlString(string xmlString)
 
             // .NET Framework doesn't report any element other than Modulus/Exponent as required,
             // it just lets import fail if they're imbalanced.
-            byte[] p = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(RSAParameters.P), halfN);
-            byte[] q = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(RSAParameters.Q), halfN);
-            byte[] dp = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(RSAParameters.DP), halfN);
-            byte[] dq = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(RSAParameters.DQ), halfN);
-            byte[] qInv = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(RSAParameters.InverseQ), halfN);
-            byte[] d = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(RSAParameters.D), n.Length);
+            byte[]? p = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(RSAParameters.P), halfN);
+            byte[]? q = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(RSAParameters.Q), halfN);
+            byte[]? dp = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(RSAParameters.DP), halfN);
+            byte[]? dq = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(RSAParameters.DQ), halfN);
+            byte[]? qInv = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(RSAParameters.InverseQ), halfN);
+            byte[]? d = XmlKeyHelper.ReadCryptoBinary(ref state, nameof(RSAParameters.D), n.Length);
 
             RSAParameters keyParameters = new RSAParameters
             {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSA.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSA.cs
index 3be56f9a19230f..d6b5d53218c112 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSA.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSA.cs
@@ -12,9 +12,9 @@ namespace System.Security.Cryptography
 {
     public abstract partial class RSA : AsymmetricAlgorithm
     {
-        public static new RSA Create(string algName)
+        public static new RSA? Create(string algName)
         {
-            return (RSA)CryptoConfig.CreateFromName(algName);
+            return (RSA?)CryptoConfig.CreateFromName(algName);
         }
 
         public static RSA Create(int keySizeInBits)
@@ -211,9 +211,6 @@ public virtual bool TrySignData(ReadOnlySpan<byte> data, Span<byte> destination,
 
         public bool VerifyData(byte[] data, byte[] signature, HashAlgorithmName hashAlgorithm, RSASignaturePadding padding)
         {
-            if (data == null)
-                throw new ArgumentNullException(nameof(data));
-
             return VerifyData(data, 0, data.Length, signature, hashAlgorithm, padding);
         }
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSACng.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSACng.cs
index 614ea7a45e9856..c4d873fb9c3158 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSACng.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSACng.cs
@@ -20,7 +20,7 @@ internal static partial class RSAImplementation
     {
         public sealed partial class RSACng : RSA
         {
-            private SafeNCryptKeyHandle _keyHandle;
+            private SafeNCryptKeyHandle? _keyHandle;
             private int _lastKeySize;
             private bool _disposed;
 
@@ -51,7 +51,7 @@ private SafeNCryptKeyHandle GetDuplicatedKeyHandle()
                     _lastKeySize = keySize;
                 }
 
-                return new DuplicateSafeNCryptKeyHandle(_keyHandle);
+                return new DuplicateSafeNCryptKeyHandle(_keyHandle!);
             }
 
             private byte[] ExportKeyBlob(bool includePrivateParameters)
@@ -142,7 +142,7 @@ protected override void Dispose(bool disposing)
                 if (disposing)
                 {
                     _keyHandle?.Dispose();
-                    _keyHandle = null;
+                    _keyHandle = null!;
                     _disposed = true;
                 }
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAEncryptionPadding.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAEncryptionPadding.cs
index 422cad859ff571..f7921cd07afc8d 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAEncryptionPadding.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAEncryptionPadding.cs
@@ -93,19 +93,19 @@ private static int CombineHashCodes(int h1, int h2)
             return (((h1 << 5) + h1) ^ h2);
         }
 
-        public override bool Equals(object obj)
+        public override bool Equals(object? obj)
         {
             return Equals(obj as RSAEncryptionPadding);
         }
 
-        public bool Equals(RSAEncryptionPadding other)
+        public bool Equals(RSAEncryptionPadding? other)
         {
             return !object.ReferenceEquals(other, null)
                 && _mode == other._mode
                 && _oaepHashAlgorithm == other._oaepHashAlgorithm;
         }
 
-        public static bool operator ==(RSAEncryptionPadding left, RSAEncryptionPadding right)
+        public static bool operator ==(RSAEncryptionPadding? left, RSAEncryptionPadding? right)
         {
             if (object.ReferenceEquals(left, null))
             {
@@ -115,7 +115,7 @@ public bool Equals(RSAEncryptionPadding other)
             return left.Equals(right);
         }
 
-        public static bool operator !=(RSAEncryptionPadding left, RSAEncryptionPadding right)
+        public static bool operator !=(RSAEncryptionPadding? left, RSAEncryptionPadding? right)
         {
             return !(left == right);
         }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAOAEPKeyExchangeDeformatter.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAOAEPKeyExchangeDeformatter.cs
index 898233372d95e6..ec7c7fcdcd925f 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAOAEPKeyExchangeDeformatter.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAOAEPKeyExchangeDeformatter.cs
@@ -6,7 +6,7 @@ namespace System.Security.Cryptography
 {
     public class RSAOAEPKeyExchangeDeformatter : AsymmetricKeyExchangeDeformatter
     {
-        private RSA _rsaKey;
+        private RSA? _rsaKey;
 
         public RSAOAEPKeyExchangeDeformatter() { }
         public RSAOAEPKeyExchangeDeformatter(AsymmetricAlgorithm key)
@@ -17,7 +17,7 @@ public RSAOAEPKeyExchangeDeformatter(AsymmetricAlgorithm key)
             _rsaKey = (RSA)key;
         }
 
-        public override string Parameters
+        public override string? Parameters
         {
             get { return null; }
             set { }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAOAEPKeyExchangeFormatter.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAOAEPKeyExchangeFormatter.cs
index df67717df76028..5ebceb1ff7456e 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAOAEPKeyExchangeFormatter.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAOAEPKeyExchangeFormatter.cs
@@ -6,9 +6,9 @@ namespace System.Security.Cryptography
 {
     public class RSAOAEPKeyExchangeFormatter : AsymmetricKeyExchangeFormatter
     {
-        private byte[] ParameterValue;
-        private RSA _rsaKey;
-        private RandomNumberGenerator RngValue;
+        private byte[]? ParameterValue;
+        private RSA? _rsaKey;
+        private RandomNumberGenerator? RngValue;
 
         public RSAOAEPKeyExchangeFormatter() { }
         public RSAOAEPKeyExchangeFormatter(AsymmetricAlgorithm key)
@@ -19,7 +19,7 @@ public RSAOAEPKeyExchangeFormatter(AsymmetricAlgorithm key)
             _rsaKey = (RSA)key;
         }
 
-        public byte[] Parameter
+        public byte[]? Parameter
         {
             get
             {
@@ -43,12 +43,12 @@ public byte[] Parameter
             }
         }
 
-        public override string Parameters
+        public override string? Parameters
         {
             get { return null; }
         }
 
-        public RandomNumberGenerator Rng
+        public RandomNumberGenerator? Rng
         {
             get { return RngValue; }
             set { RngValue = value; }
@@ -62,7 +62,7 @@ public override void SetKey(AsymmetricAlgorithm key)
             _rsaKey = (RSA)key;
         }
 
-        public override byte[] CreateKeyExchange(byte[] rgbData, Type symAlgType)
+        public override byte[] CreateKeyExchange(byte[] rgbData, Type? symAlgType)
         {
             return CreateKeyExchange(rgbData);
         }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAPKCS1KeyExchangeDeformatter.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAPKCS1KeyExchangeDeformatter.cs
index d69b14cba02fff..6e8dc4764ebd87 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAPKCS1KeyExchangeDeformatter.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAPKCS1KeyExchangeDeformatter.cs
@@ -6,8 +6,8 @@ namespace System.Security.Cryptography
 {
     public class RSAPKCS1KeyExchangeDeformatter : AsymmetricKeyExchangeDeformatter
     {
-        private RSA _rsaKey;
-        private RandomNumberGenerator RngValue;
+        private RSA? _rsaKey;
+        private RandomNumberGenerator? RngValue;
 
         public RSAPKCS1KeyExchangeDeformatter() { }
 
@@ -19,13 +19,13 @@ public RSAPKCS1KeyExchangeDeformatter(AsymmetricAlgorithm key)
             _rsaKey = (RSA)key;
         }
 
-        public RandomNumberGenerator RNG
+        public RandomNumberGenerator? RNG
         {
             get { return RngValue; }
             set { RngValue = value; }
         }
 
-        public override string Parameters
+        public override string? Parameters
         {
             get { return null; }
             set { }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAPKCS1KeyExchangeFormatter.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAPKCS1KeyExchangeFormatter.cs
index 37f541e3df2e76..5151e6a05ca26b 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAPKCS1KeyExchangeFormatter.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAPKCS1KeyExchangeFormatter.cs
@@ -6,8 +6,8 @@ namespace System.Security.Cryptography
 {
     public class RSAPKCS1KeyExchangeFormatter : AsymmetricKeyExchangeFormatter
     {
-        private RSA _rsaKey;
-        private RandomNumberGenerator RngValue;
+        private RSA? _rsaKey;
+        private RandomNumberGenerator? RngValue;
 
         public RSAPKCS1KeyExchangeFormatter() { }
 
@@ -27,7 +27,7 @@ public override string Parameters
             }
         }
 
-        public RandomNumberGenerator Rng
+        public RandomNumberGenerator? Rng
         {
             get { return RngValue; }
             set { RngValue = value; }
@@ -41,7 +41,7 @@ public override void SetKey(AsymmetricAlgorithm key)
             _rsaKey = (RSA)key;
         }
 
-        public override byte[] CreateKeyExchange(byte[] rgbData, Type symAlgType)
+        public override byte[] CreateKeyExchange(byte[] rgbData, Type? symAlgType)
         {
             return CreateKeyExchange(rgbData);
         }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAPKCS1SignatureDeformatter.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAPKCS1SignatureDeformatter.cs
index cde2c1ae7d0fb6..aee42a7a513bbd 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAPKCS1SignatureDeformatter.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAPKCS1SignatureDeformatter.cs
@@ -8,8 +8,8 @@ namespace System.Security.Cryptography
 {
     public class RSAPKCS1SignatureDeformatter : AsymmetricSignatureDeformatter
     {
-        private RSA _rsaKey;
-        private string _algName;
+        private RSA? _rsaKey;
+        private string? _algName;
 
         public RSAPKCS1SignatureDeformatter() { }
         public RSAPKCS1SignatureDeformatter(AsymmetricAlgorithm key)
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAPKCS1SignatureFormatter.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAPKCS1SignatureFormatter.cs
index 2db257cb543002..2f223d74e25de1 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAPKCS1SignatureFormatter.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAPKCS1SignatureFormatter.cs
@@ -8,8 +8,8 @@ namespace System.Security.Cryptography
 {
     public class RSAPKCS1SignatureFormatter : AsymmetricSignatureFormatter
     {
-        private RSA _rsaKey;
-        private string _algName;
+        private RSA? _rsaKey;
+        private string? _algName;
 
         public RSAPKCS1SignatureFormatter() { }
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAParameters.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAParameters.cs
index 9a728debee127b..ee69dc3ac2aeb4 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAParameters.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAParameters.cs
@@ -11,13 +11,13 @@ namespace System.Security.Cryptography
     [System.Runtime.InteropServices.StructLayoutAttribute(System.Runtime.InteropServices.LayoutKind.Sequential)]
     public struct RSAParameters
     {
-        public byte[] D;
-        public byte[] DP;
-        public byte[] DQ;
+        public byte[]? D;
+        public byte[]? DP;
+        public byte[]? DQ;
         public byte[] Exponent;
-        public byte[] InverseQ;
+        public byte[]? InverseQ;
         public byte[] Modulus;
-        public byte[] P;
-        public byte[] Q;
+        public byte[]? P;
+        public byte[]? Q;
     }
 }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSASignaturePadding.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSASignaturePadding.cs
index 60059b19808b33..6bfa15d4ad9d7d 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSASignaturePadding.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSASignaturePadding.cs
@@ -52,17 +52,17 @@ public override int GetHashCode()
             return _mode.GetHashCode();
         }
 
-        public override bool Equals(object obj)
+        public override bool Equals(object? obj)
         {
             return Equals(obj as RSASignaturePadding);
         }
 
-        public bool Equals(RSASignaturePadding other)
+        public bool Equals(RSASignaturePadding? other)
         {
             return !object.ReferenceEquals(other, null) && _mode == other._mode;
         }
 
-        public static bool operator ==(RSASignaturePadding left, RSASignaturePadding right)
+        public static bool operator ==(RSASignaturePadding? left, RSASignaturePadding? right)
         {
             if (object.ReferenceEquals(left, null))
             {
@@ -72,7 +72,7 @@ public bool Equals(RSASignaturePadding other)
             return left.Equals(right);
         }
 
-        public static bool operator !=(RSASignaturePadding left, RSASignaturePadding right)
+        public static bool operator !=(RSASignaturePadding? left, RSASignaturePadding? right)
         {
             return !(left == right);
         }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RandomNumberGenerator.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RandomNumberGenerator.cs
index 1986d564243fd0..783c73712aec5f 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RandomNumberGenerator.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RandomNumberGenerator.cs
@@ -16,9 +16,9 @@ public static RandomNumberGenerator Create()
             return new RandomNumberGeneratorImplementation();
         }
 
-        public static RandomNumberGenerator Create(string rngName)
+        public static RandomNumberGenerator? Create(string rngName)
         {
-            return (RandomNumberGenerator)CryptoConfig.CreateFromName(rngName);
+            return (RandomNumberGenerator?)CryptoConfig.CreateFromName(rngName);
         }
 
         public void Dispose()
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/Rfc2898DeriveBytes.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/Rfc2898DeriveBytes.cs
index 4e2f80aefa5a3b..70cb65e4ec5cd1 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/Rfc2898DeriveBytes.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/Rfc2898DeriveBytes.cs
@@ -20,7 +20,7 @@ public class Rfc2898DeriveBytes : DeriveBytes
         private HMAC _hmac;
         private readonly int _blockSize;
 
-        private byte[] _buffer;
+        private byte[] _buffer = null!; // Initialized in helper
         private uint _block;
         private int _startIndex;
         private int _endIndex;
@@ -145,7 +145,7 @@ protected override void Dispose(bool disposing)
                 if (_hmac != null)
                 {
                     _hmac.Dispose();
-                    _hmac = null;
+                    _hmac = null!;
                 }
 
                 if (_buffer != null)
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/Rijndael.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/Rijndael.cs
index 8987960de80f4d..7ab00ed73132b4 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/Rijndael.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/Rijndael.cs
@@ -15,9 +15,9 @@ public abstract class Rijndael : SymmetricAlgorithm
             return new RijndaelImplementation();
         }
 
-        public static new Rijndael Create(string algName)
+        public static new Rijndael? Create(string algName)
         {
-            return (Rijndael)CryptoConfig.CreateFromName(algName);
+            return (Rijndael?)CryptoConfig.CreateFromName(algName);
         }
 
         protected Rijndael()
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SHA1.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SHA1.cs
index 7de08ada0af265..23a37ebc94c213 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SHA1.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SHA1.cs
@@ -19,7 +19,7 @@ protected SHA1() { }
         [System.Diagnostics.CodeAnalysis.SuppressMessage("Microsoft.Security", "CA5350", Justification = "This is the implementaton of SHA1")]
         public static new SHA1 Create() => new Implementation();
 
-        public static new SHA1 Create(string hashName) => (SHA1)CryptoConfig.CreateFromName(hashName);
+        public static new SHA1? Create(string hashName) => (SHA1?)CryptoConfig.CreateFromName(hashName);
 
         private sealed class Implementation : SHA1
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SHA256.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SHA256.cs
index 0e8d2980b4c269..104d5b281ed8c2 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SHA256.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SHA256.cs
@@ -18,7 +18,7 @@ protected SHA256() { }
 
         public static new SHA256 Create() => new Implementation();
 
-        public static new SHA256 Create(string hashName) => (SHA256)CryptoConfig.CreateFromName(hashName);
+        public static new SHA256? Create(string hashName) => (SHA256?)CryptoConfig.CreateFromName(hashName);
 
         private sealed class Implementation : SHA256
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SHA384.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SHA384.cs
index 242d7cfa9c17a8..c38b60cd25253f 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SHA384.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SHA384.cs
@@ -18,7 +18,7 @@ protected SHA384() { }
 
         public static new SHA384 Create() => new Implementation();
 
-        public static new SHA384 Create(string hashName) => (SHA384)CryptoConfig.CreateFromName(hashName);
+        public static new SHA384? Create(string hashName) => (SHA384?)CryptoConfig.CreateFromName(hashName);
 
         private sealed class Implementation : SHA384
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SHA512.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SHA512.cs
index fcf19de9576462..434c51370000e3 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SHA512.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SHA512.cs
@@ -18,7 +18,7 @@ protected SHA512() { }
 
         public static new SHA512 Create() => new Implementation();
 
-        public static new SHA512 Create(string hashName) => (SHA512)CryptoConfig.CreateFromName(hashName);
+        public static new SHA512? Create(string hashName) => (SHA512?)CryptoConfig.CreateFromName(hashName);
 
         private sealed class Implementation : SHA512
         {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SignatureDescription.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SignatureDescription.cs
index 8459387a0d4f81..13a14d9ec11b06 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SignatureDescription.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SignatureDescription.cs
@@ -2,14 +2,16 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+using System.Diagnostics;
+
 namespace System.Security.Cryptography
 {
     public class SignatureDescription
     {
-        public string KeyAlgorithm { get; set; }
-        public string DigestAlgorithm { get; set; }
-        public string FormatterAlgorithm { get; set; }
-        public string DeformatterAlgorithm { get; set; }
+        public string? KeyAlgorithm { get; set; }
+        public string? DigestAlgorithm { get; set; }
+        public string? FormatterAlgorithm { get; set; }
+        public string? DeformatterAlgorithm { get; set; }
 
         public SignatureDescription()
         {
@@ -27,21 +29,26 @@ public SignatureDescription(SecurityElement el)
 
         public virtual AsymmetricSignatureDeformatter CreateDeformatter(AsymmetricAlgorithm key)
         {
-            AsymmetricSignatureDeformatter item = (AsymmetricSignatureDeformatter)CryptoConfig.CreateFromName(DeformatterAlgorithm);
+            Debug.Assert(DeformatterAlgorithm != null);
+            AsymmetricSignatureDeformatter? item = (AsymmetricSignatureDeformatter?)CryptoConfig.CreateFromName(DeformatterAlgorithm);
+            Debug.Assert(item != null);
             item.SetKey(key);
             return item;
         }
 
         public virtual AsymmetricSignatureFormatter CreateFormatter(AsymmetricAlgorithm key)
         {
-            AsymmetricSignatureFormatter item = (AsymmetricSignatureFormatter)CryptoConfig.CreateFromName(FormatterAlgorithm);
+            Debug.Assert(FormatterAlgorithm != null);
+            AsymmetricSignatureFormatter? item = (AsymmetricSignatureFormatter?)CryptoConfig.CreateFromName(FormatterAlgorithm);
+            Debug.Assert(item != null);
             item.SetKey(key);
             return item;
         }
 
-        public virtual HashAlgorithm CreateDigest()
+        public virtual HashAlgorithm? CreateDigest()
         {
-            return (HashAlgorithm)CryptoConfig.CreateFromName(DigestAlgorithm);
+            Debug.Assert(DigestAlgorithm != null);
+            return (HashAlgorithm?)CryptoConfig.CreateFromName(DigestAlgorithm);
         }
     }
-}
\ No newline at end of file
+}
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/TripleDES.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/TripleDES.cs
index 2738ab2d86915a..5bf4cadef9e023 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/TripleDES.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/TripleDES.cs
@@ -25,9 +25,9 @@ protected TripleDES()
             return new TripleDesImplementation();
         }
 
-        public static new TripleDES Create(string str)
+        public static new TripleDES? Create(string str)
         {
-            return (TripleDES)CryptoConfig.CreateFromName(str);
+            return (TripleDES?)CryptoConfig.CreateFromName(str);
         }
 
         public override byte[] Key
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/XmlKeyHelper.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/XmlKeyHelper.cs
index af965fc076892b..9012886b3ed084 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/XmlKeyHelper.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/XmlKeyHelper.cs
@@ -34,9 +34,9 @@ internal static bool HasElement(ref ParseState state, string name)
             return state.HasElement(name);
         }
 
-        internal static byte[] ReadCryptoBinary(ref ParseState state, string name, int sizeHint = -1)
+        internal static byte[]? ReadCryptoBinary(ref ParseState state, string name, int sizeHint = -1)
         {
-            string value = state.GetValue(name);
+            string? value = state.GetValue(name);
 
             if (value == null)
             {
@@ -166,13 +166,13 @@ internal static void WriteCryptoBinary(string name, ReadOnlySpan<byte> value, St
 
         internal struct ParseState
         {
-            private IEnumerable _enumerable;
-            private IEnumerator _enumerator;
+            private IEnumerable? _enumerable;
+            private IEnumerator? _enumerator;
             private int _index;
 
             internal static ParseState ParseDocument(string xmlString)
             {
-                object rootElement = Functions.ParseDocument(xmlString);
+                object? rootElement = Functions.ParseDocument(xmlString);
 
                 return new ParseState
                 {
@@ -184,7 +184,7 @@ internal static ParseState ParseDocument(string xmlString)
 
             internal bool HasElement(string localName)
             {
-                string value = GetValue(localName);
+                string? value = GetValue(localName);
 
                 bool ret = value != null;
 
@@ -198,7 +198,7 @@ internal bool HasElement(string localName)
                 return ret;
             }
 
-            internal string GetValue(string localName)
+            internal string? GetValue(string localName)
             {
                 if (_enumerable == null)
                 {
@@ -229,7 +229,7 @@ internal string GetValue(string localName)
 
                 while (idx != origIdx)
                 {
-                    string curName = Functions.GetLocalName(_enumerator.Current);
+                    string? curName = Functions.GetLocalName(_enumerator.Current);
 
                     if (localName == curName)
                     {
@@ -265,36 +265,36 @@ internal string GetValue(string localName)
 
             private static class Functions
             {
-                private static readonly Type s_xDocument = Type.GetType("System.Xml.Linq.XDocument, System.Private.Xml.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51");
+                private static readonly Type s_xDocument = Type.GetType("System.Xml.Linq.XDocument, System.Private.Xml.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=cc7b13ffcd2ddd51")!;
                 private static readonly Func<string, object> s_xDocumentCreate =
                     (Func<string, object>)s_xDocument.GetMethod(
                         "Parse",
                         BindingFlags.Static | BindingFlags.Public,
                         null,
                         new[] { typeof(string) },
-                        null).CreateDelegate(typeof(Func<string, object>));
-                private static readonly PropertyInfo s_docRootProperty = s_xDocument.GetProperty("Root");
+                        null)!.CreateDelegate(typeof(Func<string, object>));
+                private static readonly PropertyInfo s_docRootProperty = s_xDocument.GetProperty("Root")!;
                 private static readonly MethodInfo s_getElementsMethod = s_docRootProperty.PropertyType.GetMethod(
                         "Elements",
                         BindingFlags.Instance | BindingFlags.Public,
                         null,
                         Array.Empty<Type>(),
-                        null);
-                private static readonly PropertyInfo s_elementNameProperty = s_docRootProperty.PropertyType.GetProperty("Name");
-                private static readonly PropertyInfo s_nameNameProperty = s_elementNameProperty.PropertyType.GetProperty("LocalName");
-                private static readonly PropertyInfo s_elementValueProperty = s_docRootProperty.PropertyType.GetProperty("Value");
+                        null)!;
+                private static readonly PropertyInfo s_elementNameProperty = s_docRootProperty.PropertyType.GetProperty("Name")!;
+                private static readonly PropertyInfo s_nameNameProperty = s_elementNameProperty.PropertyType.GetProperty("LocalName")!;
+                private static readonly PropertyInfo s_elementValueProperty = s_docRootProperty.PropertyType.GetProperty("Value")!;
 
-                internal static object ParseDocument(string xmlString) =>
+                internal static object? ParseDocument(string xmlString) =>
                     s_docRootProperty.GetValue(s_xDocumentCreate(xmlString));
 
-                internal static IEnumerable GetElements(object element) =>
-                    (IEnumerable)s_getElementsMethod.Invoke(element, Array.Empty<object>());
+                internal static IEnumerable? GetElements(object? element) =>
+                    (IEnumerable?)s_getElementsMethod.Invoke(element, Array.Empty<object>());
 
-                internal static string GetLocalName(object element) =>
-                    (string)s_nameNameProperty.GetValue(s_elementNameProperty.GetValue(element));
+                internal static string? GetLocalName(object? element) =>
+                    (string?)s_nameNameProperty.GetValue(s_elementNameProperty.GetValue(element));
 
-                internal static string GetValue(object element) =>
-                    (string)s_elementValueProperty.GetValue(element);
+                internal static string? GetValue(object? element) =>
+                    (string?)s_elementValueProperty.GetValue(element);
             }
         }
     }

From a9267487bd9b6815f408b9021038e56733c5a6cc Mon Sep 17 00:00:00 2001
From: Buyaa Namnan <bunamnan@microsoft.com>
Date: Wed, 29 Jan 2020 16:46:40 -0800
Subject: [PATCH 02/13] enabling nullable for common files

---
 .../Common/src/Internal/Cryptography/BasicSymmetricCipher.cs     | 1 +
 .../Common/src/Internal/Cryptography/HashProviderCng.cs          | 1 +
 .../Unix/System.Security.Cryptography.Native/Interop.Bignum.cs   | 1 +
 .../Unix/System.Security.Cryptography.Native/Interop.Dsa.cs      | 1 +
 .../Interop.EcDsa.ImportExport.cs                                | 1 +
 .../src/Interop/Windows/BCrypt/Interop.BCryptEncryptDecrypt.cs   | 1 +
 .../Windows/BCrypt/Interop.BCryptOpenAlgorithmProvider.cs        | 1 +
 .../Common/src/Microsoft/Win32/SafeHandles/SafeHandleCache.cs    | 1 +
 8 files changed, 8 insertions(+)

diff --git a/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipher.cs b/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipher.cs
index 55fcb2bd8ac880..2d08f83e9520dc 100644
--- a/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipher.cs
+++ b/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipher.cs
@@ -6,6 +6,7 @@
 using System.Diagnostics;
 using System.Security.Cryptography;
 
+#nullable enable
 namespace Internal.Cryptography
 {
     //
diff --git a/src/libraries/Common/src/Internal/Cryptography/HashProviderCng.cs b/src/libraries/Common/src/Internal/Cryptography/HashProviderCng.cs
index 29e29f4351789e..4102f7fbd410be 100644
--- a/src/libraries/Common/src/Internal/Cryptography/HashProviderCng.cs
+++ b/src/libraries/Common/src/Internal/Cryptography/HashProviderCng.cs
@@ -9,6 +9,7 @@
 using BCryptOpenAlgorithmProviderFlags = Interop.BCrypt.BCryptOpenAlgorithmProviderFlags;
 using BCryptCreateHashFlags = Interop.BCrypt.BCryptCreateHashFlags;
 
+#nullable enable
 namespace Internal.Cryptography
 {
     //
diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Bignum.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Bignum.cs
index 9bb3f920c6eb88..f86d7618f8bd74 100644
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Bignum.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Bignum.cs
@@ -7,6 +7,7 @@
 using System.Runtime.InteropServices;
 using Microsoft.Win32.SafeHandles;
 
+#nullable enable
 internal static partial class Interop
 {
     internal static partial class Crypto
diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Dsa.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Dsa.cs
index 629a7d9a707ed5..17b819da201578 100644
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Dsa.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Dsa.cs
@@ -8,6 +8,7 @@
 using System.Security.Cryptography;
 using Microsoft.Win32.SafeHandles;
 
+#nullable enable
 internal static partial class Interop
 {
     internal static partial class Crypto
diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs
index 773e54dd55f801..21bff8c8b17d6f 100644
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs
@@ -8,6 +8,7 @@
 using Microsoft.Win32.SafeHandles;
 using System;
 
+#nullable enable
 internal static partial class Interop
 {
     internal static partial class Crypto
diff --git a/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptEncryptDecrypt.cs b/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptEncryptDecrypt.cs
index 5b0aca93c1d4cd..4f97ca0bfe87cb 100644
--- a/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptEncryptDecrypt.cs
+++ b/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptEncryptDecrypt.cs
@@ -8,6 +8,7 @@
 using Internal.NativeCrypto;
 using Microsoft.Win32.SafeHandles;
 
+#nullable enable
 internal static partial class Interop
 {
     internal static partial class BCrypt
diff --git a/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptOpenAlgorithmProvider.cs b/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptOpenAlgorithmProvider.cs
index 9ef01d5364c332..c9fb6c17787003 100644
--- a/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptOpenAlgorithmProvider.cs
+++ b/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptOpenAlgorithmProvider.cs
@@ -8,6 +8,7 @@
 
 using Microsoft.Win32.SafeHandles;
 
+#nullable enable
 internal partial class Interop
 {
     internal partial class BCrypt
diff --git a/src/libraries/Common/src/Microsoft/Win32/SafeHandles/SafeHandleCache.cs b/src/libraries/Common/src/Microsoft/Win32/SafeHandles/SafeHandleCache.cs
index 37ee704c1d9619..13aefb9ad565e8 100644
--- a/src/libraries/Common/src/Microsoft/Win32/SafeHandles/SafeHandleCache.cs
+++ b/src/libraries/Common/src/Microsoft/Win32/SafeHandles/SafeHandleCache.cs
@@ -7,6 +7,7 @@
 using System.Runtime.InteropServices;
 using System.Threading;
 
+#nullable enable
 namespace Microsoft.Win32.SafeHandles
 {
     /// <summary>Provides a cache for special instances of SafeHandles.</summary>

From 0ef7a862e7c78fe2c3a7d93584bad4eaff3370fb Mon Sep 17 00:00:00 2001
From: Buyaa Namnan <bunamnan@microsoft.com>
Date: Thu, 30 Jan 2020 11:06:25 -0800
Subject: [PATCH 03/13] Addressing feedback

---
 .../Cryptography/BasicSymmetricCipherBCrypt.cs  |  3 ++-
 .../Cryptography/UniversalCryptoDecryptor.cs    |  1 +
 .../Interop.Bignum.cs                           |  5 ++---
 .../Interop.Dsa.cs                              | 10 +++++-----
 .../Interop.ERR.cs                              |  2 +-
 .../Interop.EcDsa.ImportExport.cs               | 16 ++++++++--------
 .../Interop.EcKey.cs                            |  1 +
 .../Interop.Rsa.cs                              |  5 +++--
 .../BCrypt/Interop.BCryptEncryptDecrypt.cs      |  2 +-
 .../Interop.BCryptOpenAlgorithmProvider.cs      |  2 +-
 .../Win32/SafeHandles/SafeHandleCache.cs        |  2 +-
 .../Win32/SafeHandles/SafeInteriorHandle.cs     |  2 +-
 .../src/System/Security/Cryptography/DSACng.cs  |  1 +
 .../Cryptography/ECCng.HashAlgorithm.cs         |  1 +
 .../Security/Cryptography/ECCng.ImportExport.cs | 17 +++++++++--------
 .../System/Security/Cryptography/ECOpenSsl.cs   |  3 +--
 .../Security/Cryptography/EccKeyFormatHelper.cs |  6 +++---
 .../System/Security/Cryptography/RSAOpenSsl.cs  |  1 +
 .../Cryptography/RSASecurityTransforms.cs       |  2 +-
 .../System.Security.Cryptography.Algorithms.sln |  4 ++--
 .../System.Security.Cryptography.Algorithms.cs  |  4 ++--
 .../src/System/Security/Cryptography/ECDsa.cs   |  6 ++++++
 .../src/System/Security/Cryptography/ECPoint.cs |  4 ++--
 .../src/System/Security/Cryptography/RSA.cs     |  3 +++
 .../Cryptography/SignatureDescription.cs        |  6 ++----
 25 files changed, 61 insertions(+), 48 deletions(-)

diff --git a/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipherBCrypt.cs b/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipherBCrypt.cs
index 4ddb46101484f3..e8ee331c6a7e38 100644
--- a/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipherBCrypt.cs
+++ b/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipherBCrypt.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Security.Cryptography;
@@ -14,7 +15,7 @@ internal sealed class BasicSymmetricCipherBCrypt : BasicSymmetricCipher
         private readonly bool _encrypting;
         private SafeKeyHandle _hKey;
         private byte[]? _currentIv;  // CNG mutates this with the updated IV for the next stage on each Encrypt/Decrypt call.
-                                    // The base IV holds a copy of the original IV for Reset(), until it is cleared by Dispose().
+                                     // The base IV holds a copy of the original IV for Reset(), until it is cleared by Dispose().
 
         public BasicSymmetricCipherBCrypt(SafeAlgorithmHandle algorithm, CipherMode cipherMode, int blockSizeInBytes, byte[] key, bool ownsParentHandle, byte[]? iv, bool encrypting)
             : base(cipherMode.GetCipherIv(iv), blockSizeInBytes)
diff --git a/src/libraries/Common/src/Internal/Cryptography/UniversalCryptoDecryptor.cs b/src/libraries/Common/src/Internal/Cryptography/UniversalCryptoDecryptor.cs
index 4689e0cea0e13a..c7cdc14b2463da 100644
--- a/src/libraries/Common/src/Internal/Cryptography/UniversalCryptoDecryptor.cs
+++ b/src/libraries/Common/src/Internal/Cryptography/UniversalCryptoDecryptor.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Security.Cryptography;
diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Bignum.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Bignum.cs
index f86d7618f8bd74..02f5f13a556862 100644
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Bignum.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Bignum.cs
@@ -2,12 +2,12 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics.CodeAnalysis;
 using System.Runtime.InteropServices;
 using Microsoft.Win32.SafeHandles;
 
-#nullable enable
 internal static partial class Interop
 {
     internal static partial class Crypto
@@ -47,7 +47,7 @@ internal static SafeBignumHandle CreateBignum(byte[] bigEndianValue)
             return new SafeBignumHandle(handle, true);
         }
 
-        internal static byte[] ExtractBignum(IntPtr bignum, int targetSize)
+        internal static byte[]? ExtractBignum(IntPtr bignum, int targetSize)
         {
             // Given that the only reference held to bignum is an IntPtr, create an unowned SafeHandle
             // to ensure that we don't destroy the key after extraction.
@@ -57,7 +57,6 @@ internal static byte[] ExtractBignum(IntPtr bignum, int targetSize)
             }
         }
 
-        [return: NotNullIfNotNull("bignum")]
         private static unsafe byte[]? ExtractBignum(SafeBignumHandle? bignum, int targetSize)
         {
             if (bignum == null || bignum.IsInvalid)
diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Dsa.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Dsa.cs
index 17b819da201578..0949efff44911c 100644
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Dsa.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Dsa.cs
@@ -2,13 +2,13 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Runtime.InteropServices;
 using System.Security.Cryptography;
 using Microsoft.Win32.SafeHandles;
 
-#nullable enable
 internal static partial class Interop
 {
     internal static partial class Crypto
@@ -126,10 +126,10 @@ internal static DSAParameters ExportDsaParameters(SafeDsaHandle key, bool includ
 
                 DSAParameters dsaParameters = new DSAParameters
                 {
-                    P = Crypto.ExtractBignum(p_bn, pgy_cb),
-                    Q = Crypto.ExtractBignum(q_bn, qx_cb),
-                    G = Crypto.ExtractBignum(g_bn, pgy_cb),
-                    Y = Crypto.ExtractBignum(y_bn, pgy_cb),
+                    P = Crypto.ExtractBignum(p_bn, pgy_cb)!,
+                    Q = Crypto.ExtractBignum(q_bn, qx_cb)!,
+                    G = Crypto.ExtractBignum(g_bn, pgy_cb)!,
+                    Y = Crypto.ExtractBignum(y_bn, pgy_cb)!,
                 };
 
                 if (includePrivateParameters)
diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.ERR.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.ERR.cs
index 2d945c7f33d076..a98241ca5417e4 100644
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.ERR.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.ERR.cs
@@ -2,12 +2,12 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Runtime.InteropServices;
 using System.Security.Cryptography;
 
-#nullable enable
 internal static partial class Interop
 {
     internal static partial class Crypto
diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs
index 21bff8c8b17d6f..41017b9ab78051 100644
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs
@@ -2,13 +2,13 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Diagnostics;
 using System.Runtime.InteropServices;
 using System.Security.Cryptography;
 using Microsoft.Win32.SafeHandles;
 using System;
 
-#nullable enable
 internal static partial class Interop
 {
     internal static partial class Crypto
@@ -78,8 +78,8 @@ internal static SafeEcKeyHandle EcKeyCreateByExplicitCurve(ECCurve curve)
                 p, p.Length,
                 curve.A, curve.A.Length,
                 curve.B, curve.B.Length,
-                curve.G.X, curve.G.X.Length,
-                curve.G.Y, curve.G.Y.Length,
+                curve.G.X!, curve.G.X!.Length,
+                curve.G.Y!, curve.G.Y!.Length,
                 curve.Order, curve.Order.Length,
                 curve.Cofactor, curve.Cofactor!.Length,
                 curve.Seed, curve.Seed == null ? 0 : curve.Seed.Length);
@@ -265,22 +265,22 @@ internal static ECParameters GetECCurveParameters(
 
                     var curve = parameters.Curve;
                     curve.CurveType = curveType;
-                    curve.A = Crypto.ExtractBignum(a_bn, cbFieldLength);
-                    curve.B = Crypto.ExtractBignum(b_bn, cbFieldLength);
+                    curve.A = Crypto.ExtractBignum(a_bn, cbFieldLength)!;
+                    curve.B = Crypto.ExtractBignum(b_bn, cbFieldLength)!;
                     curve.G = new ECPoint
                     {
                         X = Crypto.ExtractBignum(gx_bn, cbFieldLength),
                         Y = Crypto.ExtractBignum(gy_bn, cbFieldLength)
                     };
-                    curve.Order = Crypto.ExtractBignum(order_bn, cbSubgroupOrder);
+                    curve.Order = Crypto.ExtractBignum(order_bn, cbSubgroupOrder)!;
 
                     if (curveType == ECCurve.ECCurveType.Characteristic2)
                     {
-                        curve.Polynomial = Crypto.ExtractBignum(p_bn, pFieldLength);
+                        curve.Polynomial = Crypto.ExtractBignum(p_bn, pFieldLength)!;
                     }
                     else
                     {
-                        curve.Prime = Crypto.ExtractBignum(p_bn, pFieldLength);
+                        curve.Prime = Crypto.ExtractBignum(p_bn, pFieldLength)!;
                     }
 
                     // Optional parameters
diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcKey.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcKey.cs
index 02b027eb67066d..bf78e9c7cd229d 100644
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcKey.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcKey.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using Microsoft.Win32.SafeHandles;
 using System;
 using System.Diagnostics;
diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Rsa.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Rsa.cs
index 0e443ff0ec7a61..e6fbc4ee01fb40 100644
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Rsa.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Rsa.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Runtime.InteropServices;
@@ -153,8 +154,8 @@ internal static RSAParameters ExportRsaParameters(SafeRsaHandle key, bool includ
 
                 RSAParameters rsaParameters = new RSAParameters
                 {
-                    Modulus = Crypto.ExtractBignum(n, modulusSize),
-                    Exponent = Crypto.ExtractBignum(e, 0),
+                    Modulus = Crypto.ExtractBignum(n, modulusSize)!,
+                    Exponent = Crypto.ExtractBignum(e, 0)!,
                 };
 
                 if (includePrivateParameters)
diff --git a/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptEncryptDecrypt.cs b/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptEncryptDecrypt.cs
index 4f97ca0bfe87cb..b377d1f8cb9a97 100644
--- a/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptEncryptDecrypt.cs
+++ b/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptEncryptDecrypt.cs
@@ -2,13 +2,13 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Runtime.InteropServices;
 using Internal.NativeCrypto;
 using Microsoft.Win32.SafeHandles;
 
-#nullable enable
 internal static partial class Interop
 {
     internal static partial class BCrypt
diff --git a/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptOpenAlgorithmProvider.cs b/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptOpenAlgorithmProvider.cs
index c9fb6c17787003..1d1372be1b4adb 100644
--- a/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptOpenAlgorithmProvider.cs
+++ b/src/libraries/Common/src/Interop/Windows/BCrypt/Interop.BCryptOpenAlgorithmProvider.cs
@@ -2,13 +2,13 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Runtime.InteropServices;
 
 using Microsoft.Win32.SafeHandles;
 
-#nullable enable
 internal partial class Interop
 {
     internal partial class BCrypt
diff --git a/src/libraries/Common/src/Microsoft/Win32/SafeHandles/SafeHandleCache.cs b/src/libraries/Common/src/Microsoft/Win32/SafeHandles/SafeHandleCache.cs
index 13aefb9ad565e8..14edf5a9a94559 100644
--- a/src/libraries/Common/src/Microsoft/Win32/SafeHandles/SafeHandleCache.cs
+++ b/src/libraries/Common/src/Microsoft/Win32/SafeHandles/SafeHandleCache.cs
@@ -2,12 +2,12 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Runtime.InteropServices;
 using System.Threading;
 
-#nullable enable
 namespace Microsoft.Win32.SafeHandles
 {
     /// <summary>Provides a cache for special instances of SafeHandles.</summary>
diff --git a/src/libraries/Common/src/Microsoft/Win32/SafeHandles/SafeInteriorHandle.cs b/src/libraries/Common/src/Microsoft/Win32/SafeHandles/SafeInteriorHandle.cs
index c1e14c32fd30fc..dcc03dcc262b23 100644
--- a/src/libraries/Common/src/Microsoft/Win32/SafeHandles/SafeInteriorHandle.cs
+++ b/src/libraries/Common/src/Microsoft/Win32/SafeHandles/SafeInteriorHandle.cs
@@ -2,11 +2,11 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Runtime.InteropServices;
 
-#nullable enable
 namespace Microsoft.Win32.SafeHandles
 {
     internal abstract class SafeInteriorHandle : SafeHandle
diff --git a/src/libraries/Common/src/System/Security/Cryptography/DSACng.cs b/src/libraries/Common/src/System/Security/Cryptography/DSACng.cs
index 98c96b9ad53ff0..b92deb1c26b7a9 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/DSACng.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/DSACng.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using Internal.Cryptography;
 using System.Diagnostics;
 using System.IO;
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECCng.HashAlgorithm.cs b/src/libraries/Common/src/System/Security/Cryptography/ECCng.HashAlgorithm.cs
index 793435238124e1..7c58da464869bc 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECCng.HashAlgorithm.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECCng.HashAlgorithm.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Diagnostics;
 using Internal.NativeCrypto;
 using static Interop.Crypt32;
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECCng.ImportExport.cs b/src/libraries/Common/src/System/Security/Cryptography/ECCng.ImportExport.cs
index 5ec3c9b72ddbbb..d8a4a5e1af46cf 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECCng.ImportExport.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECCng.ImportExport.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using Internal.Cryptography;
 using Microsoft.Win32.SafeHandles;
 using System.Diagnostics;
@@ -34,8 +35,8 @@ internal static byte[] GetNamedCurveBlob(ref ECParameters parameters, bool ecdh)
                 //     byte[cbKey]          D
 
                 int blobSize = sizeof(BCRYPT_ECCKEY_BLOB) +
-                    parameters.Q.X.Length +
-                    parameters.Q.Y.Length;
+                    parameters.Q.X!.Length +
+                    parameters.Q.Y!.Length;
                 if (includePrivateParameters)
                 {
                     blobSize += parameters.D!.Length;
@@ -95,13 +96,13 @@ internal static byte[] GetPrimeCurveBlob(ref ECParameters parameters, bool ecdh)
                     curve.Prime.Length +
                     curve.A.Length +
                     curve.B.Length +
-                    curve.G.X.Length +
-                    curve.G.Y.Length +
+                    curve.G.X!.Length +
+                    curve.G.Y!.Length +
                     curve.Order.Length +
                     curve.Cofactor!.Length +
                     (curve.Seed == null ? 0 : curve.Seed.Length) +
-                    parameters.Q.X.Length +
-                    parameters.Q.Y.Length;
+                    parameters.Q.X!.Length +
+                    parameters.Q.Y!.Length;
 
                 if (includePrivateParameters)
                 {
@@ -281,8 +282,8 @@ internal static byte[] GetPrimeCurveParameterBlob(ref ECCurve curve)
                     curve.Prime.Length +
                     curve.A.Length +
                     curve.B.Length +
-                    curve.G.X.Length +
-                    curve.G.Y.Length +
+                    curve.G.X!.Length +
+                    curve.G.Y!.Length +
                     curve.Order.Length +
                     curve.Cofactor!.Length +
                     (curve.Seed == null ? 0 : curve.Seed.Length);
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.cs b/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.cs
index c64e6765dfc064..d92f33864b20b3 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.cs
@@ -86,10 +86,9 @@ internal int GenerateKey(ECCurve curve)
 
             if (curve.IsNamed)
             {
-                string oid;
                 // Use oid Value first if present, otherwise FriendlyName because Oid maintains a hard-coded
                 // cache that may have different casing for FriendlyNames than OpenSsl
-                oid = !string.IsNullOrEmpty(curve.Oid.Value) ? curve.Oid.Value : curve.Oid.FriendlyName!;
+                string oid = !string.IsNullOrEmpty(curve.Oid.Value) ? curve.Oid.Value : curve.Oid.FriendlyName!;
 
                 SafeEcKeyHandle? key = Interop.Crypto.EcKeyCreateByOid(oid);
 
diff --git a/src/libraries/Common/src/System/Security/Cryptography/EccKeyFormatHelper.cs b/src/libraries/Common/src/System/Security/Cryptography/EccKeyFormatHelper.cs
index 38844f204f191b..c54ca41ce20b78 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/EccKeyFormatHelper.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/EccKeyFormatHelper.cs
@@ -717,7 +717,7 @@ private static void WriteFieldElement(byte[] fieldElement, AsnWriter writer)
 
         private static void WriteUncompressedBasePoint(in ECParameters ecParameters, AsnWriter writer)
         {
-            int basePointLength = ecParameters.Curve.G.X.Length * 2 + 1;
+            int basePointLength = ecParameters.Curve.G.X!.Length * 2 + 1;
             byte[] tmp = CryptoPool.Rent(basePointLength);
             tmp[0] = 0x04;
             ecParameters.Curve.G.X.CopyTo(tmp.AsSpan(1));
@@ -729,7 +729,7 @@ private static void WriteUncompressedBasePoint(in ECParameters ecParameters, Asn
 
         private static void WriteUncompressedPublicKey(in ECParameters ecParameters, AsnWriter writer)
         {
-            int publicKeyLength = ecParameters.Q.X.Length * 2 + 1;
+            int publicKeyLength = ecParameters.Q.X!.Length * 2 + 1;
 
             writer.WriteBitString(
                 publicKeyLength,
@@ -738,7 +738,7 @@ private static void WriteUncompressedPublicKey(in ECParameters ecParameters, Asn
                 {
                     publicKeyBytes[0] = 0x04;
                     point.X.AsSpan().CopyTo(publicKeyBytes.Slice(1));
-                    point.Y.AsSpan().CopyTo(publicKeyBytes.Slice(1 + point.X.Length));
+                    point.Y.AsSpan().CopyTo(publicKeyBytes.Slice(1 + point.X!.Length));
                 });
         }
 
diff --git a/src/libraries/Common/src/System/Security/Cryptography/RSAOpenSsl.cs b/src/libraries/Common/src/System/Security/Cryptography/RSAOpenSsl.cs
index cdb2f70d8a28a8..8a135300080250 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/RSAOpenSsl.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/RSAOpenSsl.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Buffers;
 using System.Diagnostics;
 using System.IO;
diff --git a/src/libraries/Common/src/System/Security/Cryptography/RSASecurityTransforms.cs b/src/libraries/Common/src/System/Security/Cryptography/RSASecurityTransforms.cs
index 7041e89708d61a..81c94c1c20d771 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/RSASecurityTransforms.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/RSASecurityTransforms.cs
@@ -27,7 +27,7 @@ internal static partial class RSAImplementation
     {
         public sealed partial class RSASecurityTransforms : RSA
         {
-            private SecKeyPair?_keys;
+            private SecKeyPair? _keys;
 
             public RSASecurityTransforms()
                 : this(2048)
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/System.Security.Cryptography.Algorithms.sln b/src/libraries/System.Security.Cryptography.Algorithms/System.Security.Cryptography.Algorithms.sln
index 35ea2d5bb13710..932d7771b141e9 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/System.Security.Cryptography.Algorithms.sln
+++ b/src/libraries/System.Security.Cryptography.Algorithms/System.Security.Cryptography.Algorithms.sln
@@ -1,6 +1,6 @@
 Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio Version 16
-VisualStudioVersion = 16.0.29720.21
+# Visual Studio 15
+VisualStudioVersion = 15.0.27213.1
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "System.Security.Cryptography.Algorithms.Tests", "tests\System.Security.Cryptography.Algorithms.Tests.csproj", "{508A7D81-6462-459C-9F8F-B58FCCCFC8E7}"
 	ProjectSection(ProjectDependencies) = postProject
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.cs b/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.cs
index a0bd4256156b65..0b52606ddafc39 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.cs
@@ -329,8 +329,8 @@ public void Validate() { }
     }
     public partial struct ECPoint
     {
-        public byte[] X;
-        public byte[] Y;
+        public byte[]? X;
+        public byte[]? Y;
     }
     public static class HKDF
     {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDsa.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDsa.cs
index 0b55b614457427..9d04547242b417 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDsa.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECDsa.cs
@@ -69,6 +69,9 @@ public virtual void GenerateKey(ECCurve curve)
 
         public virtual byte[] SignData(byte[] data, HashAlgorithmName hashAlgorithm)
         {
+            if (data == null)
+                throw new ArgumentNullException(nameof(data));
+
             return SignData(data, 0, data.Length, hashAlgorithm);
         }
 
@@ -117,6 +120,9 @@ public virtual byte[] SignData(Stream data, HashAlgorithmName hashAlgorithm)
 
         public bool VerifyData(byte[] data, byte[] signature, HashAlgorithmName hashAlgorithm)
         {
+            if (data == null)
+                throw new ArgumentNullException(nameof(data));
+
             return VerifyData(data, 0, data.Length, signature, hashAlgorithm);
         }
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECPoint.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECPoint.cs
index 0ab176682271b2..62803746389338 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECPoint.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECPoint.cs
@@ -9,7 +9,7 @@ namespace System.Security.Cryptography
     /// </summary>
     public struct ECPoint
     {
-        public byte[] X; // TODO not sure if it should be nullabe
-        public byte[] Y;
+        public byte[]? X;
+        public byte[]? Y;
     }
 }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSA.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSA.cs
index d6b5d53218c112..31e89e570bebf5 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSA.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSA.cs
@@ -211,6 +211,9 @@ public virtual bool TrySignData(ReadOnlySpan<byte> data, Span<byte> destination,
 
         public bool VerifyData(byte[] data, byte[] signature, HashAlgorithmName hashAlgorithm, RSASignaturePadding padding)
         {
+            if (data == null)
+                throw new ArgumentNullException(nameof(data));
+
             return VerifyData(data, 0, data.Length, signature, hashAlgorithm, padding);
         }
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SignatureDescription.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SignatureDescription.cs
index 13a14d9ec11b06..17d6d2a2dd17f0 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SignatureDescription.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SignatureDescription.cs
@@ -29,10 +29,8 @@ public SignatureDescription(SecurityElement el)
 
         public virtual AsymmetricSignatureDeformatter CreateDeformatter(AsymmetricAlgorithm key)
         {
-            Debug.Assert(DeformatterAlgorithm != null);
-            AsymmetricSignatureDeformatter? item = (AsymmetricSignatureDeformatter?)CryptoConfig.CreateFromName(DeformatterAlgorithm);
-            Debug.Assert(item != null);
-            item.SetKey(key);
+            AsymmetricSignatureDeformatter? item = (AsymmetricSignatureDeformatter?)CryptoConfig.CreateFromName(DeformatterAlgorithm!);
+            item!.SetKey(key);
             return item;
         }
 

From 21d3dd85c0ddfa8af1deb47477f3eec1fde9761e Mon Sep 17 00:00:00 2001
From: Buyaa Namnan <bunamnan@microsoft.com>
Date: Thu, 30 Jan 2020 12:17:58 -0800
Subject: [PATCH 04/13] More #nullabe enable and remove assertion causing test
 failure

---
 .../Cryptography/ECDiffieHellmanCng.cs        |  1 +
 .../Cryptography/ECDiffieHellmanDerivation.cs |  1 +
 .../ECDiffieHellmanOpenSsl.Derive.cs          |  1 +
 .../Cryptography/ECOpenSsl.ImportExport.cs    | 20 +++++++++----------
 .../Cryptography/SignatureDescription.cs      |  3 +--
 5 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanCng.cs b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanCng.cs
index 989b7a58dffd33..20cef431701161 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanCng.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanCng.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using Microsoft.Win32.SafeHandles;
 
 namespace System.Security.Cryptography
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanDerivation.cs b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanDerivation.cs
index 2f011385b13cd7..afa34b6cba6936 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanDerivation.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanDerivation.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Diagnostics;
 using System.Runtime.InteropServices;
 
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSsl.Derive.cs b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSsl.Derive.cs
index c4eba4302fb26f..877d7367e58095 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSsl.Derive.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanOpenSsl.Derive.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Diagnostics;
 using Microsoft.Win32.SafeHandles;
 
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.ImportExport.cs b/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.ImportExport.cs
index 2ea1cf9f9602f6..888ac1b5f98aed 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.ImportExport.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.ImportExport.cs
@@ -113,8 +113,8 @@ private static SafeEcKeyHandle ImportNamedCurveParameters(ECParameters parameter
 
             SafeEcKeyHandle key = Interop.Crypto.EcKeyCreateByKeyParameters(
                 oid,
-                parameters.Q.X, parameters.Q.X.Length,
-                parameters.Q.Y, parameters.Q.Y.Length,
+                parameters.Q.X!, parameters.Q.X!.Length,
+                parameters.Q.Y!, parameters.Q.Y!.Length,
                 parameters.D, parameters.D == null ? 0 : parameters.D.Length);
 
             return key;
@@ -125,14 +125,14 @@ private static SafeEcKeyHandle ImportPrimeCurveParameters(ECParameters parameter
             Debug.Assert(parameters.Curve.IsPrime);
             SafeEcKeyHandle key = Interop.Crypto.EcKeyCreateByExplicitParameters(
                 parameters.Curve.CurveType,
-                parameters.Q.X, parameters.Q.X.Length,
-                parameters.Q.Y, parameters.Q.Y.Length,
+                parameters.Q.X, parameters.Q.X!.Length,
+                parameters.Q.Y, parameters.Q.Y!.Length,
                 parameters.D, parameters.D == null ? 0 : parameters.D.Length,
                 parameters.Curve.Prime, parameters.Curve.Prime.Length,
                 parameters.Curve.A, parameters.Curve.A.Length,
                 parameters.Curve.B, parameters.Curve.B.Length,
-                parameters.Curve.G.X, parameters.Curve.G.X.Length,
-                parameters.Curve.G.Y, parameters.Curve.G.Y.Length,
+                parameters.Curve.G.X!, parameters.Curve.G.X!.Length,
+                parameters.Curve.G.Y!, parameters.Curve.G.Y!.Length,
                 parameters.Curve.Order, parameters.Curve.Order.Length,
                 parameters.Curve.Cofactor, parameters.Curve.Cofactor!.Length,
                 parameters.Curve.Seed, parameters.Curve.Seed == null ? 0 : parameters.Curve.Seed.Length);
@@ -145,14 +145,14 @@ private static SafeEcKeyHandle ImportCharacteristic2CurveParameters(ECParameters
             Debug.Assert(parameters.Curve.IsCharacteristic2);
             SafeEcKeyHandle key = Interop.Crypto.EcKeyCreateByExplicitParameters(
                 parameters.Curve.CurveType,
-                parameters.Q.X, parameters.Q.X.Length,
-                parameters.Q.Y, parameters.Q.Y.Length,
+                parameters.Q.X, parameters.Q.X!.Length,
+                parameters.Q.Y, parameters.Q.Y!.Length,
                 parameters.D, parameters.D == null ? 0 : parameters.D.Length,
                 parameters.Curve.Polynomial, parameters.Curve.Polynomial.Length,
                 parameters.Curve.A, parameters.Curve.A.Length,
                 parameters.Curve.B, parameters.Curve.B.Length,
-                parameters.Curve.G.X, parameters.Curve.G.X.Length,
-                parameters.Curve.G.Y, parameters.Curve.G.Y.Length,
+                parameters.Curve.G.X!, parameters.Curve.G.X!.Length,
+                parameters.Curve.G.Y!, parameters.Curve.G.Y!.Length,
                 parameters.Curve.Order, parameters.Curve.Order.Length,
                 parameters.Curve.Cofactor, parameters.Curve.Cofactor!.Length,
                 parameters.Curve.Seed, parameters.Curve.Seed == null ? 0 : parameters.Curve.Seed.Length);
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SignatureDescription.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SignatureDescription.cs
index 17d6d2a2dd17f0..3b839fbd320e7c 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SignatureDescription.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SignatureDescription.cs
@@ -36,8 +36,7 @@ public virtual AsymmetricSignatureDeformatter CreateDeformatter(AsymmetricAlgori
 
         public virtual AsymmetricSignatureFormatter CreateFormatter(AsymmetricAlgorithm key)
         {
-            Debug.Assert(FormatterAlgorithm != null);
-            AsymmetricSignatureFormatter? item = (AsymmetricSignatureFormatter?)CryptoConfig.CreateFromName(FormatterAlgorithm);
+            AsymmetricSignatureFormatter? item = (AsymmetricSignatureFormatter?)CryptoConfig.CreateFromName(FormatterAlgorithm!);
             Debug.Assert(item != null);
             item.SetKey(key);
             return item;

From dba60f06511e582e036c654fabcbebbfe241cb47 Mon Sep 17 00:00:00 2001
From: Buyaa Namnan <bunamnan@microsoft.com>
Date: Thu, 30 Jan 2020 13:24:50 -0800
Subject: [PATCH 05/13] More nullable enable and assert removal

---
 .../Common/src/Interop/Windows/NCrypt/Interop.Keys.cs       | 1 +
 .../Windows/NCrypt/Interop.NCryptDeriveKeyMaterial.cs       | 1 +
 .../Cryptography/ECDiffieHellmanCng.ImportExport.cs         | 1 +
 .../System/Security/Cryptography/ECDsaCng.ImportExport.cs   | 1 +
 .../System/Security/Cryptography/ECOpenSsl.ImportExport.cs  | 1 +
 .../Common/src/System/Security/Cryptography/ECOpenSsl.cs    | 1 +
 .../src/System/Security/Cryptography/KeyFormatHelper.cs     | 1 +
 .../System/Security/Cryptography/PasswordBasedEncryption.cs | 1 +
 .../Common/src/System/Security/Cryptography/Pkcs12Kdf.cs    | 1 +
 .../src/System/Security/Cryptography/RSACng.SignVerify.cs   | 1 +
 .../src/System/Security/Cryptography/RsaPaddingProcessor.cs | 1 +
 .../System/Security/Cryptography/SignatureDescription.cs    | 6 ++----
 12 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/src/libraries/Common/src/Interop/Windows/NCrypt/Interop.Keys.cs b/src/libraries/Common/src/Interop/Windows/NCrypt/Interop.Keys.cs
index ac816bdd1c946d..212bfdef5f23bc 100644
--- a/src/libraries/Common/src/Interop/Windows/NCrypt/Interop.Keys.cs
+++ b/src/libraries/Common/src/Interop/Windows/NCrypt/Interop.Keys.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Runtime.InteropServices;
 using System.Security.Cryptography;
diff --git a/src/libraries/Common/src/Interop/Windows/NCrypt/Interop.NCryptDeriveKeyMaterial.cs b/src/libraries/Common/src/Interop/Windows/NCrypt/Interop.NCryptDeriveKeyMaterial.cs
index 14e2c29e9e4df9..c8468d5849b4b6 100644
--- a/src/libraries/Common/src/Interop/Windows/NCrypt/Interop.NCryptDeriveKeyMaterial.cs
+++ b/src/libraries/Common/src/Interop/Windows/NCrypt/Interop.NCryptDeriveKeyMaterial.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Runtime.InteropServices;
 using System.Security.Cryptography;
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanCng.ImportExport.cs b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanCng.ImportExport.cs
index 962dc1254041f0..54eb1efe318678 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanCng.ImportExport.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECDiffieHellmanCng.ImportExport.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using Internal.NativeCrypto;
 
 namespace System.Security.Cryptography
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECDsaCng.ImportExport.cs b/src/libraries/Common/src/System/Security/Cryptography/ECDsaCng.ImportExport.cs
index 068b7fdb1e6799..4d538c214daf04 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECDsaCng.ImportExport.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECDsaCng.ImportExport.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using Internal.NativeCrypto;
 
 namespace System.Security.Cryptography
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.ImportExport.cs b/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.ImportExport.cs
index 888ac1b5f98aed..4bdd59dc4672aa 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.ImportExport.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.ImportExport.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using Microsoft.Win32.SafeHandles;
 using System.Diagnostics;
 
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.cs b/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.cs
index d92f33864b20b3..d41b8016e71aee 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Diagnostics;
 using Microsoft.Win32.SafeHandles;
 
diff --git a/src/libraries/Common/src/System/Security/Cryptography/KeyFormatHelper.cs b/src/libraries/Common/src/System/Security/Cryptography/KeyFormatHelper.cs
index d05b204dc95640..e05336387c17d4 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/KeyFormatHelper.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/KeyFormatHelper.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Buffers;
 using System.Diagnostics;
 using System.Runtime.CompilerServices;
diff --git a/src/libraries/Common/src/System/Security/Cryptography/PasswordBasedEncryption.cs b/src/libraries/Common/src/System/Security/Cryptography/PasswordBasedEncryption.cs
index 0eba8394c44f40..5780e28eb74db7 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/PasswordBasedEncryption.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/PasswordBasedEncryption.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Diagnostics;
 using System.Diagnostics.CodeAnalysis;
 using System.Runtime.InteropServices;
diff --git a/src/libraries/Common/src/System/Security/Cryptography/Pkcs12Kdf.cs b/src/libraries/Common/src/System/Security/Cryptography/Pkcs12Kdf.cs
index 7f41b376d21709..c2c6188c1cac40 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/Pkcs12Kdf.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/Pkcs12Kdf.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Collections.Generic;
 using System.Diagnostics;
 using System.Text;
diff --git a/src/libraries/Common/src/System/Security/Cryptography/RSACng.SignVerify.cs b/src/libraries/Common/src/System/Security/Cryptography/RSACng.SignVerify.cs
index eca48a1319a07e..1c73ed5f3433dd 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/RSACng.SignVerify.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/RSACng.SignVerify.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Collections.Concurrent;
 using System.Collections.Generic;
 using System.Runtime.InteropServices;
diff --git a/src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.cs b/src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.cs
index 3644eab3740b2d..291915ec254b92 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/RsaPaddingProcessor.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Buffers.Binary;
 using System.Collections.Concurrent;
 using System.Diagnostics;
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SignatureDescription.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SignatureDescription.cs
index 3b839fbd320e7c..6198390beff84f 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SignatureDescription.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/SignatureDescription.cs
@@ -37,15 +37,13 @@ public virtual AsymmetricSignatureDeformatter CreateDeformatter(AsymmetricAlgori
         public virtual AsymmetricSignatureFormatter CreateFormatter(AsymmetricAlgorithm key)
         {
             AsymmetricSignatureFormatter? item = (AsymmetricSignatureFormatter?)CryptoConfig.CreateFromName(FormatterAlgorithm!);
-            Debug.Assert(item != null);
-            item.SetKey(key);
+            item!.SetKey(key);
             return item;
         }
 
         public virtual HashAlgorithm? CreateDigest()
         {
-            Debug.Assert(DigestAlgorithm != null);
-            return (HashAlgorithm?)CryptoConfig.CreateFromName(DigestAlgorithm);
+            return (HashAlgorithm?)CryptoConfig.CreateFromName(DigestAlgorithm!);
         }
     }
 }

From c9a7be2d6af7e1c8a3ac1ce974374c9d457e15c3 Mon Sep 17 00:00:00 2001
From: Buyaa Namnan <bunamnan@microsoft.com>
Date: Thu, 30 Jan 2020 14:03:59 -0800
Subject: [PATCH 06/13] More nullable enable

---
 .../Common/src/Interop/OSX/Interop.CoreFoundation.CFError.cs    | 1 +
 .../Interop.KeyAgree.cs                                         | 1 +
 .../Interop.Keychain.cs                                         | 1 +
 .../System.Security.Cryptography.Native.Apple/Interop.SecErr.cs | 1 +
 .../Interop.SecErrMessage.cs                                    | 1 +
 .../Interop.SecKeyRef.Export.cs                                 | 1 +
 src/libraries/Common/src/Interop/Windows/BCrypt/Cng.cs          | 2 +-
 .../System/Security/Cryptography/Asn1/ECDomainParameters.xml.cs | 1 +
 .../System/Security/Cryptography/Asn1/Pbkdf2SaltChoice.xml.cs   | 1 +
 .../Common/src/System/Security/Cryptography/DSAOpenSsl.cs       | 1 +
 .../src/System/Security/Cryptography/DSASecurityTransforms.cs   | 1 +
 .../src/System/Security/Cryptography/EccKeyFormatHelper.cs      | 1 +
 .../src/System/Security/Cryptography/EccSecurityTransforms.cs   | 1 +
 .../src/System/Security/Cryptography/RSASecurityTransforms.cs   | 1 +
 .../Common/src/System/Security/Cryptography/SecKeyPair.cs       | 1 +
 15 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/libraries/Common/src/Interop/OSX/Interop.CoreFoundation.CFError.cs b/src/libraries/Common/src/Interop/OSX/Interop.CoreFoundation.CFError.cs
index e3f104eb09a778..216b350fa58ade 100644
--- a/src/libraries/Common/src/Interop/OSX/Interop.CoreFoundation.CFError.cs
+++ b/src/libraries/Common/src/Interop/OSX/Interop.CoreFoundation.CFError.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Runtime.InteropServices;
diff --git a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.KeyAgree.cs b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.KeyAgree.cs
index d6dd96d0bfbf17..f585b8210ac2f6 100644
--- a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.KeyAgree.cs
+++ b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.KeyAgree.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Runtime.InteropServices;
diff --git a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Keychain.cs b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Keychain.cs
index 9937e988b177bc..7ed270aed3ef2e 100644
--- a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Keychain.cs
+++ b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.Keychain.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Collections.Generic;
 using System.Diagnostics;
diff --git a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErr.cs b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErr.cs
index 2faceaacddea60..0c6bb80ab7a0d2 100644
--- a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErr.cs
+++ b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErr.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 
 internal static partial class Interop
diff --git a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErrMessage.cs b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErrMessage.cs
index 9748e407fbd07d..16d5beda4d906d 100644
--- a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErrMessage.cs
+++ b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecErrMessage.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Runtime.InteropServices;
 using Microsoft.Win32.SafeHandles;
 
diff --git a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecKeyRef.Export.cs b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecKeyRef.Export.cs
index c9d5fc0f9cce62..1a8b00c3e4b735 100644
--- a/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecKeyRef.Export.cs
+++ b/src/libraries/Common/src/Interop/OSX/System.Security.Cryptography.Native.Apple/Interop.SecKeyRef.Export.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Runtime.InteropServices;
diff --git a/src/libraries/Common/src/Interop/Windows/BCrypt/Cng.cs b/src/libraries/Common/src/Interop/Windows/BCrypt/Cng.cs
index 312bfa3da581de..bcb5bae2a13ebf 100644
--- a/src/libraries/Common/src/Interop/Windows/BCrypt/Cng.cs
+++ b/src/libraries/Common/src/Interop/Windows/BCrypt/Cng.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Text;
 using System.Diagnostics;
@@ -12,7 +13,6 @@
 using static Interop.BCrypt;
 using Microsoft.Win32.SafeHandles;
 
-#nullable enable
 namespace Internal.NativeCrypto
 {
     internal static partial class BCryptNative
diff --git a/src/libraries/Common/src/System/Security/Cryptography/Asn1/ECDomainParameters.xml.cs b/src/libraries/Common/src/System/Security/Cryptography/Asn1/ECDomainParameters.xml.cs
index f0870c5aa98858..39d66b3ef1af84 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/Asn1/ECDomainParameters.xml.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/Asn1/ECDomainParameters.xml.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 #pragma warning disable SA1028 // ignore whitespace warnings for generated code
 using System;
 using System.Runtime.InteropServices;
diff --git a/src/libraries/Common/src/System/Security/Cryptography/Asn1/Pbkdf2SaltChoice.xml.cs b/src/libraries/Common/src/System/Security/Cryptography/Asn1/Pbkdf2SaltChoice.xml.cs
index fe33ea331d1852..43d4f5c07052ef 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/Asn1/Pbkdf2SaltChoice.xml.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/Asn1/Pbkdf2SaltChoice.xml.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 #pragma warning disable SA1028 // ignore whitespace warnings for generated code
 using System;
 using System.Runtime.InteropServices;
diff --git a/src/libraries/Common/src/System/Security/Cryptography/DSAOpenSsl.cs b/src/libraries/Common/src/System/Security/Cryptography/DSAOpenSsl.cs
index fc0baf6beb4385..417ebb4a0d28a2 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/DSAOpenSsl.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/DSAOpenSsl.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Diagnostics;
 using System.IO;
 using Internal.Cryptography;
diff --git a/src/libraries/Common/src/System/Security/Cryptography/DSASecurityTransforms.cs b/src/libraries/Common/src/System/Security/Cryptography/DSASecurityTransforms.cs
index 2192a8079ca746..6f4e111b1c59c6 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/DSASecurityTransforms.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/DSASecurityTransforms.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Buffers;
 using System.Diagnostics;
 using System.IO;
diff --git a/src/libraries/Common/src/System/Security/Cryptography/EccKeyFormatHelper.cs b/src/libraries/Common/src/System/Security/Cryptography/EccKeyFormatHelper.cs
index c54ca41ce20b78..21f31f817ebf92 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/EccKeyFormatHelper.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/EccKeyFormatHelper.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Buffers;
 using System.Collections;
 using System.Diagnostics;
diff --git a/src/libraries/Common/src/System/Security/Cryptography/EccSecurityTransforms.cs b/src/libraries/Common/src/System/Security/Cryptography/EccSecurityTransforms.cs
index 3965e4ccd18755..d0957118122885 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/EccSecurityTransforms.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/EccSecurityTransforms.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Buffers;
 using System.Diagnostics;
 using System.Runtime.InteropServices;
diff --git a/src/libraries/Common/src/System/Security/Cryptography/RSASecurityTransforms.cs b/src/libraries/Common/src/System/Security/Cryptography/RSASecurityTransforms.cs
index 81c94c1c20d771..a21db3de01c22a 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/RSASecurityTransforms.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/RSASecurityTransforms.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Buffers;
 using System.Diagnostics;
 using System.IO;
diff --git a/src/libraries/Common/src/System/Security/Cryptography/SecKeyPair.cs b/src/libraries/Common/src/System/Security/Cryptography/SecKeyPair.cs
index a0e3238fd6d701..219a03ec4ee746 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/SecKeyPair.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/SecKeyPair.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Security.Cryptography.Apple;
 
 namespace System.Security.Cryptography

From 49d5f745d9346aed7320b9149c3f403656c9aed6 Mon Sep 17 00:00:00 2001
From: Buyaa Namnan <bunamnan@microsoft.com>
Date: Thu, 30 Jan 2020 14:57:03 -0800
Subject: [PATCH 07/13] Remove assert

---
 .../src/System/Security/Cryptography/ECCngKey.cs             | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECCngKey.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECCngKey.cs
index 8ae034d1ffd99c..8eb59e081a6d63 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECCngKey.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECCngKey.cs
@@ -51,11 +51,10 @@ internal SafeNCryptKeyHandle GetDuplicatedKeyHandle(int callerKeySizeProperty)
         {
             ThrowIfDisposed();
 
-            Debug.Assert(_keyHandle != null);
             if (ECCng.IsECNamedCurve(_lastAlgorithm))
             {
                 // Curve was previously created, so use that
-                return new DuplicateSafeNCryptKeyHandle(_keyHandle);
+                return new DuplicateSafeNCryptKeyHandle(_keyHandle!);
             }
             else
             {
@@ -99,7 +98,7 @@ internal SafeNCryptKeyHandle GetDuplicatedKeyHandle(int callerKeySizeProperty)
                     KeySize = callerKeySizeProperty;
                 }
 
-                return new DuplicateSafeNCryptKeyHandle(_keyHandle);
+                return new DuplicateSafeNCryptKeyHandle(_keyHandle!);
             }
         }
 

From d92ca884ed3c972cd618bc50290fba668dc71da3 Mon Sep 17 00:00:00 2001
From: Buyaa Namnan <bunamnan@microsoft.com>
Date: Thu, 30 Jan 2020 16:17:28 -0800
Subject: [PATCH 08/13] Updating #nullable enable position in template

---
 .../Common/src/System/Security/Cryptography/Asn1/asn.xslt       | 2 +-
 .../src/System/Security/Cryptography/DSAKeyFormatHelper.cs      | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/libraries/Common/src/System/Security/Cryptography/Asn1/asn.xslt b/src/libraries/Common/src/System/Security/Cryptography/Asn1/asn.xslt
index 50abbd2c89fdbd..ef45bb77f98164 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/Asn1/asn.xslt
+++ b/src/libraries/Common/src/System/Security/Cryptography/Asn1/asn.xslt
@@ -122,6 +122,7 @@ namespace <xsl:value-of select="@namespace" />
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 #pragma warning disable SA1028 // ignore whitespace warnings for generated code
 using System;<xsl:if test="asn:SequenceOf | asn:SetOf">
 using System.Collections.Generic;</xsl:if>
@@ -129,7 +130,6 @@ using System.Runtime.InteropServices;
 using System.Security.Cryptography;
 using System.Security.Cryptography.Asn1;
 
-#nullable enable
 namespace <xsl:value-of select="@namespace" />
 {
     [StructLayout(LayoutKind.Sequential)]
diff --git a/src/libraries/Common/src/System/Security/Cryptography/DSAKeyFormatHelper.cs b/src/libraries/Common/src/System/Security/Cryptography/DSAKeyFormatHelper.cs
index 023c09fc60d31a..7de0284da5cf40 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/DSAKeyFormatHelper.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/DSAKeyFormatHelper.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System.Buffers;
 using System.Diagnostics;
 using System.Numerics;

From 22814b0ca96cdb502622c606fb9dbbb4ce6976be Mon Sep 17 00:00:00 2001
From: Buyaa Namnan <bunamnan@microsoft.com>
Date: Fri, 31 Jan 2020 15:19:23 -0800
Subject: [PATCH 09/13] Update HMACxxx.Key to non null

---
 .../ref/System.Security.Cryptography.Algorithms.cs     | 10 +++++-----
 .../src/Internal/Cryptography/HMACCommon.cs            |  2 +-
 .../src/System/Security/Cryptography/HMACMD5.cs        |  6 +++---
 .../src/System/Security/Cryptography/HMACSHA1.cs       |  6 +++---
 .../src/System/Security/Cryptography/HMACSHA256.cs     |  6 +++---
 .../src/System/Security/Cryptography/HMACSHA384.cs     |  6 +++---
 .../src/System/Security/Cryptography/HMACSHA512.cs     |  6 +++---
 7 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.cs b/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.cs
index 0b52606ddafc39..2e738b7264f210 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.cs
@@ -345,7 +345,7 @@ public partial class HMACMD5 : System.Security.Cryptography.HMAC
     {
         public HMACMD5() { }
         public HMACMD5(byte[] key) { }
-        public override byte[]? Key { get { throw null; } set { } }
+        public override byte[] Key { get { throw null; } set { } }
         protected override void Dispose(bool disposing) { }
         protected override void HashCore(byte[] rgb, int ib, int cb) { }
         protected override void HashCore(System.ReadOnlySpan<byte> source) { }
@@ -359,7 +359,7 @@ public HMACSHA1() { }
         public HMACSHA1(byte[] key) { }
         [System.ComponentModel.EditorBrowsableAttribute(System.ComponentModel.EditorBrowsableState.Never)]
         public HMACSHA1(byte[] key, bool useManagedSha1) { }
-        public override byte[]? Key { get { throw null; } set { } }
+        public override byte[] Key { get { throw null; } set { } }
         protected override void Dispose(bool disposing) { }
         protected override void HashCore(byte[] rgb, int ib, int cb) { }
         protected override void HashCore(System.ReadOnlySpan<byte> source) { }
@@ -371,7 +371,7 @@ public partial class HMACSHA256 : System.Security.Cryptography.HMAC
     {
         public HMACSHA256() { }
         public HMACSHA256(byte[] key) { }
-        public override byte[]? Key { get { throw null; } set { } }
+        public override byte[] Key { get { throw null; } set { } }
         protected override void Dispose(bool disposing) { }
         protected override void HashCore(byte[] rgb, int ib, int cb) { }
         protected override void HashCore(System.ReadOnlySpan<byte> source) { }
@@ -383,7 +383,7 @@ public partial class HMACSHA384 : System.Security.Cryptography.HMAC
     {
         public HMACSHA384() { }
         public HMACSHA384(byte[] key) { }
-        public override byte[]? Key { get { throw null; } set { } }
+        public override byte[] Key { get { throw null; } set { } }
         public bool ProduceLegacyHmacValues { get { throw null; } set { } }
         protected override void Dispose(bool disposing) { }
         protected override void HashCore(byte[] rgb, int ib, int cb) { }
@@ -396,7 +396,7 @@ public partial class HMACSHA512 : System.Security.Cryptography.HMAC
     {
         public HMACSHA512() { }
         public HMACSHA512(byte[] key) { }
-        public override byte[]? Key { get { throw null; } set { } }
+        public override byte[] Key { get { throw null; } set { } }
         public bool ProduceLegacyHmacValues { get { throw null; } set { } }
         protected override void Dispose(bool disposing) { }
         protected override void HashCore(byte[] rgb, int ib, int cb) { }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/HMACCommon.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/HMACCommon.cs
index ea08db672a11a1..03108011b709d5 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/HMACCommon.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/HMACCommon.cs
@@ -41,7 +41,7 @@ private HMACCommon(string hashAlgorithmId, int blockSize)
 
         public int HashSizeInBits => _hMacProvider.HashSizeInBytes * 8;
 
-        public void ChangeKey(byte[]? key)
+        public void ChangeKey(byte[] key)
         {
             ActualKey = ChangeKeyImpl(key) ?? key;
         }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACMD5.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACMD5.cs
index 75497360898eae..d13c9bb9e85b29 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACMD5.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACMD5.cs
@@ -27,14 +27,14 @@ public HMACMD5(byte[] key)
 
             this.HashName = HashAlgorithmNames.MD5;
             _hMacCommon = new HMACCommon(HashAlgorithmNames.MD5, key, BlockSize);
-            base.Key = _hMacCommon.ActualKey;
+            base.Key = _hMacCommon.ActualKey!;
             // this not really needed as it'll initialize BlockSizeValue with same value it has which is 64.
             // we just want to be explicit in all HMAC extended classes
             BlockSizeValue = BlockSize;
             HashSizeValue = _hMacCommon.HashSizeInBits;
         }
 
-        public override byte[]? Key
+        public override byte[] Key
         {
             get
             {
@@ -48,7 +48,7 @@ public override byte[]? Key
                 }
 
                 _hMacCommon.ChangeKey(value);
-                base.Key = _hMacCommon.ActualKey;
+                base.Key = _hMacCommon.ActualKey!;
             }
         }
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA1.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA1.cs
index 2533df5e28c2e2..080674ccf3dc3e 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA1.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA1.cs
@@ -28,7 +28,7 @@ public HMACSHA1(byte[] key)
 
             this.HashName = HashAlgorithmNames.SHA1;
             _hMacCommon = new HMACCommon(HashAlgorithmNames.SHA1, key, BlockSize);
-            base.Key = _hMacCommon.ActualKey;
+            base.Key = _hMacCommon.ActualKey!;
             // this not really needed as it'll initialize BlockSizeValue with same value it has which is 64.
             // we just want to be explicit in all HMAC extended classes
             BlockSizeValue = BlockSize;
@@ -41,7 +41,7 @@ public HMACSHA1(byte[] key, bool useManagedSha1) : this(key)
             // useManagedSha1 is ignored
         }
 
-        public override byte[]? Key
+        public override byte[] Key
         {
             get
             {
@@ -55,7 +55,7 @@ public override byte[]? Key
                 }
 
                 _hMacCommon.ChangeKey(value);
-                base.Key = _hMacCommon.ActualKey;
+                base.Key = _hMacCommon.ActualKey!;
             }
         }
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA256.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA256.cs
index 4ada71b63d2fea..ae62a6844e1641 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA256.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA256.cs
@@ -31,14 +31,14 @@ public HMACSHA256(byte[] key)
 
             this.HashName = HashAlgorithmNames.SHA256;
             _hMacCommon = new HMACCommon(HashAlgorithmNames.SHA256, key, BlockSize);
-            base.Key = _hMacCommon.ActualKey;
+            base.Key = _hMacCommon.ActualKey!;
             // this not really needed as it'll initialize BlockSizeValue with same value it has which is 64.
             // we just want to be explicit in all HMAC extended classes
             BlockSizeValue = BlockSize;
             HashSizeValue = _hMacCommon.HashSizeInBits;
         }
 
-        public override byte[]? Key
+        public override byte[] Key
         {
             get
             {
@@ -52,7 +52,7 @@ public override byte[]? Key
                 }
 
                 _hMacCommon.ChangeKey(value);
-                base.Key = _hMacCommon.ActualKey;
+                base.Key = _hMacCommon.ActualKey!;
             }
         }
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA384.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA384.cs
index d30c95abd133e2..fe71ba08496d53 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA384.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA384.cs
@@ -31,7 +31,7 @@ public HMACSHA384(byte[] key)
 
             this.HashName = HashAlgorithmNames.SHA384;
             _hMacCommon = new HMACCommon(HashAlgorithmNames.SHA384, key, BlockSize);
-            base.Key = _hMacCommon.ActualKey;
+            base.Key = _hMacCommon.ActualKey!;
             // change the default value of BlockSizeValue to 128 instead of 64
             BlockSizeValue = BlockSize;
             HashSizeValue = _hMacCommon.HashSizeInBits;
@@ -54,7 +54,7 @@ public bool ProduceLegacyHmacValues
             }
         }
 
-        public override byte[]? Key
+        public override byte[] Key
         {
             get
             {
@@ -68,7 +68,7 @@ public override byte[]? Key
                 }
 
                 _hMacCommon.ChangeKey(value);
-                base.Key = _hMacCommon.ActualKey;
+                base.Key = _hMacCommon.ActualKey!;
             }
         }
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA512.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA512.cs
index 8c301206027faf..b97f0b76fa536a 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA512.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/HMACSHA512.cs
@@ -31,7 +31,7 @@ public HMACSHA512(byte[] key)
 
             this.HashName = HashAlgorithmNames.SHA512;
             _hMacCommon = new HMACCommon(HashAlgorithmNames.SHA512, key, BlockSize);
-            base.Key = _hMacCommon.ActualKey;
+            base.Key = _hMacCommon.ActualKey!;
             // change the default value of BlockSizeValue to 128 instead of 64
             BlockSizeValue = BlockSize;
             HashSizeValue = _hMacCommon.HashSizeInBits;
@@ -52,7 +52,7 @@ public bool ProduceLegacyHmacValues
             }
         }
 
-        public override byte[]? Key
+        public override byte[] Key
         {
             get
             {
@@ -66,7 +66,7 @@ public override byte[]? Key
                 }
 
                 _hMacCommon.ChangeKey(value);
-                base.Key = _hMacCommon.ActualKey;
+                base.Key = _hMacCommon.ActualKey!;
             }
         }
 

From 049a240bcaea9db6b3bf5830d8a60ef7fac8df04 Mon Sep 17 00:00:00 2001
From: Buyaa Namnan <bunamnan@microsoft.com>
Date: Mon, 3 Feb 2020 10:07:33 -0800
Subject: [PATCH 10/13] Move #nullable enable up

---
 .../Common/src/Internal/Cryptography/BasicSymmetricCipher.cs    | 2 +-
 .../System/Security/Cryptography/Asn1/ECDomainParameters.xml.cs | 1 -
 .../System/Security/Cryptography/Asn1/Pbkdf2SaltChoice.xml.cs   | 1 -
 3 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipher.cs b/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipher.cs
index 2d08f83e9520dc..59bf4af55abf3e 100644
--- a/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipher.cs
+++ b/src/libraries/Common/src/Internal/Cryptography/BasicSymmetricCipher.cs
@@ -2,11 +2,11 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+#nullable enable
 using System;
 using System.Diagnostics;
 using System.Security.Cryptography;
 
-#nullable enable
 namespace Internal.Cryptography
 {
     //
diff --git a/src/libraries/Common/src/System/Security/Cryptography/Asn1/ECDomainParameters.xml.cs b/src/libraries/Common/src/System/Security/Cryptography/Asn1/ECDomainParameters.xml.cs
index 2aab91ee03b374..4c89970450d32f 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/Asn1/ECDomainParameters.xml.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/Asn1/ECDomainParameters.xml.cs
@@ -9,7 +9,6 @@
 using System.Security.Cryptography;
 using System.Security.Cryptography.Asn1;
 
-#nullable enable
 namespace System.Security.Cryptography.Asn1
 {
     [StructLayout(LayoutKind.Sequential)]
diff --git a/src/libraries/Common/src/System/Security/Cryptography/Asn1/Pbkdf2SaltChoice.xml.cs b/src/libraries/Common/src/System/Security/Cryptography/Asn1/Pbkdf2SaltChoice.xml.cs
index 62905c27180c1f..0ff367aa30826d 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/Asn1/Pbkdf2SaltChoice.xml.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/Asn1/Pbkdf2SaltChoice.xml.cs
@@ -9,7 +9,6 @@
 using System.Security.Cryptography;
 using System.Security.Cryptography.Asn1;
 
-#nullable enable
 namespace System.Security.Cryptography.Asn1
 {
     [StructLayout(LayoutKind.Sequential)]

From ac7f872a6a7773dbb9f31384d2713aa6cd4d5e66 Mon Sep 17 00:00:00 2001
From: Buyaa Namnan <bunamnan@microsoft.com>
Date: Tue, 4 Feb 2020 00:04:14 -0800
Subject: [PATCH 11/13] Updating CreateDecryptor implementations

---
 .../ref/System.Security.Cryptography.Algorithms.cs        | 8 ++++----
 .../src/Internal/Cryptography/RijndaelImplementation.cs   | 4 ++--
 .../src/System/Security/Cryptography/AesManaged.cs        | 4 ++--
 .../src/System/Security/Cryptography/RijndaelManaged.cs   | 4 ++--
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.cs b/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.cs
index 2e738b7264f210..8cc378663f13f6 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/ref/System.Security.Cryptography.Algorithms.cs
@@ -51,9 +51,9 @@ public AesManaged() { }
         public override System.Security.Cryptography.CipherMode Mode { get { throw null; } set { } }
         public override System.Security.Cryptography.PaddingMode Padding { get { throw null; } set { } }
         public override System.Security.Cryptography.ICryptoTransform CreateDecryptor() { throw null; }
-        public override System.Security.Cryptography.ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[] rgbIV) { throw null; }
+        public override System.Security.Cryptography.ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[]? rgbIV) { throw null; }
         public override System.Security.Cryptography.ICryptoTransform CreateEncryptor() { throw null; }
-        public override System.Security.Cryptography.ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[] rgbIV) { throw null; }
+        public override System.Security.Cryptography.ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[]? rgbIV) { throw null; }
         protected override void Dispose(bool disposing) { }
         public override void GenerateIV() { }
         public override void GenerateKey() { }
@@ -498,9 +498,9 @@ public RijndaelManaged() { }
         public override System.Security.Cryptography.CipherMode Mode { get { throw null; } set { } }
         public override System.Security.Cryptography.PaddingMode Padding { get { throw null; } set { } }
         public override System.Security.Cryptography.ICryptoTransform CreateDecryptor() { throw null; }
-        public override System.Security.Cryptography.ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[] rgbIV) { throw null; }
+        public override System.Security.Cryptography.ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[]? rgbIV) { throw null; }
         public override System.Security.Cryptography.ICryptoTransform CreateEncryptor() { throw null; }
-        public override System.Security.Cryptography.ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[] rgbIV) { throw null; }
+        public override System.Security.Cryptography.ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[]? rgbIV) { throw null; }
         protected override void Dispose(bool disposing) { }
         public override void GenerateIV() { }
         public override void GenerateKey() { }
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RijndaelImplementation.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RijndaelImplementation.cs
index 8f59d147b07921..938f322ea7dfb0 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RijndaelImplementation.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/Internal/Cryptography/RijndaelImplementation.cs
@@ -74,9 +74,9 @@ public override PaddingMode Padding
 
         public override KeySizes[] LegalKeySizes => _impl.LegalKeySizes;
         public override ICryptoTransform CreateEncryptor() => _impl.CreateEncryptor();
-        public override ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[] rgbIV) => _impl.CreateEncryptor(rgbKey, rgbIV);
+        public override ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[]? rgbIV) => _impl.CreateEncryptor(rgbKey, rgbIV);
         public override ICryptoTransform CreateDecryptor() => _impl.CreateDecryptor();
-        public override ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[] rgbIV) => _impl.CreateDecryptor(rgbKey, rgbIV);
+        public override ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[]? rgbIV) => _impl.CreateDecryptor(rgbKey, rgbIV);
         public override void GenerateIV() => _impl.GenerateIV();
         public override void GenerateKey() => _impl.GenerateKey();
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesManaged.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesManaged.cs
index a48dc3b4ea8f97..e267fa197cca75 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesManaged.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/AesManaged.cs
@@ -61,9 +61,9 @@ public override PaddingMode Padding
         public override KeySizes[] LegalBlockSizes => _impl.LegalBlockSizes;
         public override KeySizes[] LegalKeySizes => _impl.LegalKeySizes;
         public override ICryptoTransform CreateEncryptor() => _impl.CreateEncryptor();
-        public override ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[] rgbIV) => _impl.CreateEncryptor(rgbKey, rgbIV);
+        public override ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[]? rgbIV) => _impl.CreateEncryptor(rgbKey, rgbIV);
         public override ICryptoTransform CreateDecryptor() => _impl.CreateDecryptor();
-        public override ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[] rgbIV) => _impl.CreateDecryptor(rgbKey, rgbIV);
+        public override ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[]? rgbIV) => _impl.CreateDecryptor(rgbKey, rgbIV);
         public override void GenerateIV() => _impl.GenerateIV();
         public override void GenerateKey() => _impl.GenerateKey();
 
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RijndaelManaged.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RijndaelManaged.cs
index 3c0f23050a882d..a4027d4a8b278d 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RijndaelManaged.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RijndaelManaged.cs
@@ -69,9 +69,9 @@ public override PaddingMode Padding
         // LegalBlockSizes not forwarded because base has correct information
         public override KeySizes[] LegalKeySizes => _impl.LegalKeySizes;
         public override ICryptoTransform CreateEncryptor() => _impl.CreateEncryptor();
-        public override ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[] rgbIV) => _impl.CreateEncryptor(rgbKey, rgbIV);
+        public override ICryptoTransform CreateEncryptor(byte[] rgbKey, byte[]? rgbIV) => _impl.CreateEncryptor(rgbKey, rgbIV);
         public override ICryptoTransform CreateDecryptor() => _impl.CreateDecryptor();
-        public override ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[] rgbIV) => _impl.CreateDecryptor(rgbKey, rgbIV);
+        public override ICryptoTransform CreateDecryptor(byte[] rgbKey, byte[]? rgbIV) => _impl.CreateDecryptor(rgbKey, rgbIV);
         public override void GenerateIV() => _impl.GenerateIV();
         public override void GenerateKey() => _impl.GenerateKey();
 

From b6e4750b1e3c0bf0dc940b0e708f7a3c3ed8e507 Mon Sep 17 00:00:00 2001
From: Buyaa Namnan <bunamnan@microsoft.com>
Date: Wed, 5 Feb 2020 12:04:52 -0800
Subject: [PATCH 12/13] Reference types of structs should be nullable

---
 .../Cryptography/DSACng.ImportExport.cs        | 18 +++++++++---------
 .../Cryptography/ECCng.ImportExport.cs         | 16 ++++++++--------
 .../Cryptography/EccKeyFormatHelper.cs         |  6 +++---
 .../System/Security/Cryptography/CngKeyLite.cs |  3 +--
 .../System/Security/Cryptography/DSA.Xml.cs    |  2 ++
 .../Security/Cryptography/DSAParameters.cs     |  8 ++++----
 .../System/Security/Cryptography/ECCurve.cs    | 10 +++++-----
 .../Security/Cryptography/ECParameters.cs      |  2 +-
 .../Security/Cryptography/RSAParameters.cs     |  4 ++--
 9 files changed, 35 insertions(+), 34 deletions(-)

diff --git a/src/libraries/Common/src/System/Security/Cryptography/DSACng.ImportExport.cs b/src/libraries/Common/src/System/Security/Cryptography/DSACng.ImportExport.cs
index d948132c50cd79..1d942466bc4929 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/DSACng.ImportExport.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/DSACng.ImportExport.cs
@@ -220,16 +220,16 @@ private static void GenerateV1DsaBlob(out byte[] blob, DSAParameters parameters,
                         }
 
                         // The Q length is hardcoded into BCRYPT_DSA_KEY_BLOB, so check it now we can give a nicer error message.
-                        if (parameters.Q.Length != Sha1HashOutputSize)
+                        if (parameters.Q!.Length != Sha1HashOutputSize)
                             throw new ArgumentException(SR.Cryptography_InvalidDsaParameters_QRestriction_ShortKey);
 
                         Interop.BCrypt.Emit(blob, ref offset, parameters.Q);
 
                         Debug.Assert(offset == sizeof(BCRYPT_DSA_KEY_BLOB), $"Expected offset = sizeof(BCRYPT_DSA_KEY_BLOB), got {offset} != {sizeof(BCRYPT_DSA_KEY_BLOB)}");
 
-                        Interop.BCrypt.Emit(blob, ref offset, parameters.P);
-                        Interop.BCrypt.Emit(blob, ref offset, parameters.G);
-                        Interop.BCrypt.Emit(blob, ref offset, parameters.Y);
+                        Interop.BCrypt.Emit(blob, ref offset, parameters.P!);
+                        Interop.BCrypt.Emit(blob, ref offset, parameters.G!);
+                        Interop.BCrypt.Emit(blob, ref offset, parameters.Y!);
                         if (includePrivate)
                         {
                             Interop.BCrypt.Emit(blob, ref offset, parameters.X!);
@@ -256,11 +256,11 @@ private static void GenerateV2DsaBlob(out byte[] blob, DSAParameters parameters,
                 {
                     int blobSize =
                         sizeof(BCRYPT_DSA_KEY_BLOB_V2) +
-                        (parameters.Seed == null ? parameters.Q.Length : parameters.Seed.Length) + // Use Q size if Seed is not present
-                        parameters.Q.Length +
-                        parameters.P.Length +
-                        parameters.G.Length +
-                        parameters.Y.Length +
+                        (parameters.Seed == null ? parameters.Q!.Length : parameters.Seed.Length) + // Use Q size if Seed is not present
+                        parameters.Q!.Length +
+                        parameters.P!.Length +
+                        parameters.G!.Length +
+                        parameters.Y!.Length +
                         (includePrivateParameters ? parameters.X!.Length : 0);
 
                     blob = new byte[blobSize];
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECCng.ImportExport.cs b/src/libraries/Common/src/System/Security/Cryptography/ECCng.ImportExport.cs
index d8a4a5e1af46cf..482f598cf00bed 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECCng.ImportExport.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECCng.ImportExport.cs
@@ -93,12 +93,12 @@ internal static byte[] GetPrimeCurveBlob(ref ECParameters parameters, bool ecdh)
                 //     byte[cbSubgroupOrder]        D
 
                 int blobSize = sizeof(BCRYPT_ECCFULLKEY_BLOB) +
-                    curve.Prime.Length +
-                    curve.A.Length +
-                    curve.B.Length +
+                    curve.Prime!.Length +
+                    curve.A!.Length +
+                    curve.B!.Length +
                     curve.G.X!.Length +
                     curve.G.Y!.Length +
-                    curve.Order.Length +
+                    curve.Order!.Length +
                     curve.Cofactor!.Length +
                     (curve.Seed == null ? 0 : curve.Seed.Length) +
                     parameters.Q.X!.Length +
@@ -279,12 +279,12 @@ internal static byte[] GetPrimeCurveParameterBlob(ref ECCurve curve)
                 //     byte[cbSeed]                 Seed
 
                 int blobSize = sizeof(BCRYPT_ECC_PARAMETER_HEADER) +
-                    curve.Prime.Length +
-                    curve.A.Length +
-                    curve.B.Length +
+                    curve.Prime!.Length +
+                    curve.A!.Length +
+                    curve.B!.Length +
                     curve.G.X!.Length +
                     curve.G.Y!.Length +
-                    curve.Order.Length +
+                    curve.Order!.Length +
                     curve.Cofactor!.Length +
                     (curve.Seed == null ? 0 : curve.Seed.Length);
 
diff --git a/src/libraries/Common/src/System/Security/Cryptography/EccKeyFormatHelper.cs b/src/libraries/Common/src/System/Security/Cryptography/EccKeyFormatHelper.cs
index 21f31f817ebf92..785fa560cf5e38 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/EccKeyFormatHelper.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/EccKeyFormatHelper.cs
@@ -607,7 +607,7 @@ private static void DetermineChar2Parameters(
             ref int k2,
             ref int k3)
         {
-            byte[] polynomial = ecParameters.Curve.Polynomial;
+            byte[] polynomial = ecParameters.Curve.Polynomial!;
             int lastIndex = polynomial.Length - 1;
 
             // The most significant byte needs a set bit, and the least significant bit must be set.
@@ -693,8 +693,8 @@ private static void DetermineChar2Parameters(
         private static void WriteCurve(in ECCurve curve, AsnWriter writer)
         {
             writer.PushSequence();
-            WriteFieldElement(curve.A, writer);
-            WriteFieldElement(curve.B, writer);
+            WriteFieldElement(curve.A!, writer);
+            WriteFieldElement(curve.B!, writer);
 
             if (curve.Seed != null)
             {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/CngKeyLite.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/CngKeyLite.cs
index dede9e0ae49468..77498b666d1681 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/CngKeyLite.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/CngKeyLite.cs
@@ -4,7 +4,6 @@
 
 using System;
 using System.Diagnostics;
-using System.Diagnostics.CodeAnalysis;
 using System.Runtime.InteropServices;
 using System.Security.Cryptography;
 using Internal.Cryptography;
@@ -274,7 +273,7 @@ internal static unsafe bool ExportPkcs8KeyBlob(
             int kdfCount,
             Span<byte> destination,
             out int bytesWritten,
-            [NotNullWhen(true)] out byte[]? allocated)
+            out byte[]? allocated)
         {
             using (SafeUnicodeStringHandle stringHandle = new SafeUnicodeStringHandle(password))
             {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSA.Xml.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSA.Xml.cs
index bb64cd20d0c545..cfa242d50fb96c 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSA.Xml.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSA.Xml.cs
@@ -2,6 +2,7 @@
 // The .NET Foundation licenses this file to you under the MIT license.
 // See the LICENSE file in the project root for more information.
 
+using System.Diagnostics;
 using System.Text;
 
 namespace System.Security.Cryptography
@@ -103,6 +104,7 @@ public override string ToXmlString(bool includePrivateParameters)
             // StringBuilder to need to grow.
 
             DSAParameters keyParameters = ExportParameters(includePrivateParameters);
+            Debug.Assert(keyParameters.P != null);
             StringBuilder builder = new StringBuilder((keyParameters.P.Length << 1) / 3);
             builder.Append("<DSAKeyValue>");
             XmlKeyHelper.WriteCryptoBinary(nameof(DSAParameters.P), keyParameters.P, builder);
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSAParameters.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSAParameters.cs
index 87734d4178dbf3..397d00e5548a67 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSAParameters.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/DSAParameters.cs
@@ -9,10 +9,10 @@ namespace System.Security.Cryptography
     // so you cannot accidently send it along with the public parameters.
     public struct DSAParameters
     {
-        public byte[] P;
-        public byte[] Q;
-        public byte[] G;
-        public byte[] Y;
+        public byte[]? P;
+        public byte[]? Q;
+        public byte[]? G;
+        public byte[]? Y;
         public byte[]? J;
         public byte[]? X;
         public byte[]? Seed;
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECCurve.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECCurve.cs
index 8bc7603aafe66f..c69fee89974075 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECCurve.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECCurve.cs
@@ -19,12 +19,12 @@ public partial struct ECCurve
         /// <summary>
         /// Coefficient A. Applies only to Explicit curves.
         /// </summary>
-        public byte[] A;
+        public byte[]? A;
 
         /// <summary>
         /// Coefficient B. Applies only to Explicit curves.
         /// </summary>
-        public byte[] B;
+        public byte[]? B;
 
         /// <summary>
         /// Base Point. Applies only to Explicit curves.
@@ -34,7 +34,7 @@ public partial struct ECCurve
         /// <summary>
         /// Order of the group generated by G = (x,y). Applies only to Explicit curves.
         /// </summary>
-        public byte[] Order;
+        public byte[]? Order;
 
         /// <summary>
         /// Cofactor (optional). Applies only to Explicit curves.
@@ -59,12 +59,12 @@ public partial struct ECCurve
         /// <summary>
         /// The binary polynomial. Applies only to Characteristic2 curves.
         /// </summary>
-        public byte[] Polynomial;
+        public byte[]? Polynomial;
 
         /// <summary>
         /// The prime specifying the base field. Applies only to Prime curves.
         /// </summary>
-        public byte[] Prime;
+        public byte[]? Prime;
 
         private Oid _oid;
         /// <summary>
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECParameters.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECParameters.cs
index fd74c8dc76b9e1..f325ba696fc41a 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECParameters.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/ECParameters.cs
@@ -50,7 +50,7 @@ public void Validate()
                 if (Curve.IsExplicit)
                 {
                     // Explicit curves require D length to match Curve.Order
-                    hasErrors = (D != null && (D.Length != Curve.Order.Length));
+                    hasErrors = (D != null && (D.Length != Curve.Order!.Length));
                 }
                 else if (Curve.IsNamed)
                 {
diff --git a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAParameters.cs b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAParameters.cs
index ee69dc3ac2aeb4..9e06c0055d15cd 100644
--- a/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAParameters.cs
+++ b/src/libraries/System.Security.Cryptography.Algorithms/src/System/Security/Cryptography/RSAParameters.cs
@@ -14,9 +14,9 @@ public struct RSAParameters
         public byte[]? D;
         public byte[]? DP;
         public byte[]? DQ;
-        public byte[] Exponent;
+        public byte[]? Exponent;
         public byte[]? InverseQ;
-        public byte[] Modulus;
+        public byte[]? Modulus;
         public byte[]? P;
         public byte[]? Q;
     }

From 3603771505c6613bba7a668a9b3ad29286fcde5a Mon Sep 17 00:00:00 2001
From: Buyaa Namnan <bunamnan@microsoft.com>
Date: Mon, 10 Feb 2020 15:05:16 -0800
Subject: [PATCH 13/13] Added some more bang

---
 .../Interop.EcDsa.ImportExport.cs                | 10 +++++-----
 .../Interop.Rsa.cs                               |  4 ++--
 .../Cryptography/ECOpenSsl.ImportExport.cs       | 16 ++++++++--------
 3 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs
index 41017b9ab78051..85c256da2d97c1 100644
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.EcDsa.ImportExport.cs
@@ -59,11 +59,11 @@ internal static SafeEcKeyHandle EcKeyCreateByExplicitCurve(ECCurve curve)
             byte[] p;
             if (curve.IsPrime)
             {
-                p = curve.Prime;
+                p = curve.Prime!;
             }
             else if (curve.IsCharacteristic2)
             {
-                p = curve.Polynomial;
+                p = curve.Polynomial!;
             }
             else
             {
@@ -76,11 +76,11 @@ internal static SafeEcKeyHandle EcKeyCreateByExplicitCurve(ECCurve curve)
                 null, 0,
                 null, 0,
                 p, p.Length,
-                curve.A, curve.A.Length,
-                curve.B, curve.B.Length,
+                curve.A!, curve.A!.Length,
+                curve.B!, curve.B!.Length,
                 curve.G.X!, curve.G.X!.Length,
                 curve.G.Y!, curve.G.Y!.Length,
-                curve.Order, curve.Order.Length,
+                curve.Order!, curve.Order!.Length,
                 curve.Cofactor, curve.Cofactor!.Length,
                 curve.Seed, curve.Seed == null ? 0 : curve.Seed.Length);
 
diff --git a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Rsa.cs b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Rsa.cs
index e6fbc4ee01fb40..425a493d8eaf34 100644
--- a/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Rsa.cs
+++ b/src/libraries/Common/src/Interop/Unix/System.Security.Cryptography.Native/Interop.Rsa.cs
@@ -194,9 +194,9 @@ private static extern bool GetRsaParameters(
         [return: MarshalAs(UnmanagedType.Bool)]
         internal static extern bool SetRsaParameters(
             SafeRsaHandle key,
-            byte[] n,
+            byte[]? n,
             int nLength,
-            byte[] e,
+            byte[]? e,
             int eLength,
             byte[]? d,
             int dLength,
diff --git a/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.ImportExport.cs b/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.ImportExport.cs
index 4bdd59dc4672aa..609ec1125a4cf3 100644
--- a/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.ImportExport.cs
+++ b/src/libraries/Common/src/System/Security/Cryptography/ECOpenSsl.ImportExport.cs
@@ -129,12 +129,12 @@ private static SafeEcKeyHandle ImportPrimeCurveParameters(ECParameters parameter
                 parameters.Q.X, parameters.Q.X!.Length,
                 parameters.Q.Y, parameters.Q.Y!.Length,
                 parameters.D, parameters.D == null ? 0 : parameters.D.Length,
-                parameters.Curve.Prime, parameters.Curve.Prime.Length,
-                parameters.Curve.A, parameters.Curve.A.Length,
-                parameters.Curve.B, parameters.Curve.B.Length,
+                parameters.Curve.Prime!, parameters.Curve.Prime!.Length,
+                parameters.Curve.A!, parameters.Curve.A!.Length,
+                parameters.Curve.B!, parameters.Curve.B!.Length,
                 parameters.Curve.G.X!, parameters.Curve.G.X!.Length,
                 parameters.Curve.G.Y!, parameters.Curve.G.Y!.Length,
-                parameters.Curve.Order, parameters.Curve.Order.Length,
+                parameters.Curve.Order!, parameters.Curve.Order!.Length,
                 parameters.Curve.Cofactor, parameters.Curve.Cofactor!.Length,
                 parameters.Curve.Seed, parameters.Curve.Seed == null ? 0 : parameters.Curve.Seed.Length);
 
@@ -149,12 +149,12 @@ private static SafeEcKeyHandle ImportCharacteristic2CurveParameters(ECParameters
                 parameters.Q.X, parameters.Q.X!.Length,
                 parameters.Q.Y, parameters.Q.Y!.Length,
                 parameters.D, parameters.D == null ? 0 : parameters.D.Length,
-                parameters.Curve.Polynomial, parameters.Curve.Polynomial.Length,
-                parameters.Curve.A, parameters.Curve.A.Length,
-                parameters.Curve.B, parameters.Curve.B.Length,
+                parameters.Curve.Polynomial!, parameters.Curve.Polynomial!.Length,
+                parameters.Curve.A!, parameters.Curve.A!.Length,
+                parameters.Curve.B!, parameters.Curve.B!.Length,
                 parameters.Curve.G.X!, parameters.Curve.G.X!.Length,
                 parameters.Curve.G.Y!, parameters.Curve.G.Y!.Length,
-                parameters.Curve.Order, parameters.Curve.Order.Length,
+                parameters.Curve.Order!, parameters.Curve.Order!.Length,
                 parameters.Curve.Cofactor, parameters.Curve.Cofactor!.Length,
                 parameters.Curve.Seed, parameters.Curve.Seed == null ? 0 : parameters.Curve.Seed.Length);
 
