.NET中RijndaelManaged与AESManaged是否调用Windows API？

我们知道FileStream.Read会调用底层Windows API的ReadFile，但不确定RijndaelManaged或AESManaged是否也会间接调用Windows CryptoAPI——换句话说，当恶意.NET二进制文件调用AESManaged时，会不会触发Windows API调用？

比如下面这段代码，会不会间接调用BCryptEncrypt这类Windows API？

public byte[] AES_Encrypt(byte[] bytesToBeEncrypted, byte[] passwordBytes)
{
    byte[] result = null;
    byte[] salt = new byte[]
    {
        1,
        2,
        3,
        4,
        5,
        6,
        7,
        8
    };
    using (MemoryStream memoryStream = new MemoryStream())
    {
        using (RijndaelManaged rijndaelManaged = new RijndaelManaged())
        {
            rijndaelManaged.KeySize = 256;
            rijndaelManaged.BlockSize = 128;
            Rfc2898DeriveBytes rfc2898DeriveBytes = new Rfc2898DeriveBytes(passwordBytes, salt, 1000);
            rijndaelManaged.Key = rfc2898DeriveBytes.GetBytes(rijndaelManaged.KeySize / 8);
            rijndaelManaged.IV = rfc2898DeriveBytes.GetBytes(rijndaelManaged.BlockSize / 8);
            rijndaelManaged.Mode = CipherMode.CBC;
            using (CryptoStream cryptoStream = new CryptoStream(memoryStream, rijndaelManaged.CreateEncryptor(), CryptoStreamMode.Write))
            {
                cryptoStream.Write(bytesToBeEncrypted, 0, bytesToBeEncrypted.Length);
                cryptoStream.Close();
            }
            result = memoryStream.ToArray();
        }
    }
    return result;
}

1. 核心结论：.NET Framework中的RijndaelManaged和AESManaged是纯托管实现，默认不会调用Windows CryptoAPI（如BCryptEncrypt）。
2. 类的区别：
   • 带Managed后缀的加密类，加密逻辑完全在.NET运行时内部实现，不依赖系统底层加密API，执行时不会触发Windows API调用。
   • 带CryptoServiceProvider后缀的类（如AesCryptoServiceProvider），才会调用Windows的BCrypt或CryptoAPI。
3. 针对示例代码：你提供的代码使用RijndaelManaged，整个加密流程（包括基于RFC2898的密钥派生、AES CBC模式加密）都是纯托管代码执行，不会触发Windows加密相关API调用。

内容的提问来源于stack exchange，提问作者Moooz