如何使用 Aes128CbcHmacSha256 创建令牌答案

【问题标题】：How to create a token using Aes128CbcHmacSha256如何使用 Aes128CbcHmacSha256 创建令牌
【发布时间】：2019-11-12 10:13:34
【问题描述】：

我可以使用这个 dot net core 2.2 代码使用 HmacSha256 算法创建一个对称签名的 jwt 令牌。

using System;
using System.Text;
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;

namespace ConsoleApp1
{
  class Program
  {
    static void Main(string[] args)
    {
      var securityKey = "7iMdnuwf7XMMKGXGSMHKcs+qicGCinCJONLPrhGOX94=";
      var symmetricSecurityKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(securityKey));
      var signingCredentials = new SigningCredentials(symmetricSecurityKey, SecurityAlgorithms.HmacSha256);
      var token = new JwtSecurityToken(signingCredentials: signingCredentials);
      Console.WriteLine(new JwtSecurityTokenHandler().WriteToken(token));
    }
  }
}

但如果我将算法更改为 Aes128CbcHmacSha256，我会收到此异常。

System.InvalidOperationException
  HResult=0x80131509
  Message=IDX10677: GetKeyedHashAlgorithm threw, key: [PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.], algorithm [PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.].
  Source=Microsoft.IdentityModel.Tokens
  StackTrace:
   at Microsoft.IdentityModel.Tokens.SymmetricSignatureProvider.get_KeyedHashAlgorithm()
   at Microsoft.IdentityModel.Tokens.SymmetricSignatureProvider.Sign(Byte[] input)
   at Microsoft.IdentityModel.JsonWebTokens.JwtTokenUtilities.CreateEncodedSignature(String input, SigningCredentials signingCredentials)
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.WriteToken(SecurityToken token)
   at ConsoleApp1.Program.Main(String[] args) in D:\Users\d841616\source\repos\JwtTokenTest\ConsoleApp1\Program.cs:line 16

Inner Exception 1:
InvalidOperationException: IDX10677: GetKeyedHashAlgorithm threw, key: [PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.], algorithm [PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.].

Inner Exception 2:
NotSupportedException: IDX10666: Unable to create KeyedHashAlgorithm for algorithm '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'.

谁能解释为什么会失败？

【问题讨论】：

标签： .net-core jwt

【解决方案1】：

使用 Aes128CbcHmacSha256 时，需要提供第二个密钥用于 jwt 内容的加密。

    static void Main(string[] args)
    {

      var securityKey = "7iMdnuwf7XMMKGXGSMHKcs+qicGCinCJONLPrhGOX94=";
      var symmetricSecurityKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(securityKey));
      var signingCredentials = new SigningCredentials(symmetricSecurityKey, SecurityAlgorithms.HmacSha256);

      var encryptingKey = "7iMdnuwf7XMMKGXG";
      var symmetricEncryptingKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(encryptingKey));
      var encryptingCredentials = new EncryptingCredentials(symmetricEncryptingKey, SecurityAlgorithms.Aes128KW, SecurityAlgorithms.Aes128CbcHmacSha256);

      var handler = new JwtSecurityTokenHandler();
      var claims = new List<Claim>()
      {
          new Claim("group", "test"),
      };
      var jwtSecurityToken = handler.CreateJwtSecurityToken(
        "issuer",
        "Audience",
        new ClaimsIdentity(claims),
        DateTime.Now,
        DateTime.Now.AddHours(1),
        DateTime.Now,
        signingCredentials,
        encryptingCredentials);
      string tokenString = handler.WriteToken(jwtSecurityToken);
      Console.WriteLine(tokenString);
      Console.ReadLine();
    }
  }

【讨论】：