How to create a token using Aes128CbcHmacSha256

0

I can create a symmetrically signed jwt token using the HmacSha256 algorithm using this dot net core 2.2 code.

using System;
using System.Text;
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;

namespace ConsoleApp1
{
  class Program
  {
    static void Main(string[] args)
    {
      var securityKey = "7iMdnuwf7XMMKGXGSMHKcs+qicGCinCJONLPrhGOX94=";
      var symmetricSecurityKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(securityKey));
      var signingCredentials = new SigningCredentials(symmetricSecurityKey, SecurityAlgorithms.HmacSha256);
      var token = new JwtSecurityToken(signingCredentials: signingCredentials);
      Console.WriteLine(new JwtSecurityTokenHandler().WriteToken(token));
    }
  }
}

But if I change the algorithm to Aes128CbcHmacSha256 I get this exception.

System.InvalidOperationException
  HResult=0x80131509
  Message=IDX10677: GetKeyedHashAlgorithm threw, key: [PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.], algorithm [PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.].
  Source=Microsoft.IdentityModel.Tokens
  StackTrace:
   at Microsoft.IdentityModel.Tokens.SymmetricSignatureProvider.get_KeyedHashAlgorithm()
   at Microsoft.IdentityModel.Tokens.SymmetricSignatureProvider.Sign(Byte[] input)
   at Microsoft.IdentityModel.JsonWebTokens.JwtTokenUtilities.CreateEncodedSignature(String input, SigningCredentials signingCredentials)
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.WriteToken(SecurityToken token)
   at ConsoleApp1.Program.Main(String[] args) in D:\Users\d841616\source\repos\JwtTokenTest\ConsoleApp1\Program.cs:line 16

Inner Exception 1:
InvalidOperationException: IDX10677: GetKeyedHashAlgorithm threw, key: [PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.], algorithm [PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.].

Inner Exception 2:
NotSupportedException: IDX10666: Unable to create KeyedHashAlgorithm for algorithm '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'.

Can anyone explain why this is failing?

.net-core
jwt
asked on Stack Overflow Nov 8, 2019 by Douglas Woods • edited Nov 12, 2019 by Douglas Woods

1 Answer

0

When using Aes128CbcHmacSha256, you need to provide a second key for the encryption of the jwt contents.

    static void Main(string[] args)
    {

      var securityKey = "7iMdnuwf7XMMKGXGSMHKcs+qicGCinCJONLPrhGOX94=";
      var symmetricSecurityKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(securityKey));
      var signingCredentials = new SigningCredentials(symmetricSecurityKey, SecurityAlgorithms.HmacSha256);

      var encryptingKey = "7iMdnuwf7XMMKGXG";
      var symmetricEncryptingKey = new SymmetricSecurityKey(Encoding.ASCII.GetBytes(encryptingKey));
      var encryptingCredentials = new EncryptingCredentials(symmetricEncryptingKey, SecurityAlgorithms.Aes128KW, SecurityAlgorithms.Aes128CbcHmacSha256);

      var handler = new JwtSecurityTokenHandler();
      var claims = new List<Claim>()
      {
          new Claim("group", "test"),
      };
      var jwtSecurityToken = handler.CreateJwtSecurityToken(
        "issuer",
        "Audience",
        new ClaimsIdentity(claims),
        DateTime.Now,
        DateTime.Now.AddHours(1),
        DateTime.Now,
        signingCredentials,
        encryptingCredentials);
      string tokenString = handler.WriteToken(jwtSecurityToken);
      Console.WriteLine(tokenString);
      Console.ReadLine();
    }
  }
answered on Stack Overflow Nov 12, 2019 by Douglas Woods

User contributions licensed under CC BY-SA 3.0