JWT web token encryption - SecurityAlgoritms.HmacSha256 vs SecurityAlgoritms.HmacSha256Signature

Question

For token based authentication Microsoft.IdentityModel.Tokens provides a list of security algorithms that can be used to create SigningCredentials:

  string secretKey = "MySuperSecretKey";
  byte[] keybytes = Encoding.ASCII.GetBytes(secretKey);
  SecurityKey securityKey = new SymmetricSecurityKey(keybytes);
  SigningCredentials signingCredentials =
                    new SigningCredentials(securityKey,
                        SecurityAlgorithms.HmacSha256);

  SigningCredentials signingCredentials =
                    new SigningCredentials(securityKey,
                        SecurityAlgorithms.HmacSha256Signature);

What is the difference between HmacSha256 and HmacSha256Signature? When would you use the signature one instead of the non-signature one?**

There are other algorithms "non signature" and "signature" algorithms as well - RsaSha256 and RsaSha256

Answer 1

HmacSha256是一个字符串常量，计算结果为“HS256”。HmacSha256Signature也是一个字符串常量，但计算结果为“ http://www.w3.org/2001/04/xmldsig-more#hmac-sha256 ”

的最新定义System.IdentityModel.Tokens.SecurityAlgorithms不包括 HmacSha256，而是允许您将SigningCredentials.

您应该使用看起来已弃用HmacSha256Signature的应用程序来验证您的应用程序的未来HmacSha256。

从微软文档...

具有 Signature 后缀的成员可用于指定signatureAlgorithm 参数，具有Digest 后缀的成员可用于指定digestAlgorithm 参数。