25

For token based authentication Microsoft.IdentityModel.Tokens provides a list of security algorithms that can be used to create SigningCredentials:

  string secretKey = "MySuperSecretKey";
  byte[] keybytes = Encoding.ASCII.GetBytes(secretKey);
  SecurityKey securityKey = new SymmetricSecurityKey(keybytes);
  SigningCredentials signingCredentials =
                    new SigningCredentials(securityKey,
                        SecurityAlgorithms.HmacSha256);

  SigningCredentials signingCredentials =
                    new SigningCredentials(securityKey,
                        SecurityAlgorithms.HmacSha256Signature);

What is the difference between HmacSha256 and HmacSha256Signature? When would you use the signature one instead of the non-signature one?**

There are other "non signature" and "signature" algorithms as well. For example, RsaSha256 and RsaSha256Signature

atiyar
  • 7,762
  • 6
  • 34
  • 75
Atomic Star
  • 5,427
  • 4
  • 39
  • 48

1 Answers1

14

HmacSha256 is a string constant evaluating to "HS256". HmacSha256Signature is also a string constant but evaluates to "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256"

The latest definition of System.IdentityModel.Tokens.SecurityAlgorithms does not include HmacSha256 but instead allows you to separate the signature and digest algorithms for the SigningCredentials.

You should use HmacSha256Signature for future-proofing your application as HmacSha256 looks deprecated.

From the Microsoft docs...

The members that have a Signature suffix can be used to specify the signatureAlgoritm parameter and the members that have a Digest suffix can be used to specify the digestAlgorithm parameter.

Marcus Cunningham
  • 350
  • 1
  • 9
  • 11
    When using `HmacSha256Signature` instead of `HmacSha256` https://jwt.io/ fails to verify the signature for some reason. – Konrad Aug 28 '18 at 14:58
  • 1
    Also, the RFC for JWT https://tools.ietf.org/html/rfc7519 doesn't mention `http` notation. – Konrad Aug 28 '18 at 15:01
  • 3
    @Konrad You still need to use `HmacSha256` to verify the algorithm type, as that is what is actually in the JWT – phuzi Feb 07 '20 at 11:05