如何使用带有RSA私钥的RS256对JWT进行签名

本文介绍了如何使用带有RSA私钥的RS256对JWT进行签名的处理方法，对大家解决问题具有一定的参考价值，需要的朋友们下面随着小编来一起学习吧！

问题描述

我正在使用 jose-jwt库，并希望使用C#在C#中创建签名的JWT RS256加密算法.我没有密码学的经验，所以请原谅我的无知.我在文档中看到以下示例:

I am using the jose-jwt library and want to create a signed JWT in C# using the RS256 algorithm for encryption. I have no experience with cryptography, so please excuse my ignorance. I see the following example in the docs:

var payload = new Dictionary<string, object>()
{
    { "sub", "[email protected]" },
    { "exp", 1300819380 }
};

var privateKey=new X509Certificate2("my-key.p12", "password", X509KeyStorageFlags.Exportable | X509KeyStorageFlags.MachineKeySet).PrivateKey as RSACryptoServiceProvider;

string token=Jose.JWT.Encode(payload, privateKey, JwsAlgorithm.RS256);

其中显示了p12文件的用法，但是如何使用下面形式的RSA密钥文件?我正在查看 X509Certificate2 ，但是我看不到RSA私钥的选项.它似乎只接受PKCS7，我认为这是公共密钥.

which shows the use of a p12 file, but how do I use an RSA key file of the form below? I am looking at the docs for X509Certificate2, but I see no option for RSA private keys. It appears to only accept PKCS7, which I understand to be public keys.

最后，文档中列出的两个选项之间有什么区别，以及如何做我要在两者之间选择?

Finally, what is the difference between the two options listed in the docs, and how do I choose between the two?

RS- *和PS- *系列

RS-* and PS-* family

CLR:

RS256，RS384，RS512和PS256，PS384，PS512签名需要对应的RSACryptoServiceProvider(通常为私有)密钥长度.需要强制CSP使用Microsoft增强的RSA和AES 加密提供者.通常可以重新导入 RSAParameters.参见 http://clrsecurity.codeplex.com/discussions/243156 有关详细信息.

RS256, RS384, RS512 and PS256, PS384, PS512 signatures require RSACryptoServiceProvider (usually private) key of corresponding length. CSP need to be forced to use Microsoft Enhanced RSA and AES Cryptographic Provider. Which usually can be done be re-importing RSAParameters. See http://clrsecurity.codeplex.com/discussions/243156 for details.

--------------------------选项2 ------------------- -------

-------------------------- OPTION 2 --------------------------

CORECLR:RS256，RS384，RS512签名需要相应长度的RSA(通常是私有)密钥.

CORECLR: RS256, RS384, RS512 signatures require RSA (usually private) key of corresponding length.

推荐答案

我知道这篇文章很旧，但是花了我很多时间才弄清楚这一点，所以我想分享一下.

I know this post is old, but it took me forever to figure this out, so I thought I would share.

要测试，我使用OpenSSL创建了RSA密钥:

To test I created RSA keys using OpenSSL:

openssl genrsa -out privateKey.pem 512
openssl rsa -in privateKey.pem -pubout -out publicKey.pem

您将需要以下2个nuget程序包:

You will need the following 2 nuget packages:

https://github.com/dvsekhvalnov/jose-jwt
http://www.bouncycastle.org/csharp/

https://github.com/dvsekhvalnov/jose-jwt
http://www.bouncycastle.org/csharp/

测试代码

public static void Test()
{
        string publicKey = File.ReadAllText(@"W:\Dev\Temp\rsa_keys\publicKey.pem");
        string privateKey = File.ReadAllText(@"W:\Dev\Temp\rsa_keys\privateKey.pem");

        var claims = new List<Claim>();
        claims.Add(new Claim("claim1", "value1"));
        claims.Add(new Claim("claim2", "value2"));
        claims.Add(new Claim("claim3", "value3"));

        var token = CreateToken(claims, privateKey);
        var payload = DecodeToken(token, publicKey);
}

创建令牌

public static string CreateToken(List<Claim> claims, string privateRsaKey)
{
     RSAParameters rsaParams;
     using (var tr = new StringReader(privateRsaKey))
     {
          var pemReader = new PemReader(tr);
          var keyPair = pemReader.ReadObject() as AsymmetricCipherKeyPair;
          if (keyPair == null)
          {
               throw new Exception("Could not read RSA private key");
          }
          var privateRsaParams = keyPair.Private as RsaPrivateCrtKeyParameters;
          rsaParams = DotNetUtilities.ToRSAParameters(privateRsaParams);
     }
     using (RSACryptoServiceProvider rsa = new RSACryptoServiceProvider())
     {
          rsa.ImportParameters(rsaParams);
          Dictionary<string, object> payload = claims.ToDictionary(k => k.Type, v => (object)v.Value);
          return Jose.JWT.Encode(payload, rsa, Jose.JwsAlgorithm.RS256);
     }
}

解码令牌

public static string DecodeToken(string token, string publicRsaKey)
{
     RSAParameters rsaParams;

     using (var tr = new StringReader(publicRsaKey))
     {
          var pemReader = new PemReader(tr);
          var publicKeyParams = pemReader.ReadObject() as RsaKeyParameters;
          if (publicKeyParams == null)
          {
               throw new Exception("Could not read RSA public key");
          }
          rsaParams = DotNetUtilities.ToRSAParameters(publicKeyParams);
     }
     using (RSACryptoServiceProvider rsa = new RSACryptoServiceProvider())
     {
          rsa.ImportParameters(rsaParams);
          // This will throw if the signature is invalid
          return Jose.JWT.Decode(token, rsa, Jose.JwsAlgorithm.RS256);
     }
}

我发现 https://jwt.io/是测试令牌的绝佳资源

I found https://jwt.io/ a great resource to test your tokens

这篇关于如何使用带有RSA私钥的RS256对JWT进行签名的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！