Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

what should be the key length in signingCredentials jwt asp.net core

public static string GenerateToken(string Username)
{
    var claimsdata = new[] { new Claim(ClaimTypes.Name, Username) };
    var key = new SymmetricSecurityKey(
        Encoding.UTF8.GetBytes("qwertyuioplkjhgfdsazxcvbnmqwertlkjfdslkjflksjfklsjfklsjdflskjflyuioplkjhgfdsazxcvbnmmnbv"));
    var signInCred = new SigningCredentials(key, SecurityAlgorithms.HmacSha384Signature);
    var token = new JwtSecurityToken(
        issuer: "mysite",
        audience: "mysite",
        expires: DateTime.Now.AddMinutes(60),
        claims: claimsdata,
        signingCredentials: signInCred);
    var tokenString = new JwtSecurityTokenHandler().WriteToken(token);
    return tokenString;
}

//the length of the key is 88 characters. if i reduce it to less than 16 characters it gives an exception:

System.ArgumentOutOfRangeException: 'IDX10603: Decryption failed. Keys tried: '[PII is hidden]'. Exceptions caught: '[PII is hidden]'. token: '[PII is hidden]''

like image 776
Mohan Kurali Avatar asked Sep 03 '18 16:09

Mohan Kurali


1 Answers

the minimum length in sha256 in 16 characters because they are 256 hexadecimal bits, then 256/16 = 16

like image 154
Horacio Avatar answered Oct 06 '22 00:10

Horacio