Validate JWT signature with RS512 using System.IdentityModel.Tokens.Jwt

Question

I wanted to verify JWT signature with RS512 algorithm using public key. I fond the exact solution given in the below link and it is working perfectly.

Verifying JWT signed with the RS256 algorithm using public key in C#

But I want to use System.IdentityModel.Tokens.Jwt with my application. Can anyone change below working example by implementing System.IdentityModel.Tokens.Jwt ?

 static void Main(string[] args)
        {

            var token = "eyJhbGciOiJSUzUxMiIsImtpZCI6ImsxMDY5NDgxOTAifQ.eyJleHAiOjE0NzMzNDcxODUsInN1YiI6ImZmZmZmZmZmNTcxZGJkNjBlNGIwMWYyNzk4ZGI5N2Y4Iiwic2Vzc2lkIjoiNzZlNTg4ZDIzZmM3NDBiMGFkNzIxMDk2MGYwOWFhY2IiLCJ0eXBlIjoiYXQiLCJpYXQiOjE0NzMzMzYzODV9.WA-5NFaDx38dDEbZTH_hEYpbhuC3yTA9RHCmyF3Z8L1eYmZ8w4RFv5PrjWN-HprkMP7WzVfwKeSCqU4O1_FGbl88arCgZb_Ui7VUxwftRDMErib8XFu4hGfRKrdZOOHxBY_EGLINLobYG-n0akRTycIjmH0sgroQ_3Na7sxCJSM";
            var secretKey = "j6Dtct-hCbacNoaTWVskOLh7Fcj4snuQ2kY3ZIpOZfJP-fsBgj6dxUFiqZSKjHikk73xiVLAb6w2SqQ8Z2Ez5hpGmG0U3eZzWkm8gwrpN-DN3eSBjBzyE5UUSTxmfMXGIBZtlwGEmmameycvX8nCJLuF83nK7Q5OQd7MIWUw-_8";
            bool isValied = false;

            string[] tokenParts = token.Split('.');

            RSACryptoServiceProvider rsa = new RSACryptoServiceProvider();
            rsa.ImportParameters(
              new RSAParameters()
              {
                  Modulus = FromBase64Url(secretKey),
                  Exponent = FromBase64Url("AQAB")
              });

            HashAlgorithm H = SHA512.Create();
            byte[] hash = H.ComputeHash(Encoding.UTF8.GetBytes(tokenParts[0] + '.' + tokenParts[1]));

            RSAPKCS1SignatureDeformatter rsaDeformatter = new RSAPKCS1SignatureDeformatter(rsa);
            rsaDeformatter.SetHashAlgorithm(H.GetType().ToString());
            if (rsaDeformatter.VerifySignature(hash, FromBase64Url(tokenParts[2])))
                isValied = true;




        }

        static byte[] FromBase64Url(string base64Url)
        {
            string padded = base64Url.Length % 4 == 0
                ? base64Url : base64Url + "====".Substring(base64Url.Length % 4);
            string base64 = padded.Replace("_", "/")
                                  .Replace("-", "+");
            return Convert.FromBase64String(base64);
        }

score 2 · Answer 1 · answered Oct 11 '16 at 09:50

Using the latest version of System.IdentityModel.Tokens.Jwt (5.0.0) and assuming you need to validate the following JWT token:

eyJhbGciOiJSUzUxMiIsImtpZCI6IjhDOURCQzA1OEIzN0Y5NzM2QzdCMzVGMDVFMDcxOENDMDUzOUU4RDciLCJ0eXAiOiJKV1QifQ.eyJuYmYiOjE0NzYxNzg2NzMsImV4cCI6MTQ3NjE4MjI3MywiaWF0IjoxNDc2MTc4NjczLCJpc3MiOiJNRSIsImF1ZCI6IllPVSJ9.Lh0iXDREkrgfuPBAJxOlNcoctRQkAV-VuhvH4oqavSV8M5ZYKhkSJ_11FyRN24yRTZfdScbOGZwO_-7Z8qSAbeLOc5HNa52LN09si-gruQFoB2Fikvd5FhwC5tqpqZeNw6usFR05Z9hl0SV05-joDv3OVfpnl31figrNiXcgqo2bB9kEPo6XeOw_JVTOrta6bHI-q6uulc4ZrLF4UWosb5R5ALLN5hwsY2lX9LrSCLfhuMlEDyjBbvrhC5fr29Ci9NYmk4U75qhhf13nS69vX8RJ5xRW8Nw6MP3Om0WaW-yX0RhtdrGZ8GuqdOxWU25i3j_qj5-ovO3OAhh0qsdMBA

which uses RS512 (view the full token contents by decoding it online in jwt.io) you could then do the following:

string thumbprint = "8C9DBC058B37F9736C7B35F05E0718CC0539E8D7"; // Change to your certificate

X509Certificate2 certificate = GetSigningCertificate(thumbprint);

var handler = new JwtSecurityTokenHandler();

string jwt = "[TOKEN_TO_BE_VALIDATED]";

SecurityToken token;
ClaimsPrincipal principal = handler.ValidateToken(jwt, new TokenValidationParameters
{
    ValidIssuer = "ME",
    ValidAudience = "YOU",
    IssuerSigningKey = new X509SecurityKey(certificate),
}, out token);

Thanks. I want to do this validation using Modulus and Exponent in the JWK. I don't have a thumbprint. And also GetSigningCertificate method is not implemented here. — Niroshana, Oct 12 '16 at 06:01
You should have stated your exact requirements in the question, I suggest you update it with the description of what exactly are you looking for. The `GetSigningCertificate` is just an helper method to get a `X509Certificate2`, .NET supports many ways to obtain a certificate and any would suffice. — João Angelo, Oct 12 '16 at 08:02
Thanks. I updated the question with my working code. Could you please do the same using System.IdentityModel.Tokens.Jwt . Please don't use inputs other than given in my example. — Niroshana, Oct 18 '16 at 04:15
@Niroshana How to implement the getSigningCert method. Did you find a solution for this. I am facing the same issue — Sourav Das, Nov 22 '17 at 18:14

Validate JWT signature with RS512 using System.IdentityModel.Tokens.Jwt

1 Answers1

Linked