{"action":"created","issue":{"url":"https://api.github.com/repos/dvsekhvalnov/jose-jwt/issues/20","repository_url":"https://api.github.com/repos/dvsekhvalnov/jose-jwt","labels_url":"https://api.github.com/repos/dvsekhvalnov/jose-jwt/issues/20/labels{/name}","comments_url":"https://api.github.com/repos/dvsekhvalnov/jose-jwt/issues/20/comments","events_url":"https://api.github.com/repos/dvsekhvalnov/jose-jwt/issues/20/events","html_url":"https://github.com/dvsekhvalnov/jose-jwt/issues/20","id":153816434,"number":20,"title":"Invalid algorithm specified and enhanced RSA Provider","user":{"login":"rmbrunet","id":2124799,"avatar_url":"https://avatars.githubusercontent.com/u/2124799?v=3","gravatar_id":"","url":"https://api.github.com/users/rmbrunet","html_url":"https://github.com/rmbrunet","followers_url":"https://api.github.com/users/rmbrunet/followers","following_url":"https://api.github.com/users/rmbrunet/following{/other_user}","gists_url":"https://api.github.com/users/rmbrunet/gists{/gist_id}","starred_url":"https://api.github.com/users/rmbrunet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rmbrunet/subscriptions","organizations_url":"https://api.github.com/users/rmbrunet/orgs","repos_url":"https://api.github.com/users/rmbrunet/repos","events_url":"https://api.github.com/users/rmbrunet/events{/privacy}","received_events_url":"https://api.github.com/users/rmbrunet/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-05-09T16:29:30Z","updated_at":"2016-05-10T14:35:36Z","closed_at":null,"body":"Testing JOSW-JWT I was getting \"Invalid algorithm specified\" errors with certificates that were working fine using Microsoft's JwtSecurityTokenHandler.\r\n\r\nFollowing the advice of http://hintdesk.com/c-how-to-fix-invalid-algorithm-specified-when-signing-with-sha256/ I regenerated the certificates using the -sp \"Microsoft Enhanced RSA and AES Cryptographic Provider\" -sy 24 options in makecert and then was able to generate the token with JOSE-JWT. And also to verify with JOSE-JWT the token generated with  JwtSecurityTokenHandler and viceversa. \r\n\r\nBy I wonder why it is necessary to specify the enhanced provider for JOSE-JWT and not for JwtSecurityTokenHandler."},"comment":{"url":"https://api.github.com/repos/dvsekhvalnov/jose-jwt/issues/comments/218176953","html_url":"https://github.com/dvsekhvalnov/jose-jwt/issues/20#issuecomment-218176953","issue_url":"https://api.github.com/repos/dvsekhvalnov/jose-jwt/issues/20","id":218176953,"user":{"login":"rmbrunet","id":2124799,"avatar_url":"https://avatars.githubusercontent.com/u/2124799?v=3","gravatar_id":"","url":"https://api.github.com/users/rmbrunet","html_url":"https://github.com/rmbrunet","followers_url":"https://api.github.com/users/rmbrunet/followers","following_url":"https://api.github.com/users/rmbrunet/following{/other_user}","gists_url":"https://api.github.com/users/rmbrunet/gists{/gist_id}","starred_url":"https://api.github.com/users/rmbrunet/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rmbrunet/subscriptions","organizations_url":"https://api.github.com/users/rmbrunet/orgs","repos_url":"https://api.github.com/users/rmbrunet/repos","events_url":"https://api.github.com/users/rmbrunet/events{/privacy}","received_events_url":"https://api.github.com/users/rmbrunet/received_events","type":"User","site_admin":false},"created_at":"2016-05-10T14:35:36Z","updated_at":"2016-05-10T14:35:36Z","body":"Hello @dvsekhvalnov,\r\n\r\nThanks for your answer. Yes, I was comparing the results from your library and Microsoft's implementation of JwtSecurityTokenHandler. \r\n\r\nI tested re-importing the key and, as you said, it works fine. Then there seems to be two ways of getting it right;\r\n\r\na) Re-importing the parameters.\r\n\r\nb) Specifying the  \"Microsoft Enhanced RSA and AES Cryptographic Provider\" provider when creating the certificate. For example, I used the following line to create a certificate that then used to sign a JWT without re-importing the private key:\r\n\r\n```\r\nmakecert -n \"CN=JOSE_TEST\" -ic \"JOSE_ROOT.cer\" -iv \"JOSE_ROOT.pvk\" -sp \"Microsoft Enhanced RSA and AES Cryptographic Provider\" -sy 24 -a sha256 -sky exchange -pe -sr LocalMachine -ss My\r\n```\r\n\r\nI have a another question. When signing a JWT we normally use a private key belonging to the issuer of the JWT and then the consumer of the JWT uses the corresponding public key to validate it. With encryption it seems that we need to use just the public key of the consumer and the certificate of the issuer plays no role. This seems strange to me (probably I am missing something) as there is no way for the consumer to validate the origin of the token. Is there a way to use different keys for encrypting and signing? What I am missing here?\r\n\r\nThanks again.\r\n\r\nRoberto   \r\n\r\n"}}