title: Generate a strong HMACSHA256 key in C#
body: <p>I'm looking to implement HMACSHA256 request signing in an API I'm building. From what I understood from <a href="https://www.rfc-editor.org/rfc/rfc4868" rel="nofollow noreferrer">https://www.rfc-editor.org/rfc/rfc4868</a>, it's best that the secret key be the same number of bits as the hashing algorithm (i.e. SHA256 secret keys should be 256 bits/32 bytes).</p>
  <p>Can I use one of the many different random number generators out there for C# or is there a specific way that these keys need to be generated.</p>
  <p>Lastly, Amazon Web Services uses HMACSHA256, but they secret keys they provide (at least to me) is 320 bits/40 bytes (when the key is converted to bytes using UTF-8, see <a href="https://github.com/aws/aws-sdk-net/blob/master/AWSSDK/Amazon.Runtime/Internal/Auth/AWS4Signer.cs#L205-L232" rel="nofollow noreferrer">https://github.com/aws/aws-sdk-net/blob/master/AWSSDK/Amazon.Runtime/Internal/Auth/AWS4Signer.cs#L205-L232</a>). Is there a reason to use more than needed by the hashing algorithm since it's truncated?</p>