基于Token认证：服务器私钥加密客户端公钥解密的算法选择

Got it, let's break down your problem clearly. You want a token system where your server generates an encrypted token, and clients can decrypt it to read payload data—specifically using server-side private key "encryption" and client-side public key decryption. Here are the two most practical approaches, depending on your exact needs:

1. 推荐方案：JWT + RS256 签名算法（行业标准） #

This is the most robust and widely adopted solution for your use case. It lets clients read payload data directly while guaranteeing the token was issued by your server (prevents tampering and non-repudiation).

JWT has three parts: Header.Payload.Signature:

• Payload: Your custom data (like user IDs, roles) stored as Base64-encoded plaintext—clients can decode this instantly to read the content.
• Signature: Your server uses its private key to sign a hash of the Header + Payload. Clients use your public key to verify the signature, ensuring the token hasn't been altered and came from a trusted source.

C# Server: Generate JWT with RS256 #

using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using Microsoft.IdentityModel.Tokens;
using System.Security.Cryptography;

// Load your server's private key (store this securely, never hardcode!)
var privateKeyXml = "<your-RSA-private-key-xml>";
using var rsa = RSA.Create();
rsa.FromXmlString(privateKeyXml);

var tokenHandler = new JwtSecurityTokenHandler();
var tokenDescriptor = new SecurityTokenDescriptor
{
    Subject = new ClaimsIdentity(new[]
    {
        new Claim(ClaimTypes.NameIdentifier, "user_123"),
        new Claim("role", "admin"),
        new Claim("exp", DateTimeOffset.UtcNow.AddHours(1).ToUnixTimeSeconds().ToString())
    }),
    SigningCredentials = new SigningCredentials(
        new RsaSecurityKey(rsa), 
        SecurityAlgorithms.RsaSha256) // RS256 signature algorithm
};

var securityToken = tokenHandler.CreateToken(tokenDescriptor);
var jwtToken = tokenHandler.WriteToken(securityToken);
// Return jwtToken to the client

C# Client: Validate JWT & Read Payload #

using System.IdentityModel.Tokens.Jwt;
using Microsoft.IdentityModel.Tokens;
using System.Security.Cryptography;

var jwtToken = "<token-received-from-server>";
var publicKeyXml = "<your-server's-public-RSA-key-xml>";

using var rsa = RSA.Create();
rsa.FromXmlString(publicKeyXml);

var tokenHandler = new JwtSecurityTokenHandler();
var validationParams = new TokenValidationParameters
{
    ValidateIssuerSigningKey = true,
    IssuerSigningKey = new RsaSecurityKey(rsa),
    ValidateIssuer = false, // Toggle based on your business rules
    ValidateAudience = false,
    ValidateLifetime = true // Check if token is expired
};

try
{
    var claimsPrincipal = tokenHandler.ValidateToken(jwtToken, validationParams, out var validatedToken);
    var jwt = validatedToken as JwtSecurityToken;
    
    // Extract payload data
    var userId = jwt.Claims.First(c => c.Type == ClaimTypes.NameIdentifier).Value;
    var role = jwt.Claims.First(c => c.Type == "role").Value;
    
    Console.WriteLine($"User ID: {userId}, Role: {role}");
}
catch (SecurityTokenException ex)
{
    Console.WriteLine($"Invalid token: {ex.Message}");
}

2. Direct RSA Reverse Encryption (Not Recommended, But Technically Possible) #

If you strictly need to "encrypt" the payload with your private key for clients to decrypt with the public key (note: this offers no confidentiality—anyone with the public key can read the data), you can reverse RSA's typical usage.

Key Caveats #

• RSA has strict payload size limits: For a 2048-bit key, you can only encrypt ~245 bytes (depends on padding). This makes it unsuitable for large payloads.
• This only proves the data came from your server (since only you have the private key)—it doesn't keep the data secret.

C# Server: Encrypt with Private Key #

using System.Security.Cryptography;
using System.Text;

var privateKeyXml = "<your-RSA-private-key-xml>";
using var rsa = new RSACryptoServiceProvider();
rsa.FromXmlString(privateKeyXml);

// Small payload (keep it under size limits!)
var payload = "{\"userId\":\"123\",\"role\":\"admin\"}";
var payloadBytes = Encoding.UTF8.GetBytes(payload);

// Encrypt with private key (using PKCS#1 v1.5 padding)
var encryptedBytes = rsa.Encrypt(payloadBytes, false);
var token = Convert.ToBase64String(encryptedBytes);

C# Client: Decrypt with Public Key #

using System.Security.Cryptography;
using System.Text;

var token = "<base64-encrypted-token>";
var publicKeyXml = "<your-server's-public-RSA-key-xml>";

using var rsa = new RSACryptoServiceProvider();
rsa.FromXmlString(publicKeyXml);

var tokenBytes = Convert.FromBase64String(token);
var decryptedBytes = rsa.Decrypt(tokenBytes, false);
var payload = Encoding.UTF8.GetString(decryptedBytes);

Console.WriteLine("Decrypted payload: " + payload);

Final Recommendation #

Stick with JWT + RS256—it's industry-standard, supports large payloads, and provides clear separation between readable data and tamper-proof verification. The reverse RSA approach is only useful for tiny, non-sensitive payloads and isn't ideal for production authentication systems.

内容的提问来源于stack exchange，提问作者Rakesh