public void ComputeSignature(SecurityKey signingKey)
 {
     string signatureMethod = this.Signature.SignedInfo.SignatureMethod;
     SymmetricSecurityKey key = signingKey as SymmetricSecurityKey;
     if (key != null)
     {
         using (KeyedHashAlgorithm algorithm = key.GetKeyedHashAlgorithm(signatureMethod))
         {
             if (algorithm == null)
             {
                 throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(System.IdentityModel.SR.GetString("UnableToCreateKeyedHashAlgorithm", new object[] { key, signatureMethod })));
             }
             this.ComputeSignature(algorithm);
             return;
         }
     }
     AsymmetricSecurityKey key2 = signingKey as AsymmetricSecurityKey;
     if (key2 == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(System.IdentityModel.SR.GetString("UnknownICryptoType", new object[] { signingKey })));
     }
     using (HashAlgorithm algorithm2 = key2.GetHashAlgorithmForSignature(signatureMethod))
     {
         if (algorithm2 == null)
         {
             throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(System.IdentityModel.SR.GetString("UnableToCreateHashAlgorithmFromAsymmetricCrypto", new object[] { signatureMethod, key2 })));
         }
         AsymmetricSignatureFormatter signatureFormatter = key2.GetSignatureFormatter(signatureMethod);
         if (signatureFormatter == null)
         {
             throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(System.IdentityModel.SR.GetString("UnableToCreateSignatureFormatterFromAsymmetricCrypto", new object[] { signatureMethod, key2 })));
         }
         this.ComputeSignature(algorithm2, signatureFormatter, signatureMethod);
     }
 }

        /// <summary>
        /// Inherited from <see cref="SecurityTokenResolver"/>.
        /// </summary>
        protected override bool TryResolveSecurityKeyCore( SecurityKeyIdentifierClause keyIdentifierClause, out SecurityKey key )
        {
            if ( keyIdentifierClause == null )
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull( "keyIdentifierClause" );
            }

            key = null;

            X509RawDataKeyIdentifierClause rawDataClause = keyIdentifierClause as X509RawDataKeyIdentifierClause;
            if ( rawDataClause != null )
            {
                key = rawDataClause.CreateKey();
                return true;
            }

            RsaKeyIdentifierClause rsaClause = keyIdentifierClause as RsaKeyIdentifierClause;
            if ( rsaClause != null )
            {
                key = rsaClause.CreateKey();
                return true;
            }

            if ( _wrappedTokenResolver.TryResolveSecurityKey( keyIdentifierClause, out key ) )
            {
                return true;
            }

            return false;
        }

 private void InitCrypto(SecurityKey securityKey)
 {
     m_securityKey = securityKey;
     List<SecurityKey> securityKeys = new List<SecurityKey>(1);
     securityKeys.Add(securityKey);
     m_securityKeys = securityKeys.AsReadOnly();
 }

        /// <summary>
        /// Constructs an EncryptingCredentials with a security key, a security key identifier and
        /// the encryption algorithm.
        /// </summary>
        /// <param name="key">A security key for encryption.</param>
        /// <param name="keyIdentifier">A security key identifier for the encryption key.</param>
        /// <param name="algorithm">The encryption algorithm.</param>
        /// <exception cref="ArgumentNullException">When key is null.</exception>
        /// <exception cref="ArgumentNullException">When key identifier is null.</exception>
        /// <exception cref="ArgumentNullException">When algorithm is null.</exception>
        public EncryptingCredentials(SecurityKey key, SecurityKeyIdentifier keyIdentifier, string algorithm)
        {
            if (key == null)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("key");
            }

            if (keyIdentifier == null)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("keyIdentifier");
            }

            if (string.IsNullOrEmpty(algorithm))
            {
                throw DiagnosticUtility.ThrowHelperArgumentNullOrEmptyString("algorithm");
            }

            //
            // It is possible that keyIdentifier is pointing to a token which 
            // is not capable of doing the given algorithm, we have no way verify 
            // that at this level.
            //
            _algorithm = algorithm;
            _key = key;
            _keyIdentifier = keyIdentifier;
        }

		public SigningCredentials (SecurityKey signingKey, string signatureAlgorithm, string digestAlgorithm, SecurityKeyIdentifier signingKeyIdentifier)
			: this (signingKey, signatureAlgorithm, digestAlgorithm)
		{
			if (signingKeyIdentifier == null)
				throw new ArgumentNullException ("signingKeyIdentifier");
			this.identifier = signingKeyIdentifier;
		}

 public bool TryResolveSecurityKey(SecurityKeyIdentifierClause keyIdentifierClause, out SecurityKey key)
 {
     if (keyIdentifierClause == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("keyIdentifierClause");
     }
     return this.TryResolveSecurityKeyCore(keyIdentifierClause, out key);
 }

		protected BinarySecretSecurityToken (string id, byte [] key, bool allowCrypto)
			: this (id, allowCrypto)
		{
			if (key == null)
				throw new ArgumentNullException ("key");
			this.key = key;

			SecurityKey [] arr = new SecurityKey [] {new InMemorySymmetricSecurityKey (key)};
			keys = new ReadOnlyCollection<SecurityKey> (arr);
		}

		public SwtIssuerTokenResolver()
		{
			var signValue = ConfigurationManager.AppSettings[SigningKeyAppSetting];
			if (string.IsNullOrEmpty(signValue))
				throw new InvalidSecurityException(string.Format(
					"Required appSettings key '{0}' containing the 256-bit symmetric key for token signing was not found.",
					SigningKeyAppSetting));

			this.key = new InMemorySymmetricSecurityKey(Convert.FromBase64String(signValue));
		}

		protected override bool TryResolveSecurityKeyCore (
			SecurityKeyIdentifierClause keyIdentifierClause,
			out SecurityKey key)
		{
			key = null;
			foreach (SecurityTokenResolver r in resolvers)
				if (r != null && r.TryResolveSecurityKey (keyIdentifierClause, out key))
					return true;
			return false;
		}

 protected override bool TryResolveSecurityKeyCore(SecurityKeyIdentifierClause keyIdentifierClause, out SecurityKey key)
 {
     SecurityToken token;
     if (this.TryResolveTokenCore(keyIdentifierClause, out token))
     {
         key = ((SecurityContextSecurityToken) token).SecurityKeys[0];
         return true;
     }
     key = null;
     return false;
 }

		protected override bool TryResolveSecurityKeyCore(SecurityKeyIdentifierClause keyIdentifierClause, out SecurityKey key)
		{
			// We pass ourselves a SwtSecurityKeyClause from the SwtSecurityTokenHandler on ValidateToken.
			var nameClause = keyIdentifierClause as SwtSecurityKeyClause;

			// If it wasn't us passing the clause, let the base class handle other built-in scenarios (i.e. X509)
			if (nameClause == null)
				return base.TryResolveSecurityKeyCore(keyIdentifierClause, out key);

			key = this.key;
			return true;
		}

        protected override bool TryResolveSecurityKeyCore(SecurityKeyIdentifierClause keyIdentifierClause, out SecurityKey key)
        {
            key = null;
            var swtClause = keyIdentifierClause as WebTokenSecurityKeyClause;

            string value;
            if (_signingKeys.TryGetValue(swtClause.Issuer.ToLowerInvariant(), out value))
            {
                key = new InMemorySymmetricSecurityKey(Convert.FromBase64String(value));

                return true;
            }

            return false;
        }

        protected override bool TryResolveSecurityKeyCore(SecurityKeyIdentifierClause keyIdentifierClause, out SecurityKey key)
        {
            key = null;
            CustomTokenKeyIdentifierClause keyClause = keyIdentifierClause as CustomTokenKeyIdentifierClause;
            if (keyClause != null)
            {
                string base64Key = null;
                _keys.TryGetValue(keyClause.Audience, out base64Key);
                if (!string.IsNullOrEmpty(base64Key))
                {
                    key = new InMemorySymmetricSecurityKey(Encoding.UTF8.GetBytes(base64Key));
                    return true;
                }
            }

            return false;
        }

        /// <summary>
        /// Initializes a new instance of the <see cref="NamedKeySecurityToken"/> class that contains a single <see cref="SecurityKey"/>.
        /// </summary>
        /// <param name="name">A name for the <see cref="SecurityKey"/>.</param>
        /// <param name="id">the identifier for this token.</param>
        /// <param name="key">A <see cref="SecurityKey"/></param>
        /// <exception cref="ArgumentNullException">if 'name' is null or whitespace.</exception>
        /// <exception cref="ArgumentNullException">if 'id' is null or whitespace.</exception>
        /// <exception cref="ArgumentNullException">if 'key' is null.</exception>
        public NamedKeySecurityToken(string name, string id, SecurityKey key)
        {
            if (string.IsNullOrWhiteSpace(name))
                throw new ArgumentNullException("name");

            if (string.IsNullOrWhiteSpace(id))
                throw new ArgumentNullException("id");

            if (key == null)
                throw new ArgumentNullException("key");

            this.id = id;
            this.name = name;
            this.securityKeys = new List<SecurityKey>{key};
            this.validFrom = DateTime.UtcNow;

        }

        /// <summary>
        /// Override of the base class. Resolves the given SecurityKeyIdentifierClause to a 
        /// SecurityKey.
        /// </summary>
        /// <param name="keyIdentifierClause">The Clause to be resolved.</param>
        /// <param name="key">The resolved SecurityKey</param>
        /// <returns>True if successfully resolved.</returns>
        /// <exception cref="ArgumentNullException">Input argument 'keyIdentifierClause' is null.</exception>
        protected override bool TryResolveSecurityKeyCore( SecurityKeyIdentifierClause keyIdentifierClause, out SecurityKey key )
        {
            if ( keyIdentifierClause == null )
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull( "keyIdentifierClause" );
            }

            key = null;
            foreach ( SecurityTokenResolver tokenResolver in _tokenResolvers )
            {
                if ( tokenResolver.TryResolveSecurityKey( keyIdentifierClause, out key ) )
                {
                    return true;
                }
            }

            return false;
        }

        /// <summary>
        /// Creates the JWT header
        /// </summary>
        /// <param name="token">The token.</param>
        /// <param name="credential">The credentials.</param>
        /// <returns>The JWT header</returns>
        protected virtual async Task<JwtHeader> CreateHeaderAsync(Token token, SecurityKey key)
        {
            JwtHeader header = null;

#if DOTNET5_4
            header = new JwtHeader(new SigningCredentials(key, SecurityAlgorithms.RsaSha256Signature));
#elif NET451
            header = new JwtHeader(new SigningCredentials(key, SecurityAlgorithms.RsaSha256Signature, SecurityAlgorithms.Sha256Digest));

            var x509key = key as X509SecurityKey;
            if (x509key != null)
            {
                header.Add("kid", await _keyService.GetKidAsync(x509key.Certificate));
                header.Add("x5t", await _keyService.GetKidAsync(x509key.Certificate));
            }
#endif

            return header;
        }

        /// <summary>
        /// Resolves the given SecurityKeyIdentifierClause to a SecurityKey.
        /// </summary>
        /// <param name="keyIdentifierClause">SecurityKeyIdentifierClause to resolve</param>
        /// <param name="key">The resolved SecurityKey.</param>
        /// <returns>True if successfully resolved.</returns>
        /// <exception cref="ArgumentNullException">The input argument 'keyIdentifierClause' is null.</exception>
        protected override bool TryResolveSecurityKeyCore(SecurityKeyIdentifierClause keyIdentifierClause, out SecurityKey key)
        {
            if (keyIdentifierClause == null)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("keyIdentifierClause");
            }

            key = null;
            EncryptedKeyIdentifierClause encryptedKeyIdentifierClause = keyIdentifierClause as EncryptedKeyIdentifierClause;
            if (encryptedKeyIdentifierClause != null)
            {
                SecurityKeyIdentifier keyIdentifier = encryptedKeyIdentifierClause.EncryptingKeyIdentifier;
                if (keyIdentifier != null && keyIdentifier.Count > 0)
                {
                    for (int i = 0; i < keyIdentifier.Count; i++)
                    {
                        SecurityKey unwrappingSecurityKey = null;
                        if (TryResolveSecurityKey(keyIdentifier[i], out unwrappingSecurityKey))
                        {
                            byte[] wrappedKey = encryptedKeyIdentifierClause.GetEncryptedKey();
                            string wrappingAlgorithm = encryptedKeyIdentifierClause.EncryptionMethod;
                            byte[] unwrappedKey = unwrappingSecurityKey.DecryptKey(wrappingAlgorithm, wrappedKey);
                            key = new InMemorySymmetricSecurityKey(unwrappedKey, false);
                            return true;
                        }
                    }
                }
            }
            else
            {
                SecurityToken token = null;
                if (TryResolveToken(keyIdentifierClause, out token))
                {
                    if (token.SecurityKeys.Count > 0)
                    {
                        key = token.SecurityKeys[0];
                        return true;
                    }
                }
            }

            return false;
        }

 public SigningCredentials(SecurityKey signingKey, string signatureAlgorithm, string digestAlgorithm, SecurityKeyIdentifier signingKeyIdentifier)
 {
     if (signingKey == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("signingKey"));
     }
     if (signatureAlgorithm == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("signatureAlgorithm"));
     }
     if (digestAlgorithm == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("digestAlgorithm"));
     }
     this.signingKey = signingKey;
     this.signatureAlgorithm = signatureAlgorithm;
     this.digestAlgorithm = digestAlgorithm;
     this.signingKeyIdentifier = signingKeyIdentifier;
 }

 protected override bool TryResolveSecurityKeyCore(SecurityKeyIdentifierClause keyIdentifierClause, out SecurityKey key)
 {
     bool flag = false;
     key = null;
     flag = this.tokenResolver.TryResolveSecurityKey(keyIdentifierClause, false, out key);
     if (!flag && (this.outOfBandTokenResolvers != null))
     {
         for (int i = 0; i < this.outOfBandTokenResolvers.Count; i++)
         {
             flag = this.outOfBandTokenResolvers[i].TryResolveSecurityKey(keyIdentifierClause, out key);
             if (flag)
             {
                 break;
             }
         }
     }
     if (!flag)
     {
         flag = System.ServiceModel.Security.SecurityUtils.TryCreateKeyFromIntrinsicKeyClause(keyIdentifierClause, this, out key);
     }
     return flag;
 }

        private SignatureProvider CreateProvider(SecurityKey key, string algorithm, bool willCreateSignatures)
        {
            _Logger?.LogDebug($"Creating {algorithm} provider for {key.KeyId} for {(willCreateSignatures ? "signing" : "verifying")}");
            if (key == null)
                throw new ArgumentNullException(nameof(key));
            if (string.IsNullOrWhiteSpace(algorithm))
                throw new ArgumentNullException(nameof(algorithm));

            //AsymmetricSecurityKey asymmetricSecurityKey = key as AsymmetricSecurityKey;
            //if (asymmetricSecurityKey != null)
            //    return new AsymmetricSignatureProvider(asymmetricSecurityKey, algorithm, willCreateSignatures, this.AsymmetricAlgorithmResolver);
            SymmetricSecurityKey symmetricSecurityKey = key as SymmetricSecurityKey;
            if (symmetricSecurityKey != null)
                return new SymmetricSignatureProvider(symmetricSecurityKey, algorithm);
            JsonWebKey jsonWebKey = key as JsonWebKey;
            if (jsonWebKey != null && jsonWebKey.Kty != null)
            {
                //if (jsonWebKey.Kty == "RSA" || jsonWebKey.Kty == "EC")
                //    return new AsymmetricSignatureProvider(key, algorithm, willCreateSignatures, this.AsymmetricAlgorithmResolver);
                if (jsonWebKey.Kty == "oct")
                    return new SymmetricSignatureProvider(key, algorithm);
            }
            throw new ArgumentException($"{typeof(SignatureProvider)} supports: '{typeof(SecurityKey)}' of types: '{typeof(AsymmetricSecurityKey)}' or '{typeof(AsymmetricSecurityKey)}'. SecurityKey received was of type: '{key.GetType()}'.");
        }