SHA256 hashalgorithm used in creating nonce key is not FIPS compliant.

[hmalli]

We have noticed that the GetNonceKey uses SHA256.Create() to generate hash algorithm which is not FIPS compliant and it is not designed to extend it easily to change the hash algorithm. Can you address this?

[Tratcher]

Note this has changed in the ASP.NET Core version:
https://github.com/aspnet/Security/blob/a53bf093a7d86b35e019c80515c92d7626982325/src/Microsoft.AspNetCore.Authentication.OpenIdConnect/OpenIdConnectHandler.cs#L888

[hmalli]

What about non asp.net core version?

[hmalli]

Tratcher - Any plan to make the same fix in non asp.net core version?

[Tratcher]

No decision has been made yet.

[muratg]

Backlogging this. @blowdart , FYI