Add encryption key size validation

src/OpenIddict.Abstractions/Resources/OpenIddictResources.resx

@@ -1385,6 +1385,10 @@ To register the OpenIddict core services, reference the 'OpenIddict.Core' packag
     <value>The implicit flow must be enabled when adding a response type containing '{0}'.</value>
     <comment>{Locked}</comment>
   </data>
+  <data name="ID0283" xml:space="preserve">
+    <value>Provided symmetric key was incorrect size. Expected {0} bits, received {1}.</value>
+    <comment>{Locked}</comment>
+  </data>
   <data name="ID2000" xml:space="preserve">
     <value>The security token is missing.</value>
   </data>

src/OpenIddict.Server/OpenIddictServerBuilder.cs

@@ -157,7 +157,8 @@ namespace Microsoft.Extensions.DependencyInjection
         /// <summary>
         /// Registers an encryption key.
         /// </summary>
-        /// <param name="key">The security key.</param>
+        /// <param name="key">The security key.
+        /// </param>
         /// <returns>The <see cref="OpenIddictServerBuilder"/>.</returns>
         public OpenIddictServerBuilder AddEncryptionKey(SecurityKey key)
         {
@@ -175,6 +176,11 @@ namespace Microsoft.Extensions.DependencyInjection
 
             if (key.IsSupportedAlgorithm(SecurityAlgorithms.Aes256KW))
             {
+                if (key.KeySize != 256)
+                {
+                    throw new InvalidOperationException(SR.FormatID0283(256, key.KeySize));
+                }
+
                 return AddEncryptionCredentials(new EncryptingCredentials(key,
                     SecurityAlgorithms.Aes256KW, SecurityAlgorithms.Aes256CbcHmacSha512));
             }

test/OpenIddict.Server.Tests/OpenIddictServerBuilderTests.cs

@@ -170,7 +170,7 @@ namespace OpenIddict.Server.Tests
             var services = CreateServices();
             var builder = CreateBuilder(services);
 
-            var key = Mock.Of<SecurityKey>(mock => mock.IsSupportedAlgorithm(SecurityAlgorithms.Aes256KW));
+            var key = Mock.Of<SecurityKey>(mock => mock.KeySize == 256 && mock.IsSupportedAlgorithm(SecurityAlgorithms.Aes256KW));
 
             // Act
             builder.AddEncryptionKey(key);
@@ -181,6 +181,32 @@ namespace OpenIddict.Server.Tests
             Assert.Same(key, options.EncryptionCredentials[0].Key);
         }
 
+        [Fact]
+        public void AddEncryptionKey_ThrowsExceptionWhenSymmetricKeyIsTooShort()
+        {
+            // Arrange
+            var services = CreateServices();
+            var builder = CreateBuilder(services);
+
+            // Act and assert
+            var key = Mock.Of<SecurityKey>(mock => mock.KeySize == 128 && mock.IsSupportedAlgorithm(SecurityAlgorithms.Aes256KW));
+            var exception = Assert.Throws<InvalidOperationException>(() => builder.AddEncryptionKey(key));
+            Assert.Equal(SR.FormatID0283(256, 128), exception.Message);
+        }
+
+        [Fact]
+        public void AddEncryptionKey_ThrowsExceptionWhenSymmetricKeyIsTooLong()
+        {
+            // Arrange
+            var services = CreateServices();
+            var builder = CreateBuilder(services);
+
+            // Act and assert
+            var key = Mock.Of<SecurityKey>(mock => mock.KeySize == 384 && mock.IsSupportedAlgorithm(SecurityAlgorithms.Aes256KW));
+            var exception = Assert.Throws<InvalidOperationException>(() => builder.AddEncryptionKey(key));
+            Assert.Equal(SR.FormatID0283(256, 384), exception.Message);
+        }
+
         [Fact]
         public void RemoveEventHandler_ThrowsAnExceptionWhenDescriptorIsNull()
         {