There's examples of this in the documentation , but I've found it to be a useful and not necessarily intuitive technique. Say for interop purposes the X509SecurityTokenManager needs to use RSA15 instead of RSAOAEP and the EncryptedKeyTokenManager should