Skip to content

Digital Signature with ECDSA not implemented according to RFC 7518 #21

Description

@paceto256

ES256, ES384 are not implemented according to RFC 7518

RFC 7518:
"Generate a digital signature of the JWS Signing Input using ECDSA
P-256 SHA-256 with the desired private key. The output will be
the pair (R, S), where R and S are 256-bit unsigned integers ..."

here is the problematic sign method:
https://github.com/psecio/jwt/blob/master/src/Psecio/Jwt/Jwt.php#L324

test case:

  1. create private & public key with ES384.
  2. use the private key and this lib to sign the token
    use the signed token generated by this lib and try to validate it using the public key and this tool:
    http://kjur.github.io/jsjws/tool_jwt.html (working correct by RFC7518)

here is a working implementation with ES256, ES384, etc you can check
https://github.com/lcobucci/jwt/blob/master/src/Signer/Ecdsa.php#L82

Regards,
Plamen

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions