RS256 - Verify Signature.

VCL TMS Cryptography Pack
1

Hi Guys,


Pretty new to Crypto so please understand if my questions show a lack of understanding.

I am trying to verify the signature of a JWT (Json Web Token) we have three parts to the token encoding in BASE64 Header, Body, Signature. I have the public key in the form (character replaced with hashes) which I assume gai is BASE64 and looks like ###########################-###############.

I am struggling decoding the key into modulus and exponent.


Any suggestion would be much appreciated.


2

Hello Mark,

This is because JSON uses PKCS#1 v1.5 that we don't support. You should try PS256 instead of RS256.

Regards,

bernard

3
Bernard,

PS256 isn't an option  I am bound by Microsoft Azure. Is there anything on the road map for you guys to support PKCS#1 at some point in the future? 

Regards,
Mark

4

Mark,
We don't support PKCS#1 because it is not secure as many poor crypto standards still alive in  various RFCs and libraries.
PKCS#1 is not in our roadmap but we may consider it for interoperability reasons (it will be caveated as "deprecated" if we do so). We maintain it is not good practice to use such standards.
Regards,
bernard