Using ECDSA/RSA Signing?

[gamringer]

Using ECDSA/RSA Signing?

[gamringer]

Hi,

A standard JWS simply puts the base 64 encoded signature as the last component of its form. Unfortunately, none of the currently existing JWT libraries support this extension. It is my plan to submit appropriate patches to some of them, but meanwhile, you can construct a valid JWS by hand using the available tests as starting points:`

https://github.com/gamringer/php-pkcs11/blob/master/tests/0163-rsa-sign-pss.phpt
https://github.com/gamringer/php-pkcs11/blob/master/tests/0170-ecdsa.phpt

I would strongly suggest still using a well tested library for validation of those resulting JWTs to avoid numerous often repeated mistakes.

[InfinityMin3r]

after a bit further digging, I think it's doable, it's just not in the README. I will see if I can figure it out

[gamringer]

@InfinityMin3r, was my last comment helpful ? Which library are you using for your JWTs ? I'll make sure it's included in my PRs

[InfinityMin3r]

Hi @gamringer, worked perfectly. I had to do some modifications to the Spomky Framework in order to get it to work properly. I'm still in the process of hacking the framework to get access to the fields in the JWS before the signature is verified.

Btw, I had to fix a few lines of code to get your library to work on php8.1.

But yes, this library is great! Now I don't have to migrate everything to Java.

Thanks!

[gamringer]

@InfinityMin3r, you're right, the last release that I made was still incompatible with 8.1, but the master branch is already compatible. I should probably address that.

That being said, I am pleased to see that you find this extension helpful.