Verifying jwt tokens [rsa]

Question

A collegue and myself have been trying to understand how jwt tokens verify tokens, but from our reading we seem to be confusing ourselves.

Please can someone help confirm whether my thinking is correct

• Tokens are signed using the private key. The signature is a combination of the header and payload encrypted using the private key and added to the jwt as the last part, the signature.
• In order to verify the token the receiver can replicate this process using the public key. They encrypt the header and payload to see if it the same as the signature. Note this is not decryption. The receiver is not decrypting the token (this is the main thing we are unsure of). -The receiver cannot issue new tokens as they do not have the private key to encrypt a new token with.

I have read the jwt documentation on both RS256 and HS256 and still struggling to confirm my thinking, hence the post.

Answer 1

Tokens can be digitally signed using a key pair, private and public, or hashed using a secret key:

• RS256 :RSA KeyPair with SHA256. Token is signed with private key and verified using the public

• HS256: HMAC key with SHA256. The key is the same to sign and verify

A compact JWT looks like this hhhhh.ppppp.sssss

• hhhhh: Header of JWT, includes the algorithm used to sign the token. e.g {"alg":"RS256","typ":"JWT"}. Encoded in base64url

• ppppp: Payload of JWT, include some useful claims like sub, iss or exp. Encoded in base64url

• sssss: Signature of JWT , performed on the concatenation of the base64 url encoding of header and payload using the specified algorithm and encoded in base64. E.g b64(signature(hhhhhh.pppppp))

Answering your question, you are refering to RS256 using a key pair where the client verifies the token using the public key (a verification with HMAC key would mean client and server share the key)

The token is signed (not encrypted) with the algorithm I wrote above. To verify, the client verifies that signature match with the first part of the token hhhhhh.pppppp using the provided public key. Digital signature verification is a standard operation supported in all modern languages. Note that is not the same as encryption/decryption