22
$\begingroup$

As I understand it, a JSON Web Token (JWT) consists of 3 parts:

  • the header, specifying the hashing algorithm to use for the signature;
  • the payload itself; and
  • the signature, which is a hash of the header and the payload using the specified hashing algorithm and a given secret.

The point of the signature is for the receiver to verify the integrity of the received JWT, that it has not been tampered with. This is done, presumably, by the receiver of the JWT reproducing the steps made by the JWT producer to create the signature, by hashing the header and the payload with the specified hashing algorithm and a given secret.

When the secret used by the JWT sender and receiver is one and the same (shared secret, symmetric key), I understand how this works. All the inputs are identical, so the hash will be identical, whether calculated by the sender or receiver.

My actual question, and what I don't understand, is how this works when the secrets used by the sender and receiver are different (asymmetric keys, public/private key pair). I.e. if the hash produced by the sender was generated using the secret key, and the hash produced by the receiver (for signature verification purposes) was produced by the corresponding public key.

How can two different secrets yield the same hash?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
21
$\begingroup$

I received the following explanation from a separate source.

Send:    { object | encrypt(hash(object), private_key) }
Receive: { object | signature }
Verify:  hash(object) == decrypt(signature, public_key)

This explains what I was struggling to understand.

There are two processes at work here: not just hashing, but also encryption. The actual hashing itself needs no secret parameter, it takes in only the object to be hashed (the concatenation of header + payload in the case of JWT). The resulting hash itself is then the input to the encryption, the result of which forms the signature, which can then be decrypted by the recipient to retrieve the original hash for comparison against the recipient's own computed hash.

Thus, instead of the sender and recipient performing similar calculations, with different secrets, to arrive at the same hash value:

hash(object, private_key) == signature == hash(object, public_key)

we rather have the sender and recipient performing complementary calculations to arrive back at the original input

decrypt(encrypt(hash_value, private_key), public_key) == hash_value

This makes sense with how I understand public-private key encryption.

Improve this answer
$\endgroup$
9
  • $\begingroup$ Thanks for your explanation, but in public-private key encryption, we use public key to encrypt and private key to decrypt which opposite to what you said, decrypt(encrypt(hash_value, private_key), public_key), please correct me if I'm wrong. $\endgroup$
    – sankar
    Mar 25, 2019 at 22:14
  • 1
    $\begingroup$ For the normal encryption use case, where you want to obfuscate the message content so that only the recipient can read it, you would be correct: the sender would use the public key, and the receiver would use the private key. However, the use case here is that anyone should be able to read the token content, but need to be able to verify that the sender is the expected sender. For this use case, the sender uses the private key, and the receiver uses the public key. See the second paragraph of "What is JSON Web Token?" under jwt.io/introduction. $\endgroup$
    – Anders Rabo Thorbeck
    Apr 2, 2019 at 12:12
  • $\begingroup$ @AndersRaboThorbeck the signature is hash (not encryption) which uses a sk to generate (HMACSHA256 needs a sk and that is the signature). So how can a client generate the same signature? what I am missing? $\endgroup$
    – Mike.R
    Jan 21, 2020 at 21:51
  • $\begingroup$ @Mike.R No, the signature is not a hash directly, it is the encryption of a hash, encrypted using the private key of a public-private key pair, or using a shared secret. The recipient of the JWT token does not generate the same signature, but rather decrypts the signature (using respectively the public key or the shared secret) to arrive back at the hash value, and can then verify that the hash value matches the content of the header and payload (by computing its own hash of these values and comparing it to the decrypted hash). $\endgroup$
    – Anders Rabo Thorbeck
    Jan 22, 2020 at 9:01
  • 1
    $\begingroup$ you can either embed the pulic key in the "jwk" claim or use "jku" claim to point to a file url containing public keys (can be more than one), the use "kid" claim to match the key you need. see here for a really good explanation of everything: pingidentity.com/en/company/blog/posts/2019/… $\endgroup$
    – Dawesi
    Aug 8, 2021 at 19:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.