As I understand it, a JSON Web Token (JWT) consists of 3 parts:

  • the header, specifying the hashing algorithm to use for the signature;
  • the payload itself; and
  • the signature, which is a hash of the header and the payload using the specified hashing algorithm and a given secret.

The point of the signature is for the receiver to verify the integrity of the received JWT, that it has not been tampered with. This is done, presumably, by the receiver of the JWT reproducing the steps made by the JWT producer to create the signature, by hashing the header and the payload with the specified hashing algorithm and a given secret.

When the secret used by the JWT sender and receiver is one and the same (shared secret, symmetric key), I understand how this works. All the inputs are identical, so the hash will be identical, whether calculated by the sender or receiver.

My actual question, and what I don't understand, is how this works when the secrets used by the sender and receiver are different (asymmetric keys, public/private key pair). I.e. if the hash produced by the sender was generated using the secret key, and the hash produced by the receiver (for signature verification purposes) was produced by the corresponding public key.

How can two different secrets yield the same hash?


I received the following explanation from a separate source.

Send:    { object | encrypt(hash(object), private_key) }
Receive: { object | signature }
Verify:  hash(object) == decrypt(signature, public_key)

This explains what I was struggling to understand.

There are two processes at work here: not just hashing, but also encryption. The actual hashing itself needs no secret parameter, it takes in only the object to be hashed (the concatenation of header + payload in the case of JWT). The resulting hash itself is then the input to the encryption, the result of which forms the signature, which can then be decrypted by the recipient to retrieve the original hash for comparison against the recipient's own computed hash.

Thus, instead of the sender and recipient performing similar calculations, with different secrets, to arrive at the same hash value:

hash(object, private_key) == signature == hash(object, public_key)

we rather have the sender and recipient performing complementary calculations to arrive back at the original input

decrypt(encrypt(hash_value, private_key), public_key) == hash_value

This makes sense with how I understand public-private key encryption.

  • $\begingroup$ Thanks for your explanation, but in public-private key encryption, we use public key to encrypt and private key to decrypt which opposite to what you said, decrypt(encrypt(hash_value, private_key), public_key), please correct me if I'm wrong. $\endgroup$ – sankar Mar 25 at 22:14
  • $\begingroup$ For the normal encryption use case, where you want to obfuscate the message content so that only the recipient can read it, you would be correct: the sender would use the public key, and the receiver would use the private key. However, the use case here is that anyone should be able to read the token content, but need to be able to verify that the sender is the expected sender. For this use case, the sender uses the private key, and the receiver uses the public key. See the second paragraph of "What is JSON Web Token?" under jwt.io/introduction. $\endgroup$ – Anders Rabo Thorbeck Apr 2 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.