hi Mike On Apr 9, 2014, at 6:47 PM, Mike Jones <[email protected]<mailto:[email protected]>> wrote:
Hi Antonio, The JWS Signature *is* the decoded signature. The encoded signature is denoted BASE64URL(JWS Signature) in the spec. The decoding and validation are described in steps 8 and 9 of http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-25#section-5.2. That being said, I will look at ways to make the prose in the example clearer – for instance, possibly referencing steps 8 and 9 directly. Thanks again, — Mike thanks a lot for the pointer. And yes probably referencing http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-25#section-5.2. might help some implementer :) (or at least me :)) regards antonio From: jose [mailto:[email protected]] On Behalf Of Antonio Sanso Sent: Wednesday, April 09, 2014 2:33 AM To: [email protected]<mailto:[email protected]> Subject: [jose] Fwd: RSASSA-PKCS-v1_5 SHA-256 validation example anyone :)? Begin forwarded message: From: Antonio Sanso <[email protected]<mailto:[email protected]>> Subject: RSASSA-PKCS-v1_5 SHA-256 validation example Date: April 2, 2014 at 8:19:11 AM GMT+2 To: <[email protected]<mailto:[email protected]>> hi *, IMHO the RSASSA-PKCS-v1_5 SHA-256 validation example n [0] can be a bit better explained. Indeed it says We pass (n, e), JWS Signature, and the JWS Signing Input to an RSASSA-PKCS-v1_5 signature verifier that has been configured to use the SHA-256 hash function. There is no mention on the fact the JWS Signature should be decoded in order to be verified. IMHO a bit of more wording around this would not harm. WDYT? regards antonio [0] http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-25#appendix-A.2.2
_______________________________________________ jose mailing list [email protected] https://www.ietf.org/mailman/listinfo/jose
