Create and validate a JSON Web Signature (JWS)

This page shows how to use CryptoSys PKI to create and validate a JSON Web Signature (JWS) using RSASSA-PKCS1-v1_5 SHA-256 {"alg":"RS256"}. It includes sample code in C# and VBA.

Background

Example Code

C# code

Example C# code: JWS_Signature_RFC7515.cs.

The core line of the code to carry out the signing is

string jwsSignature = Sig.SignData(b, jwsPriKey, "", SigAlgorithm.Rsa_Sha256, Sig.SigOptions.Default, Sig.Encoding.Base64url);

where b is a byte array representing the JWS Signing Input and jwsPriKey is a string containing the RSA private key represented in JSON Web Key (JWK).

To validate the signature:

int n = Sig.VerifyData(jwsSignature, b, jwsPubKey, SigAlgorithm.Rsa_Sha256);

where a return value of zero means the signature is valid.

VBA/VB6 code

Example VBA code: JWS_Signature_RFC7515.bas

The core part of the code to carry out the signing is

Dim strJwsSignature As String
nChars = SIG_SignData("", 0, abData(0), nDataLen, strJwsPriKey, "", strAlgName, PKI_ENCODE_BASE64URL)
strJwsSignature = String(nChars, " ")
nChars = SIG_SignData(strJwsSignature, Len(strJwsSignature), abData(0), nDataLen, strJwsPriKey, "", strAlgName, PKI_ENCODE_BASE64URL)

where abData is a byte array of length nDataLen representing the JWS Signing Input, strJwsPriKey is a string containing the RSA private key represented in JSON Web Key (JWK), and strAlgName = "sha256WithRSAEncryption".

To validate the signature:

Dim nRet As Long
nRet = SIG_VerifyData(strJwsSignature, abData(0), nDataLen, strJwsPubKey, strAlgName, 0)

where a return value of zero means the signature is valid.

Summary of the signing process

JWS Signing Input

The input to be signed is a concatenation of the JWS Protected Header and JWS Payload both encoded in base64url and separated by a period '.' character. The header is a JSON object that must at a minimum contain the signing algorithm, e.g. {"alg":"RS256"}. The JWS Payload does not need to be a JSON object.

JWS Signature

The JWS signature is computed over the JWS Signing Input using, in this case, the RSA private key with the RSASSA-PKCS1-v1_5 SHA-256 algorithm. The JWS signature is encoded with base64url BASE64URL(JWS Signature)

JWS Compact Serialization

The complete JWS representation is called a JWS Compact Serialization and is a concatenation of the three values Header.Payload.Signature with period ('.') characters between the parts, all parts encoded in base64url.

Signature Validation

Base64url encoding

Base64url encoding is defined in [RFC7515] to use the URL- and filename-safe character set in section 5 of [RFC4648] with all trailing "=" characters omitted. The base64url character set is identical to base64 except "+" (plus sign, U+002B) is replaced by "-" (hyphen-minus, U+002D), and "/" (slash, U+002F) by "_" (underscore, U+005F).