Subject: [jose] RSASSA-PKCS-v1_5 SHA-256 validation example

From: Antonio Sanso <[email-masked]>
Date: Wed, 2 Apr 2014 06:19:13 +0000

hi *,

IMHO the RSASSA-PKCS-v1_5 SHA-256 validation example n [0] can be a bit better explained.
Indeed it says

We pass (n, e), JWS Signature, and the JWS Signing Input to
   an RSASSA-PKCS-v1_5 signature verifier that has been configured to
   use the SHA-256 hash function.

There is no mention on the fact the JWS Signature should be decoded in order to be verified.
IMHO a bit of more wording around this would not harm.
WDYT?

regards

antonio

[0] http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-25#appendix-A.2.2

---

From: Antonio Sanso <[email-masked]>
Date: Wed, 9 Apr 2014 09:33:29 +0000

anyone :)?

Begin forwarded message:

From: Antonio Sanso <[email-masked]<mailto:[email-masked]>>
Subject: RSASSA-PKCS-v1_5 SHA-256 validation example
Date: April 2, 2014 at 8:19:11 AM GMT+2
To: <[email-masked]<mailto:[email-masked]>>

hi *,

regards

antonio

---

From: Mike Jones <[email-masked]>
Date: Wed, 9 Apr 2014 16:47:26 +0000

Hi Antonio,

The JWS Signature *is* the decoded signature.  The encoded signature is denoted BASE64URL(JWS Signature) in the spec.  The decoding and validation are described in steps 8 and 9 of http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-25#section-5.2.

That being said, I will look at ways to make the prose in the example clearer - for instance, possibly referencing steps 8 and 9 directly.

                                                            Thanks again,
                                                            -- Mike

From: jose [mailto:[email-masked]] On Behalf Of Antonio Sanso
Sent: Wednesday, April 09, 2014 2:33 AM
To: [email-masked]
Subject: [jose] Fwd: RSASSA-PKCS-v1_5 SHA-256 validation example

anyone :)?

Begin forwarded message:

hi *,

regards

antonio

---

From: Antonio Sanso <[email-masked]>
Date: Thu, 10 Apr 2014 06:37:07 +0000

hi Mike

On Apr 9, 2014, at 6:47 PM, Mike Jones <[email-masked]<mailto:[email-masked]>> wrote:

Hi Antonio,

That being said, I will look at ways to make the prose in the example clearer – for instance, possibly referencing steps 8 and 9 directly.

                                                            Thanks again,
                                                            — Mike

thanks a lot for the pointer.  And yes probably referencing http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-25#section-5.2. might help some implementer :) (or at least me :))

regards

antonio

From: jose [mailto:[email-masked]] On Behalf Of Antonio Sanso
Sent: Wednesday, April 09, 2014 2:33 AM
To: [email-masked]<mailto:[email-masked]>
Subject: [jose] Fwd: RSASSA-PKCS-v1_5 SHA-256 validation example

anyone :)?

Begin forwarded message:

hi *,

regards

antonio

---

From: Mike Jones <[email-masked]>
Date: Thu, 1 May 2014 06:54:35 +0000

FYI, the -26 draft has been edited to clarify the issue you raised.  See http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-26#appendix-A.2.2.

                                             Thanks for your feedback,
                                                            -- Mike

From: jose [mailto:[email-masked]] On Behalf Of Antonio Sanso
Sent: Tuesday, April 01, 2014 11:19 PM
To: [email-masked]
Subject: [jose] RSASSA-PKCS-v1_5 SHA-256 validation example

hi *,

regards

antonio