Support PS256 JWS Signing Algorithms for OIDC

XMLWordPrintableJSON

    • Server Security
    • v8.1, v8.0, v7.0
    • Server Security 2025-06-06, Server Security 2025-06-20, Server Security 2025-07-04
    • 200
    • None
    • 3
    • TBD
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Right now we support RS256, RS384 and RS512 JWT signing algorithms. This ticket will add support for PS256.

      PS256 is similar to RS256 but uses a different padding scheme (PSS - Probabilistic Signature Scheme) instead of PKCS#1 v1.5 padding. This requires different OpenSSL functions to verify and validate tokens signed with it.

      Work required:
      In `jws_validator_openssl.cpp`:

      1. Add new kPS256 constant and update getHashingAlg() method.
      2. Add new validation path for PSS algorithms using EVP_PKEY_CTX instead of EVP_MD_CTX.
      3. Take into consideration extra algorithms could be added in the future.

       

      In `jws_validated_token_test.cpp`:

      1. Add unit tests for PS256 JWT.

            Assignee:
            Kat Cheng
            Reporter:
            Adam Rayner
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: