-
Type:
Task
-
Resolution: Fixed
-
Priority:
Major - P3
-
Affects Version/s: None
-
Component/s: None
-
Server Security
-
v8.1, v8.0, v7.0
-
Server Security 2025-06-06, Server Security 2025-06-20, Server Security 2025-07-04
-
200
-
None
-
3
-
TBD
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Right now we support RS256, RS384 and RS512 JWT signing algorithms. This ticket will add support for PS256.
PS256 is similar to RS256 but uses a different padding scheme (PSS - Probabilistic Signature Scheme) instead of PKCS#1 v1.5 padding. This requires different OpenSSL functions to verify and validate tokens signed with it.
Work required:
In `jws_validator_openssl.cpp`:
- Add new kPS256 constant and update getHashingAlg() method.
- Add new validation path for PSS algorithms using EVP_PKEY_CTX instead of EVP_MD_CTX.
- Take into consideration extra algorithms could be added in the future.
In `jws_validated_token_test.cpp`:
- Add unit tests for PS256 JWT.
- fixes
-
SERVER-106548 Update custom-key used in jws_validated_token_test to use the actual key
-
- Closed
-