question: PS256 signatures fail to validate in jwt.io about jose HOT 7 CLOSED

I've poked my colleague (@Sambego) to take a look at this, no promises tho.

from jose.

Hi @neilwashere,

Can you provide the specific JWS, private and public PEMs? I'm happy to look into it.

jwt.io does not do any "backend", your key material and potentially PII containing tokens remain in your browsers, it's using webpacked node-jose

from jose.

Thank @panva. I think this may just be jwt.io as this is the same issue auth0/node-jws#85.

Thanks for the response!

from jose.

@neilwashere please confirm it's fixed with 0.11.0

from jose.

Bottom line

https://tools.ietf.org/html/rfc7518#section-3.5

A key of size 2048 bits or larger MUST be used with this algorithm.

and

The size of the salt value is the same size as
the hash function output. All other algorithm parameters use the
defaults specified in Appendix A.2.3 of RFC 3447.

from jose.

@panva confirmed 0.11.0 working 👍 🎉

from jose.

Thanks.

from jose.