JWS Tokens generation in Elixir

Question

I am trying to create JWS Tokens using Elixir. What I've got:

RSA Private key
Base 64 encoded sha256 cert thumbprint
Token header
Token body

What I need:

Token signature

JWS header looks like this

{ 
  "x5t#S256": {{ cert thumbprint }},
  "alg":"RS256"
}

To get the header token I just convert it to base64 and it's finished. Same with token body, I just convert the payload to base64.

The problem is getting token signature. As I understand it should be done like this:

token signature = base64(rsa-sha256(token header + "." + token body))

Q1: Is my logic here correct?

Q2: How to do the rsa-sha256 encryption on Elixir? Or is it the same thing as :crypto.hash(sha256, ...)?

Why would you reinvent a wheel? We have JOSE for that. Even if you don’t want to rely on 3rd party, check the code, it is OSS, there are all the algorithms. — Aleksei Matiushkin

Adam Millerchip Adam Millerchip · Accepted Answer · 2019-03-16T06:18:43

I've not worked with JWS in Elixir, but I decided to try it as an exercise. You can generate the JWS signature using RSA like this:

rsa_private_key = JOSE.JWK.from_pem_file("rsa-2048.pem")
header = %{"alg" => "RS256"}
payload = %{"example" => "foo"}

JOSE.JWT.sign(rsa_private_key, header, payload)

Output:

{%{alg: :jose_jws_alg_rsa_pkcs1_v1_5},
 %{
   "payload" => "eyJleGFtcGxlIjoiZm9vIn0",
   "protected" => "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9",
   "signature" => "T2llXS2pGN-jev10Xd5EZQmaEih_dn9DIn5FJJg8ocEwIpNLupEWiNLz-5mP21z9JGpyYPFaRuq77AtKL67nP7KMDTpKKYJonOxQdL31sHU4vTKBRf-2XcVbDLGkST5dUMUWHOS106Sw_0x7DSiuFBUzkkYQ_lZKES8idVUp88Kx4uWU65Yoti0_Pu7aVLRGWDu0EiMjzuTPTBkMoib21VEVBqrJ4jiKXFudEFiNNSaV_GOH9yNZqyxwl4RhCYYT9U-Mda8Dc7xPjQk0LaJhwlaV91OhxJQHP2fGR8XkznHFlRRHTEsesYgl9OKZuSzVXoffydLc1VotphKUnG1WZQ"
 }}

And if you want it in short form:

JOSE.JWT.sign(rsa_private_key, header, payload) |> JOSE.JWS.compact

Produces:

{%{alg: :jose_jws_alg_rsa_pkcs1_v1_5},
"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJleGFtcGxlIjoiZm9vIn0.T2llXS2pGN-jev10Xd5EZQmaEih_dn9DIn5FJJg8ocEwIpNLupEWiNLz-5mP21z9JGpyYPFaRuq77AtKL67nP7KMDTpKKYJonOxQdL31sHU4vTKBRf-2XcVbDLGkST5dUMUWHOS106Sw_0x7DSiuFBUzkkYQ_lZKES8idVUp88Kx4uWU65Yoti0_Pu7aVLRGWDu0EiMjzuTPTBkMoib21VEVBqrJ4jiKXFudEFiNNSaV_GOH9yNZqyxwl4RhCYYT9U-Mda8Dc7xPjQk0LaJhwlaV91OhxJQHP2fGR8XkznHFlRRHTEsesYgl9OKZuSzVXoffydLc1VotphKUnG1WZQ"}

Here is the public key if you want to verify it:

JWS Tokens generation in Elixir

2 Answers