I am totally new to this, so please bear with my question if it's utterly stupid. I am learning how to verify signature using https://jwt.io
The following is what I am doing
Generated Public/Private Key Pair
Private Key
-----BEGIN EC PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,4A6A48288A531DCA
m2glcvku6rdV8z0QBsBc3Hc72vG4NN3wIPnqdC47FTA3y9WiD7Ukh4m3ZpL2mraz
7PSblIe8ob/aaG9TYViIb4QRYZFg8z3jR6WeNEhC2EbC2CwkSSH3ug8ViQ+1i8d1
kMnQDK1i/s0BZvxlhKPuSy2kOIjelWctkDHvJyvU/WQ=
-----END EC PRIVATE KEY-----
Public Key
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHpqkegB/A/12vqfApHOaFXaJcHkyhNw1u9XnZe2+hiDT698U4c3iet5VyTo3D1DOe7Xi5dG07UorsMvWCmSbvU=
I used this website to generate ECDSA-256 pair of keys with passphrase as H2
Create a JSON Web Token (JWT)
I used http://jwtbuilder.jamiekurtz.com/ to generate the token
I used the private key to sign the JWT
. The following is the token
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJIYXJpdCIsImlhdCI6MTU4Nzc1MjM3NCwiZXhwIjoxNjE5Mjg4Mzc0LCJhdWQiOiJodHRwczovL3d3dy5oYXJpdC5kZXYiLCJzdWIiOiJjb250YWN0QGhhcml0LmNvbSIsIkdpdmVuTmFtZSI6Ikhhcml0IiwiU3VybmFtZSI6IkhpbWFuc2h1In0.pmvGfBXH4603YMGYDB6qOXlQjhfdPulvbODrK70ihS0
Verify
I go to the website https://jwt.io and below is the video of what I tried
Question
How JWT is verifying and telling it as a valid signature when the secret is empty. I have not even provided the secret yet.
What am I missing?