JWT Keys - Asymmetric and Symmetric

jwt signature encryption-asymmetric
n00b picture n00b · Oct 2, 2015 · Viewed 12.4k times · Source

I understand the difference between symmetric and asymmetric keys. I understand that the keys are used to calculate the signature and then verify them. However diving a little deeper, I'd like to understand a bit more which I'm having trouble finding online.

Are the keys given to the consumers to verify the contents? Wouldn't that give consumers the ability to change the JWT contents if symmetric keys are used?

When asymmetric keys are used is the signature calculated with the private or public key? Is the consumer given the public/private key?

Answer

Hans Z. picture Hans Z. · Oct 2, 2015

Symmetric keys are only to be used in a peer-to-peer way so it would be pointless for the receiver to modify JWTs for which only he and the sender have a shared key (and he is the intended recipient).

Asymmetric key signatures (in JWTs as well as in general) are produced by the sender with the private key and verified by the receiver with the public key. The consumer/receiver is given only the public key which happens out_of_band (i.e. through another means of communication than the one you use to exchange the secured data).

Related questions

c# How to verify signature JWT?

I have a token, a file containing public key and I want to verify the signature. I tried to verify signature based on this. However, decodedCrypto and decodedSignature don't match. Here is my code: public static string Decode(string token, …

Read More
What are the main differences between JWT and OAuth authentication?

I have a new SPA with a stateless authentication model using JWT. I am often asked to refer OAuth for authentication flows like asking me to send 'Bearer tokens' for every request instead of a simple token header but I …

Read More
JWT authentication for ASP.NET Web API

I'm trying to support JWT bearer token (JSON Web Token) in my web API application and I'm getting lost. I see support for .NET Core and for OWIN applications. I'm currently hosting my application in IIS. How can I achieve …

Read More