class

KemalIdentity::JWT::RSA

Inherits KemalIdentity::JWT::Algorithm < Reference < Object

RSASSA-PKCS1-v1_5: RS256, RS384 and RS512.

The algorithms an OpenID Connect provider actually signs ID tokens with. Asymmetric, so the key this shard holds verifies and cannot forge — which is what makes a token from a third party meaningfully different from an HS256 one, where the verifier's copy of the key is also a signing key.

A Key built with one of these takes an RSAPublicKey in place of a Secret, so the same keyring, the same kid selection and the same allow-list apply unchanged.

Instance methods

name

The alg header value that selects this scheme, exactly as it appears in the token.

Source

verify(signing_input : String, signature : Bytes, key : Secret) : Bool

Not reachable through Key, which routes an RSA key to #verify_with. Present because Algorithm demands it, and refusing outright is better than quietly treating a public key as an HMAC secret — which is the algorithm-confusion attack itself.

Source

verify_with(signing_input : String, signature : Bytes, key : RSAPublicKey) : Bool

Source