question: PS256 signatures fail to validate in jwt.io

Hello, I have come to your library specifically looking to generate signatures with the PS256 alg. I am coming from a different lib that may possibly using the same underlying crypto but as this lib requires node >=11 I was hopeful it would resolve the apparent issue I am facing.

The problem I have is that our recipients are failing verification when we have signed with PS256. I’m using jwt.io as an independent source of verification but I can’t seem to generate a signature that will pass validation. I’m not sure what jwt.io are using on the backend but whatever it is, I am at a loss.

I’ve tried using my own private cert as well as using a generated key with pem extraction

       import { JWK, JWS } from "@panva/jose";
       import moment = require("moment");
       const jwkToPem = require("jwk-to-pem");

       const key = await JWK.generate("RSA", 512, { use: "sig"});
       const payload = { foo: "baz", exp: Math.round(moment.now() / 1000 + 3600) };
       const pPem = jwkToPem(key);

       const sig = JWS.sign(payload, key, {alg: "PS256"});
       // resultant sig does not validate in jwt.io

I respect this may simply be an issue with jwt.io but as my recipient is rejecting my signatures I am wondering if there is a more subtle issue at hand or if I am just doing something completely wrong. Any ideas?

[panva]

I’ve poked my colleague (@Sambego) to take a look at this, no promises tho.

[panva]

Thanks.