Skip to content
This repository has been archived by the owner on May 12, 2021. It is now read-only.

Unable to verify signature for JWT #17

Open
rmw2 opened this issue Nov 15, 2018 · 1 comment
Open

Unable to verify signature for JWT #17

rmw2 opened this issue Nov 15, 2018 · 1 comment
Assignees

Comments

@rmw2
Copy link

rmw2 commented Nov 15, 2018

A few people have reported issues in which a response coming back from the mobile app is unable to be verified. It's unlikely that the problem is in the libraries, as a valid signature with other issues would not crash in this particular place.

In android chrome, a user provided this trace
image

A similar trace was provided by an EthDenver user, after receiving the response from a disclosure request:
imagen

Initial suspicions were that an old signer of some sort is using the wrong algorithm to sign -- I think I've seen something similar with ES256K vs ES256K-R? However, the latter crash was experienced by a user after supposedly creating a fresh account on the latest version of the app, so that's particularly confusing, and I have been unable to reproduce so far.

@OR13
Copy link

OR13 commented Jan 18, 2019

Current readme docs might lead users to create signatures that are note recoverable:

const jwt = await didJWT.createJWT(
        {
          aud: "did:example:123",
          exp: 1957463421,
          name: "uPort Developer"
        },
        {
          issuer: "did:example:123",
          alg: "ES256K-R",
          signer
        }
      );

Might be better to be explicit with the algorithm.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants