2026-09-13 · 8 min read
- jwt
- ecdsa
- cryptography
ECDSA produces two mathematical integers, r and s. ASN.1 toolchains commonly encode them as a variable-length DER sequence, while JWS concatenates two fixed-width unsigned integers before Base64url encoding.
The curve determines the width. ES256 uses P-256 and a 64-byte JOSE signature; ES384 uses 96 bytes; ES512 uses P-521 and 132 bytes despite its algorithm name.
Parse DER strictly at integration boundaries
When a signing API returns DER, parse one sequence containing exactly two minimally encoded positive integers. Remove only DER sign padding, reject oversized values, then left-pad each unsigned integer to the curve width.
- Reject trailing bytes and indefinite lengths.
- Reject negative, zero, or out-of-range r and s values.
- Do not truncate significant bytes.
- Use maintained ASN.1 and JOSE implementations.
Validate JOSE form before cryptography
Base64url-decode the JWS signature under strict rules and require the exact byte length for the selected algorithm. Split it into equal-width r and s values, then convert to the representation expected by the cryptographic provider.
Keep syntax errors distinct from a validly encoded signature that fails verification. Avoid returning detail that helps an attacker probe keys or validation internals.
Bind algorithms, curves, and signing input
Choose the allowed algorithm and verification keys from trusted issuer configuration. Confirm that each key uses the required curve and permitted operation rather than accepting whatever combination the protected header advertises.
- Verify the original encoded header and payload segments.
- Reject unsupported critical headers.
- Validate JWT claims only after signature verification.
- Plan key rotation and cache refresh behavior.
Run cross-provider vectors
Use Flashman's JWT, Base64, and JSON tools to inspect synthetic structures, hash to identify exact public signing inputs, and diff for byte-rendered format comparisons. These tools do not replace signature verification.
Test DER sign padding, maximum-width values, wrong lengths, wrong curves, DER used as JOSE, altered segments, malformed keys, algorithm confusion, rotated keys, and every hardware, cloud, and language signer-verifier pair.