X.509 certificate's signature algorithm vs. algorithm used in key derived from it to verify a signature

Question

I have the following from Google's public certs for verifying JWT ID

Decoding the cert shows the signature and certificate algorithm is `sha1WithRSAEncryption (PKCS #1). Using Charles Engelke's excellent tutorial and code also shows that the cert says it uses '1.2.840.113549.1.1.5', which is SHA-1 in this reference lookup page.

However, when passing the key into crypto.subtle.verify() in JS (MDN reference) to verify a JWT signature, I needed to pass in {name: "RSASSA-PKCS1-v1_5", hash: {name: 'RS256}}, as specified by the JWT's header, instead of SHA-1 as per the public cert.

Why is this? Does the cert's signature algorithm have any relevance to the signature being checked?

score 1 · Accepted Answer · answered Oct 27 '21 at 23:15

1

Does the cert's signature algorithm have any relevance to the signature being checked?

No. The cert's signature algorithm is the algorithm that the issuing certificate authority used when creating the certificate. That doesn't even have to be the same algorithm family as the certificate's public key, so it certainly shouldn't be assumed to be related to how the subject wants to use their key.

answered Oct 27 '21 at 23:15

bartonjs

1,723
7
9

So both the `signature algorithm` and the `certificate signature algorithm` relate solely to the public certificate? Just looking at the fields from that x509 decoding web page. – David Min Oct 27 '21 at 23:19
1

@DavidMin Correct. One's inside the "to be signed certificate" section saying how the CA intends to sign it, the other's outside that, in the "this is how it got signed". Those two values are always the same. – bartonjs Oct 27 '21 at 23:20

X.509 certificate's signature algorithm vs. algorithm used in key derived from it to verify a signature

1 Answers1