RS256 is an asymmetric JWT signature algorithm: RSASSA-PKCS1-v1_5 uses SHA-256 to hash the message, a private RSA key signs it, and the matching public key verifies it. section 7.2.2
Using separate signing and verification keys reduces the leakage risk of HS256, whose shared secret must exist wherever tokens are validated. section 7.2.2 section 8.2
A JOSE header selecting RS256
A JWT header can identify the token type, select RS256 through alg, and identify a key with kid: { "typ": "JWT", "alg": "RS256", "kid": "080E8CtRFAnnLlgK3dk8Y" }.
Assess RS256 deployments against these cautions:
- Check for RSA signing keys with exponents below 3, which are associated with Bleichenbacher’s signature-forgery attack. section 8.2
- Treat verification implementation flaws as a serious concern even when the algorithm itself is otherwise safe. section 8.2
- Consider PS256 or EdDSA where FAPI guidance applies, because FAPI bans RS256 and recommends those alternatives. section 8.2
