Skip to content

feat: refactor existing code, and add Erlang and JavaScript rsa implementation#12

Draft
brettkolodny wants to merge 4 commits intomainfrom
feat/rsa
Draft

feat: refactor existing code, and add Erlang and JavaScript rsa implementation#12
brettkolodny wants to merge 4 commits intomainfrom
feat/rsa

Conversation

@brettkolodny
Copy link
Owner

This PR adds support for RS256, RS384, and RS256 signed JWTs.

Erlang:

  • Create public/private RSA keys from PEM
  • Create public/private RSA keys from JWK
  • Sign/verify JWTs with RSA public/private keys
  • Add docs

JavaScript:

  • JavaScript: Create public/private RSA keys from PEM
  • JavaScript: Create public/private RSA keys from JWK
  • JavaScript: Sign/verify JWTs with RSA public/private keys
  • Add docs

Changes to the existing API

As described in the next section, it's become necessary to break out the signing and verifying functionality into their own modules. To keep consistency a new module gwt/hmac has been created that handles the existingto_signed_string and from_signed_string functions. All other functionality around working with a JWT once it's decoded remains in the gwt module.

New functionality

Because the JavaScript API is promise based and that is incompatible with Erlang the functionality is broken out the following modules:

  • gwt/erlang/rsa
  • gwt/javascript/rsa

All of the functions and types in any module within a <runtime> folder is annotated with @target(<runtime>). This means that it's impossible to use the the incorrect implementation as they won't even be available at compile time. The docs will make this very clear both at the top level of the module and on every function and type.

With this set up we are able to keep all the platform specific code separate from the cross platform utilities of the library. For example, once a JWT is verified/decoded you can use all of the existing functionality in the gwt module without having to worry about platform differences.

Notes on JavaScript

To be cross platform between server runtimes (Node, Deno, and Bun) I'm using the web SubtleCrypto API. This seems to be working well, but the one draw back I found is that it doesn't support PKCS#1 formatted PEMs. But seeing as you can convert a PKCS#1 PEMs to a PKCS#8 this doesn't seem like a deal breaker.

Closes #1

@brettkolodny brettkolodny mentioned this pull request Dec 11, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Adding RS256

1 participant