blocks|key|4463940|text|对称密钥只能以点对点的方式使用，因此对于接收方来说，修改只有他和发送方拥有共享密钥的JWTs是没有意义的(并且他是预期的接收方)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4463941|非对称密钥签名(在JWT中以及一般情况下)由发送方使用私钥生成，并由接收方使用公钥进行验证。消费者/接收者只被给予公钥，这发生在out_of_band+(即，通过另一种通信方式，而不是您用来交换安全数据的方式)。|4463942|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

Symmetric keys are only to be used in a peer-to-peer way so it would be pointless for the receiver to modify JWTs for which only he and the sender have a shared key (and he is the intended recipient).

Asymmetric key signatures (in JWTs as well as in general) are produced by the sender with the private key and verified by the receiver with the public key. The consumer/receiver is given only the public key which happens out_of_band (i.e. through another means of communication than the one you use to exchange the secured data).

blocks|key|4464138|text|没有人会加密JWT的有效负载。这都是关于签名的！RSA或ECDSA+(两者都是非对称的)签名可以只用一个公钥来验证，对于对称签名，你需要一个auth-service。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4464139|最常见的JWT签名算法：|4464140|HMAC+%2B+SHA256
RSASSA-PKCS1-v1_5+%2B+SHA256
ECDSA+%2B+P-256+%2B+SHA256|code-block|syntax|javascript|4464141|查看更多https://www.rfc-editor.org/rfc/rfc7518#section-3|offset|length|4464142|entityMap|0|LINK|mutability|MUTABLE|url|https://www.rfc-editor.org/rfc/rfc7518#section-3^0|0|0|0|4|1C|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|V|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|W|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|X|8|@]|9|@$K|Y|L|Z|1|10]]|A|$]]|$1|M|3|-4|5|6|7|11|8|@]|9|@]|A|$]]]|N|$O|$5|P|Q|R|A|$S|T]]]]

No one will encrypt the payload of a JWT. It's all about the signature!
RSA or ECDSA (both asymetric) signatures can be verified just with a puiblic key, for symetric signed signatures you'll need an auth-service.
Most Common JWT Signing Algorithms:
<pre><code>HMAC + SHA256
RSASSA-PKCS1-v1_5 + SHA256
ECDSA + P-256 + SHA256
</code></pre>
see more <a href="https://www.rfc-editor.org/rfc/rfc7518#section-3" rel="nofollow noreferrer">https://www.rfc-editor.org/rfc/rfc7518#section-3</a>

I understand the difference between symmetric and asymmetric keys. I understand that the keys are used to calculate the signature and then verify them. However diving a little deeper, I'd like to understand a bit more which I'm having trouble finding online. 

Are the keys given to the consumers to verify the contents? Wouldn't that give consumers the ability to change the JWT contents if symmetric keys are used? 

When asymmetric keys are used is the signature calculated with the private or public key? Is the consumer given the public/private key?

JWT Keys - Asymmetric and Symmetric

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我理解对称密钥和非对称密钥之间的区别。我知道密钥是用来计算签名，然后验证它们的。但是深入一点，我想了解更多一些我在网上很难找到的东西。是否将密钥提供给消费者以验证内容？如果使用对称密钥，消费者不是可以更改JWT内容吗？当使用非对称密钥时，签名是用私钥还是公钥计算的？消费者是否获得了公钥/私钥？

问JWT密钥-非对称和对称
EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问JWT密钥-非对称和对称EN

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问JWT密钥-非对称和对称
EN