# Signature verification for Elliptic Curve

**URL:** <https://community.auth0.com/t/signature-verification-for-elliptic-curve/41648>\
**Category:** JWT.io\
**Created:** [April 23, 2020, 3:07pm UTC](https://community.auth0.com/t/signature-verification-for-elliptic-curve/41648 "2020-04-23T15:07:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![fxmathieu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/fxmathieu/32/20730_2.png) [@fxmathieu](https://community.auth0.com/u/fxmathieu)\
**Post date:** [April 23, 2020, 3:07pm UTC](https://community.auth0.com/t/signature-verification-for-elliptic-curve/41648/1 "2020-04-23T15:07:22Z")

</div>

Hello,

Receiving a JWT, I try to implement Signature validation for ES256, ES384 and ES512. I did it successfully for RSA types based on public certificate sent as content in JWT. I try to do the same for ES algorithm, but It don’t work. Must I have other input parameters such couple (x,y) to do this validation ? I don’t think so, but …

I use io.jsonwebtoken Java library.

I don’t know how the debugger do it and need to have same behavior.

Can somebody have tips, or sample java code ?

Thanks for your help  
François

---

<div class="post-metadata">

**Author:** ![fxmathieu](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/fxmathieu/32/20730_2.png) [@fxmathieu](https://community.auth0.com/u/fxmathieu)\
**Post date:** [April 24, 2020, 10:42am UTC](https://community.auth0.com/t/signature-verification-for-elliptic-curve/41648/2 "2020-04-24T10:42:54Z")

</div>

Hi all,

In fact I produced Token signed with ES256, ES384 or ES512 containing public certificate in x5c key, but cannot understand how site validate (or not) such token …

I tried several methods with no success.

Can somebody help me ?  
Thanks for your support  
François

Current Validation Java code is (using java.security.Signature)

…  
// send algorithm name  
Signature signature = Signature.getInstance(algo.getJcaName());  
// contains public X.509 certificate  
signature.initVerify(certificate);  
// contains header.claims parts from token  
signature.update(jwtAssertion.getBytes());  
// verification with signed part from token converted in Der format  
verifiedToken = signature.verify(toDerSignature(signPart));  
// \>\>\> return true in all cases … ☹  
…

```
private static byte[] toDerSignature(byte[] jwsSig) throws IOException {

    byte[] rBytes = Arrays.copyOfRange(jwsSig, 0, jwsSig.length/2);
    byte[] sBytes = Arrays.copyOfRange(jwsSig, jwsSig.length/2, jwsSig.length);

    BigInteger r = new BigInteger(1, rBytes);
    BigInteger s = new BigInteger(1, sBytes);

    DERSequence sequence = new DERSequence(new ASN1Encodable[]{
        new ASN1Integer(r),
        new ASN1Integer(s)
    });
    return sequence.getEncoded();
}

```