Saturday, April 26, 2025

The JWK file specification , something about the public exponent : AQAB 

I need to configure Salesforce JWT (JSON Web Token) user verification recently.

And there is a file JWK (JSON Web Key) required .The sample document from Salesforce shown as below : 
Salesforce Reference


{
    "kid":"123456",
    "alg":"RS256",
    "use":"sig",
    "kty":"RSA",
    "x5c":["<Your public certificate>"],
    "y":"y",
    "n":"<Base64-encoded modulus>",
    "e":"<Base64-encoded public exponent>",
    "crv":"crv",
    "d":"d",
    "k":"k"
}

In order to know more about the values , I do another search online do know more about each parameters.
Detail RFC specification 
And to know more about the Salesforce sample document, I get a search about the Salesforce specific file format as well. 
Medium Reference

The public exponent now become a fix value "AQAB".

{
"kid": "{A unique value that identifies the end user}",
"alg": "RS256",
"use": "sig",
"kty": "RSA",
"x5c": [
"{Paste the public certificate value here}"
],
"y": "y",
"n": "{modulus of the public key in Base64 format}",
"e": "AQAB",
"crv": "crv",
"d": "d",
"k": "k"
}

Isn't it a variable, why it can be fixed ?


The answer is related to the kty (Key Type) parameter.

When "RSA" is used as key type, then the public exponent of it is 65537.


Convert 65537 to hexadecimal , we got 0x01000. Then we encode the 0x01000 to Base64 , we got "AQAB". 


In short, the base64 format public exponent of RSA is "AQAB".  
And this value is came from conversion of public exponent of RSA key type.

Quoted from Wiki

"65537 is commonly used as a public exponent in the RSA cryptosystem".


No comments:

Post a Comment

Next year SF migration plan : moving out customer account to AWS , and call SF data with service account

 👀 The most challenging part is about those function with user verification. My service cloud with MIAW chat , nearly redo due to the user ...