Saturday, April 26, 2025

The JWK file specification , something about the public exponent : AQAB 

I need to configure Salesforce JWT (JSON Web Token) user verification recently.

And there is a file JWK (JSON Web Key) required .The sample document from Salesforce shown as below : 
Salesforce Reference


{
    "kid":"123456",
    "alg":"RS256",
    "use":"sig",
    "kty":"RSA",
    "x5c":["<Your public certificate>"],
    "y":"y",
    "n":"<Base64-encoded modulus>",
    "e":"<Base64-encoded public exponent>",
    "crv":"crv",
    "d":"d",
    "k":"k"
}

In order to know more about the values , I do another search online do know more about each parameters.
Detail RFC specification 
And to know more about the Salesforce sample document, I get a search about the Salesforce specific file format as well. 
Medium Reference

The public exponent now become a fix value "AQAB".

{
"kid": "{A unique value that identifies the end user}",
"alg": "RS256",
"use": "sig",
"kty": "RSA",
"x5c": [
"{Paste the public certificate value here}"
],
"y": "y",
"n": "{modulus of the public key in Base64 format}",
"e": "AQAB",
"crv": "crv",
"d": "d",
"k": "k"
}

Isn't it a variable, why it can be fixed ?


The answer is related to the kty (Key Type) parameter.

When "RSA" is used as key type, then the public exponent of it is 65537.


Convert 65537 to hexadecimal , we got 0x01000. Then we encode the 0x01000 to Base64 , we got "AQAB". 


In short, the base64 format public exponent of RSA is "AQAB".  
And this value is came from conversion of public exponent of RSA key type.

Quoted from Wiki

"65537 is commonly used as a public exponent in the RSA cryptosystem".


No comments:

Post a Comment

Migrating from Renpy to Godot

 Due to the limitation of renpy in rendering dynamic screen ,  due the the black border it gives in different UI scale resolution , finally ...