Reproduce the RFC’s four-byte example
02Two public HMAC examples use the same four-byte payload but different protected headers and signing inputs.
Separate tampering example: $.03 replaces $.02 but the original A5dx… tag is retained. Recomputing HMAC over the changed bytes does not match that tag.
Source for this drawing: RFC 7797 · Read RFC section 4 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- Signing input
- The exact byte sequence supplied to the signature or MAC computation.
- HS256
- HMAC using SHA-256; this example uses a shared test key.
- Detached payload
- Content carried separately while still covered by the signature or MAC.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Verification follows the exact input bytes.
- The RFC payload is the byte sequence 36,46,48,50, representing $.02. Its base64url encoding is JC4wMg.
- The RFC’s normal example encodes the payload. Its unencoded example uses a protected false b64 value, crit:["b64"], the original four payload bytes and a different MAC.
- Detaching the payload removes its representation from the serialized JWS, not from the MAC computation. Verification reconstructs the exact signing input and compares the expected tag.
The HMAC key is the deliberately public RFC7515 AppendixA.1 test fixture quoted by RFC7797§4, never a production secret or recommended key. The displayed HMAC tags are exact RFC examples. A changed $.03 payload with the old tag is a separate tampering example and fails verification. This is a byte-level worked example, not a complete JWS verification implementation or permission to trust arbitrary algorithm/key inputs.
Read the RFC section ↗