Q15: What is the JWT Algorithm Confusion Attack (RSA vs HMAC) and how is it mitigated?
In an Algorithm Confusion Attack, an API expects an RS256 token signed with the Authorization Server's Private Key and verified using its Public Key.
An attacker captures the public key (which is publicly available), crafts a malicious payload, sets the header to "alg": "HS256" (Symmetric HMAC), and signs the payload using the Public Key string as the symmetric secret key.
If the server library uses a generic verification routine that blindly trusts the token's alg header, it uses the local public key string as an HMAC secret, validating the forged signature successfully.
Key Takeaways
- Algorithm confusion tricks asymmetric RS256 verification code into executing symmetric HS256 validation using public keys.
- Always restrict API verification logic to explicit algorithm white-lists.