Skip to main content
Version: 0.2 Draft 2

6. Signing and Verification

6.1 Signing requirements​

All PCTs must be cryptographically signed before attachment. Unsigned PCTs must be rejected by all verifiers.

The following signing algorithms are supported in version 0.1:

  • RS256 (RSASSA-PKCS1-v1_5 with SHA-256). Recommended for all deployments where the issuer and verifier are different organisations or systems. Requires a public/private key pair.
  • HS256 (HMAC with SHA-256). Permitted only for single-organisation deployments where the issuer and all verifiers share a secure secret. Must not be used across organisational boundaries.

Key management: Issuers must implement key rotation procedures. The kid field in the PCT header enables verifiers to retrieve the correct public key without invalidating existing tokens. Expired or revoked keys must be maintained in a key registry for audit purposes.

6.2 Signature construction​

The signature is computed over the Base64URL encoding of the header concatenated with a period and the Base64URL encoding of the payload, consistent with RFC 7519 Section 7.2.

signature = sign(
  Base64URL(header) + '.' + Base64URL(payload),
  private_key
)
pct = Base64URL(header) + '.' + Base64URL(payload) + '.' + Base64URL(signature)

6.3 Verification procedure​

A verifier must perform all of the following steps before accepting a PCT:

  1. Decode the three components of the compact serialised PCT.
  2. Retrieve the public key (or shared secret) associated with the kid value in the header.
  3. Verify the signature over header.payload using the retrieved key.
  4. Confirm that the pct_version in the header is a version supported by the verifier.
  5. Confirm that the current timestamp is between valid_from and expires_at.
  6. Verify the data binding as defined in Section 5.8.5: re-hash the received data payload and compare against data_hash.
  7. Proceed to claims evaluation as defined in Section 4.5.

If any step fails, the PCT must be treated as invalid and the action must be blocked. Verifiers must not skip steps or apply partial verification.