BUG: unencoded JWS payloads (RFC 7797) - losing payload data

[Former user]

Hi, I have tried to create impl. of JsonWebSignature2020 with Nimbus library (here) but its not currently working correctly because of Nimbus library bug. The JsonWebSignature2020 signature suite must use payload which is not Base64 encoded (uses b64:false in JWS header), and the payload is byte array which is not a simple text, but a hash.

This is the payload hash in hexadecimal I am trying to sign and verify: cef88707946a2383ff989bacb5ac2b324871a49fdae90092d792a4499996de2f3af4314261da23e145867fe0dcdfb7508e43cfebd8b160a234b3e141d6271562 (the hash above cannot be converted to String without data loss).

The JWSObject and its composeSigningInput() method is trying to convert this payload byte array to String:

return getHeader().toBase64URL().toString() + '.' + getPayload().toString();

which is the issue because this will result in data loss of the original hash of type byte[]. You can check it with JWSObject function getSigningInput() which will return different byte array then the original.

Could you please remove the bug?

Have a nice day, Apelt