NAME

Crypt::JWS::OpenSSL::Algorithm::HMAC - Sign and verify tokens using shared HMAC secrets

VERSION

version 0.003

SYNOPSIS

use Crypt::JWS::OpenSSL::Algorithm::HMAC;
my $jws = Crypt::JWS::OpenSSL::Algorithm::HMAC->new;

my $token = $jws->sign(
  algorithm => 'HS256',
  key       => $shared_secret,
  message   => join('.', $base64urlEncodedHeader, $base64urlEncodedClaims),
);
  
my $is_verified = $jws->verify(
  algorithm => 'HS256',
  key       => $shared_secret,
  message   => join('.', $base64urlEncodedHeader, $base64urlEncodedClaims),
  signature => $base64urlDecodedSignature,
);

DESCRIPTION

This module uses Digest::SHA to produce HS256, HS384 and HS512 signatures.

It is included in Crypt::JWS::OpenSSL to support these common JWT signing algorithms.

It is normally used by Crypt::JWS::OpenSSL#encode and Crypt::JWS::OpenSSL#verify but it can be used directly if you handle the Base64 url encoding and decoding elswhere.

METHODS

sign

my $token = $jwt->sign(
  algorithm => $algo,
  key       => $key,
  message   => $message
);

The method accepts an even numbered list or a hash reference. It returns a signature.

algorithm

The name of the algorithm supported by the key parameter.

key

The shared secret.

message

The Base64 url encoded JSON header and the Base64 url encoded JSON claims joined together with a '.' ( dot ).

The final token is produced by Base64 encoding the signature returned by this method and adding it to the message seperated by a '.' ( dot );

This method returns a raw signature.

verify

my $is_verified = $jwt->verify(
  algorithm => $algo,
  key       => $key,
  message   => $message,
  signature => $raw_signature
);

The method accepts an even numbered list or a hash reference.

It returns true if signature matches a signature produced for the message by key, or false if not.

algorithm

The name of the algorithm supported by the key parameter.

key

The shared secret.

message

The Base64 url encoded JSON header and the Base64 url encoded JSON claims joined together with a '.' ( dot ) extracted from a token.

signature

The Base64 url decoded raw signature extracted from the token.

ALGORITHMS

HS256

HS384

HS512

AUTHOR

Mark Dootson <mdootson@cpan.org>

COPYRIGHT AND LICENSE

Copyright (C) 2026 by Mark Dootson

This library is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.