[ https://issues.redhat.com/browse/WFWIP-288?page=com.atlassian.jira.plugin... ] Darran Lofthouse commented on WFWIP-288: ---------------------------------------- Ok this seems to be an ambiguity within the specification. So section 4.1 of the MP JWT specification states that "alg" must be set to "RS256". Then section 9.2 of the MP JWT specification states key sizes of 1024 and 2048 are required to be supported hence this bug report. However if I consult the RFE which defines the "RS256" algorithm is clearly states a minimum key size of 2048 bits: - https://tools.ietf.org/html/rfc7518#section-3.3 I suspect that section 9.2 of the specification may be from an older version and pre-date the requirement to use RS256, regardless I do not believe it would be intentional for the MP JWT spec to bypass the minimal key size so I will raise an issue against the specification. -- This message was sent by Atlassian Jira (v7.13.8#713008)