title: Creating a JWT With ECDSA P-256 SHA-256 With PHP
body: <p>I'm wondering if it's possible to properly create a signature using the P256 curve and PHP. OpenSSL in PHP has support for creating the key and getting the proper things in order.</p>
  
  <p>According to this documentation - <a href="http://self-issued.info/docs/draft-jones-json-web-token-01.html#DefiningECDSA" rel="nofollow noreferrer">http://self-issued.info/docs/draft-jones-json-web-token-01.html#DefiningECDSA</a> - Section 8.3 states:</p>
  
  <blockquote>
    <p>A JWT is signed with an ECDSA P-256 SHA-256 signature as follows:</p>
    
    <ol>
    <li>Generate a digital signature of the UTF-8 representation of the JWT Signing Input using ECDSA P-256 SHA-256 with the desired private key. The output will be the EC point (R, S), where R and S are unsigned integers.</li>
    <li>Turn R and S into byte arrays in big endian order. Each array will be 32 bytes long.</li>
    <li>Concatenate the two byte arrays in the order R and then S.</li>
    <li>Base64url encode the 64 byte array as defined in this specification. </li>
    </ol>
  </blockquote>
  
  <p>Herein the problem lies with getting the R and S byte arrays. </p>
  
  <p>Here is an example of what I'm trying to do.</p>
  
  <pre><code>//Create Array Configuration
  $config = array(
      "curve_name" =&gt; "prime256v1",
      "private_key_type" =&gt; OPENSSL_KEYTYPE_EC,
  );
  $ourkey = openssl_pkey_new($config);
  
  /* We would get the key details to help extract out other information such as x/y coord 
  of curve and private key but it's not necessary to show for this part*/
  
  // Extract the private key from $res to $privKey
  openssl_pkey_export($ourkey, $privKey);
  
  $data = "Example data we will be using to sign";
  $data = hash("sha256", $data);
  
  $signature = "";
  openssl_sign($data, $signature, $privKey); // Should I include the digest algo in this call as well?
  </code></pre>
  
  <p>The problem here is that this signature is not R and S that I can use to concatenate together to make the real signature I need... I think. </p>
  
  <p>So ultimately, is there any way I can get the R and S values from a openssl function in php?</p>
  
  <p>Any help is greatly appreciated!</p>