Closed jackmvision closed 1 year ago
The hash of the assertion is contained in the claim, and the contents of the claim are included in the payload over which the signature is generated. This means:
In other words, knowledge of the hash function is not helpful; it's the attacker not having knowledge of the signing key that prevents this attack.
I have a technical question after reading the standard briefly. How can we prevent a hacker from replacing an existing (genuine) assertion by a fake one? Because the hacker would know the hashing methods as listed in the standard. - I am just trying to understand how the standard could protect various hacking cases.
Thanks!