 
     func implemented(algorithm: String?) -> Bool {
         let algorithms = ["none", "HS256", "HS384", "HS512"]
-        // TODO: add RS256, RS384, RS512 when rsa_* methods below are done
+        // TODO: add RS256, RS384, RS512, PS256, PS384, PS512 when rsa_* methods below are done
         for alg in algorithms {
             if alg == algorithm {
                 return true

public class JWT {
    // https://tools.ietf.org/html/draft-ietf-jose-json-web-signature-41#section-4
    // base class; supports alg: none, HS256, HS384, HS512
    // TODO: add support for RS256, RS384, RS512
    // TODO: add support for PS256, PS384, PS512

    public var header: [String: AnyObject] = ["alg": "none", "typ": "JWT", ] {

        var padding: SecPadding

        switch algorithm {
        case .SHA256: // TODO: change to HS256, ... ?
            CC_SHA256(msgbytes, msglen, digestbytes) // TODO: test on nil return?
            padding = SecPadding(kSecPaddingPKCS1SHA256)
        case .SHA384:
