title: Why can I sign and verify JWT's with a RSA-algorithm using EC-key-pairs?
body: <p>I use the crypto core-module in node.js to generate an EC-key-pair.</p>
  <p>I then use this key-pair to sign and verify JWT's.</p>
  <p>I would expect the signing/verification to only work when using an EC-algorithm.</p>
  <p>However it seems to be working with any algorithm except HMAC.</p>
  <p>From my understanding, this shouldn't be possible.</p>
  <p>Can anyone explain this to me?</p>
  <p>Thank you for reading my question.</p>
  <pre class="lang-js prettyprint-override"><code>const crypto = require('crypto')
  const jwt = require('jsonwebtoken')
  
  const keyPair = crypto.generateKeyPairSync('ec', {
    namedCurve: 'secp256k1',
    publicKeyEncoding: {
      type: 'spki',
      format: 'pem'
    },
    privateKeyEncoding: {
      type: 'pkcs8',
      format: 'pem'
    }
  })
  
  const token = jwt.sign({}, keyPair.privateKey, {
    algorithm: 'ES256' // I expect this to work, but it seems to be also working with e.g. &quot;RS256&quot; or &quot;PS512&quot;, which I don't understand.
  })
  
  const verify = jwt.verify(token, keyPair.publicKey)
  </code></pre>