RSA Verify

Category: Asymmetric & Elliptic Curve · Node Type ID: asymmetric-rsa-verify

Verifies digital signature using RSA-PSS or PKCS#1 v1.5 with public key

Overview

Verifies an RSA-PSS or RSASSA-PKCS1-v1_5 digital signature (RFC 8017) against the original message and the signer's RSA public key, emitting a boolean verdict on the Valid output port.

This node uses a Judgement Error Profile: an invalid signature or malformed key produces Valid = false as normal boolean data rather than crashing the workflow, unless you explicitly configure Treat As Error to false (or true) to halt downstream execution.

When to Use

Verifying RSA signatures produced by RSA Sign or external PKI/JWT systems.
Halting a pipeline when signature verification fails by setting Treat As Error to false.

Parameter Configuration

Parameter (ID)	Type & Default	Visibility Condition	Description & Options
Signature Scheme `scheme`	`select` Default: `PSS`	Always visible	Must match the Signature Scheme used during signing (`PSS` or `PKCS1-v1_5`). `PSS`: RSA-PSS (Probabilistic Signature Scheme - RFC 8017) `PKCS1-v1_5`: RSASSA-PKCS1-v1_5 (Deterministic - PKCS#1 v1.5)
Hash Algorithm `hash`	`select` Default: `SHA-256`	Always visible	Must match the Hash Algorithm used during signing (`SHA-256`, `SHA-384`, or `SHA-512`). `SHA-256`: SHA-256 `SHA-384`: SHA-384 `SHA-512`: SHA-512
PSS Salt Length (Bytes) `saltLength`	`number` Default: `32` Supports Variable Reference (`$var`: `int`)	When `scheme` is `PSS`	Expected PSS salt byte length (default `32`). Only visible when `Signature Scheme = PSS`.
Treat As Error `errorOnValue`	`select` Default: `""` (empty)	Always visible	Judgement error reinterpretation: when set to `false` (or `true`), transitions the node to `ERROR` status whenever `Valid` equals that value. `(empty)`: None (default; the result is plain data) `true`: true `false`: false
Error Code `errorCode`	`text` Default: `""` (empty) Supports Variable Reference (`$var`: `string`)	When `errorOnValue` is `true` or `false`	Custom error code used when Treat As Error triggers. Only visible when `Treat As Error` is not `None`.
Error Message `errorMessage`	`text` Default: `""` (empty) Supports Variable Reference (`$var`: `string`)	When `errorOnValue` is `true` or `false`	Custom error message used when Treat As Error triggers. Only visible when `Treat As Error` is not `None`.

Port I/O Specification

See Ports & Connections for general wiring rules, data type colors, and dynamic port creation.

Input Ports

Port Nature: Fixed Input Ports (3 total).

Port Name	Port ID	Data Type	Required	Visibility Condition	Description
`Public Key`	`publicKey`	`Any` (PEM/DER)	Required	Always visible	Signer RSA public key (accepts binary DER `Bytes` or UTF-8 PEM `Bytes`).
`Message`	`data`	`Bytes`	Required	Always visible	Original unhashed message bytes (`Uint8Array`). Automatically hashed with the selected Hash Algorithm during verification.
`Signature`	`signature`	`Bytes`	Required	Always visible	Candidate RSA signature bytes (`Uint8Array`) to verify.

Output Ports

Port Nature: Fixed Output Ports (1 total).

Port Name	Port ID	Data Type	Visibility Condition	Description
`Valid`	`isValid`	`Bool`	Always visible	Boolean verification verdict (`true` if the signature is valid for the message and public key, otherwise `false`).

Error Cases

This node uses a Judgement Error Profile on its boolean output port isValid:

Default Behavior (Treat As Error = None): Verification or comparison mismatches do not raise a runtime error; instead, the node completes normally and emits false (or true) on isValid so downstream nodes or scripts can inspect the boolean result.
Reinterpretation as Error (Treat As Error = false or true): When the boolean verdict on isValid equals the configured errorOnValue setting, the engine transitions this node into an ERROR state using your custom Error Code and Error Message and halts downstream execution.

Examples

Verifying an RSA-PSS Signature

Verify the signature from RSA Sign using the matching public key.

Connect Public Key (DER) from RSA KeyGen, the original Message, and the Signature from RSA Sign to RSA Verify.
The Valid output port emits true.