Changed some chars on a Private key, and JWT still authenticates - google-cloud-platform

Question

I have implemented JWT in order to authenticate on Google cloud, as described in https://developers.google.com/identity/protocols/oauth2/service-account#jwt-auth
To my surprise, I've noticed that I could change some chars on the private key, and it would still authenticate. Changing chars in some places didn't work, and I got OpenSSL unable to sign data from the PHP JWT library. And some other places resulted in access being denied. But for example, when I changed a char in this line - it authenticated well.
How can that be? That is, I don't think it's possible to change any char on the private key and get it to work. But that's what I see on my local and when checked via GitPod. So I'm wondering what I might be missing.
Here's an example PHP code:
<?php
include_once __DIR__ . '/vendor/autoload.php';
use Firebase\JWT\JWT;
use Symfony\Component\HttpClient\HttpClient;
$privateKey = <<<EOD
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhziG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCyGkIPaez6r8jO
8a4oXYtxlDhfnYYQXs/fgG3I7wbbguw5lwcYEQPkm6fcWFpeqeMeOk2tuQKrJBOl
1hRqKEY4QGv1lHR0zatiQ1WOo9n+IgekmNwWLIMH176hRbhA/2uHHBjFgzFsLHOy
JtTrOM/WXyCooVLRy45D1vci7epbkYIxiWmFXcHKkeCldprqHy1oHc/nOYPdbPfZ
0lF0g3y4cuzmiaukiDtaGm9ZfnsFXo+jqlubnF0VvLrr41LddMJMoqh9aOA/KTkt
7L74JQJjGFVRwK/4/8l6xAuwua4IhdZMoV3XWijCeQt8Exi7YohaYRUYlwA5Koz4
96caSsdzAgMBAAECggEAGrkw51IsAjNlDJQb3yemGC02xjYDGyq2wyDomCkxXLeI
zV1ZbaWD8YXfioLhUGnqT6tM43+qpFY98nisSH9xhdg4urkDPlFr4UscJ9JzD5w4
jFx5TYRxRrh6/ITTEEGi9ztihiRYwpPq6jTEZuT33oEYi+Tk4eDKoGg9XcrYCtQK
4WmVt/5wUxE+G0AZEz+Z0fe1xFCfNRZ/4tpso1xopMiUwgNjNaFHAquvJfxbozKP
um5lS8wkETXbH+EnjmSYevPibuLfoZzqfTYxVSwaSqJ8epSk4N3sad7SCq5RvLAv
kQ+BvI582HCAiYPU9K+RTyPbedJuBz8ubgJZpHc5zQKBgQDXzZBSSYXaKLFOHc5j
BvNNmddWZFHFmC8XzccTI3arof8DRrB3w9NUEYwripttJ0cMtozjbxotCNiEybKG
hwaRyBg7MGPVkBsCKDG8UrVA7YoW2eWtcVOeKoSllSjhVsh+wjqi2+g1T6mSrue2
RviFC8k6w2+mYAQYhSwVLpHlXQKBgQDTRvj/CJr9wrd5WxHJ3Gk/D3ZYFW/9H2+M
Ncsi4gQ3fRIhPhAgoCTepEQ6/cyO3KRNY3xrqOXmPII2epfNHg0P3tq0P3zBkbbv
Y1Q9+uFJ3ktFHjTC5BIH4yX6vuPf3iRFiDZq5tIfAR0ACCN/SU1WUoHCrTOJ3MNu
mlSX2SNDDwKBgQDGCBFkMavvImByes+l9/7VO1NsJ+sSFDFC+sawPWHoZWQKsZfG
j6EiCGhEnJE8fUqp0+s92fp/URq/4Ac/hDD3HlN+HU2/8NmYBSJ+2rcRuel6RsKJ
gvFkt0e6W0KEZoreJ4Z/ZKWWJmBKBs8DaeUs0j/6+NVAK+QWTD7DwVSI0QKBgAtC
vCCzr7cYuriwHumYYs+mnlMhiV9/Xm2lrFcGntzqQJ4e9bMXdf+b17shLdbrcaJi
TA5c6Sv1S6dlr1OSZ3XSFewHejnC73Ig5CuNhJZwT6i2bG96wm9DLxIHPJQA/gPq
t6PI+6gFYitPQ70UBhg0u4/JtXaCmrP5a8rQGu4HAoGAVM5lBBRSBSmsbdt4+pWx
/nHVl2XlhhrFpxjPE0VVr0xIv9K8lt/yw3pItTs6zCLxqFYPRSmsLhPKqkxr0VIx
Mg7JhqzjI+AtBoPccRRZwj4DFtjZXW+u6/mrd00IfMFsUw90IhaPRi+eCowSBIE7
4riamH03XlC7Ce3McVRrHyM=
-----END PRIVATE KEY-----
EOD;
$payload = [
'iss' => "bar#foo.iam.gserviceaccount.com",
'sub'=> "bar#foo.iam.gserviceaccount.com",
'aud'=> "https://healthcare.googleapis.com/",
'iat' => time(),
'exp' => time() + 3600,
];
$jwt = JWT::encode($payload, $privateKey, 'RS256');
$client = HttpClient::create();
$url = 'https://healthcare.googleapis.com/v1/projects/foo/locations/us-central1/datasets/my-dataset/fhirStores/my-fhir-store/fhir/Patient';
$patientIdentifier = 'Some-name' . time();
$response = $client->request('POST', $url, [
'headers' => [
'Content-Type' => 'application/fhir+json',
'Authorization' => 'Bearer ' . $jwt,
],
'json' => [
'resourceType' => 'Patient',
'name' => [
0 => [
'family' => 'Migo',
'given' => [
0 => 'Dada',
],
],
],
'gender' => 'male',
'birthDate' => '1980-09-24',
],
]);
echo $response->getContent();
Here is a short video showing the problem I face. I've run it on GitPod, just to be sure it doesn't have my credentials anywhere on it. In the video you can see:
1st execution with the un-altered private key - works well
2nd execution with an altered private key - Still works (and obviously it shouldn't)
3rd execution, undo the previous change, and alter the private key elsewhere - now I get 401.
p.s. I've already changed the private key, so the one here is no longer valid :)

Answer 1

I understand, hashing, signing, private keys, etc very well. Your claim is impossible mathematically. Any change to the private key will result in a different hash which means the public key will no longer work to validate the signature. That form of weakness would have been discovered long ago. Private/public key validation cannot be manipulated by changing the values in one of the keys without changing the other.
One minor point is that the private key is base-64 encoded. You would need to replace those characters with valid base-64 data, which you might have done, but you did not explain in detail what you changed.
Perhaps edit your question with actual code to demonstrate. Give this some thought, if you can demonstrate this, you will be a millionaire next week or at least famous worldwide.