I will be implementing JSON web tokens into my website and have a question about implementing them. I have a choice of using two algorithms, HMAC-SHA256 and ECDSA-SHA256. I have used HMAC-SHA256 in the past for jwt, but now I noticed ECDSA is being added to a lot of jwt libraries. As someone who does not have a strong background in security, I was wondering what the advantages/disadvantages are between these two? Trying to Google HMAC vs ECDSA did not bring up any great results. My areas of concern include:
-Speed (Since my server will need to sign many tokens, how do they perform?)
-Security (How do they fair against brute force attacks and rainbow tables? This will probably relate to my first concern.)
-Stability (Are these algorithms accepted as stable, proven, and reliable?)
- Speed (Since my server will need to sign many tokens, how do they perform?)
- Security (How do they fair against brute force attacks and rainbow tables? This will probably relate to my first concern.)
- Stability (Are these algorithms accepted as stable, proven, and reliable?)