Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I am using a Java JWT library jose4j. There is a list of digital signatures algorithms which can be used.
I tried to understand what the advantages/disadvantages of the algorithms are but Google searches of "HMAC vs RSASSA-PKCS1-V1_5" did not return results.
What are the pros/cons of these algorithms?
My answer is not original, as I am simply summing up information from different questions already solved in this site. Nevertheless, I thought it could be interesting to collect everything in one answer.
The first thing you have to know is to differentiate between a digital signature and a message authentication code (MAC). In this case, HMAC is a MAC and the rest (RSA and ECDSA) are digital signatures.
This answer to a previous question gives you an excellent overview of the different characteristics of both categories. As you can see, the main difference between HMAC and conventional digital signatures are:
That is the first differential factor between them. Now, we could focus on the difference among digital signatures schemes:
In this case, the main differences are not about functionality, but about the underlying mathematical primitives, namely RSA vs Elliptic Curves. This also has been covered before. To sum up, the implications are mainly centered on performance, size of keys, implementations, etc.
Finally, this other answer covers the difference between RSASSA-PSS and RSASSA-PKCS1-V1_5. To sum up, the difference is mainly of theoretical interest, concerning the proof of security.
