Questions tagged [jwt]
JWT specifies JSON web tokens. It is defined in RFC 7519: JSON Web Token (JWT)
35
questions
0
votes
0
answers
48
views
JSON Web Encryption (JWE) Key Wrapping Fundamentals - How To Encrypt Content Encryption Key?
The JSON Web Encryption RFC 7516 says:
Encrypt the CEK with the recipient's public key using the
RSAES-PKCS1-v1_5 [or RSAES-OAEP] algorithm to produce the JWE
Encrypted Key.
Assuming a client/server ...
- 101
0
votes
0
answers
104
views
Node.js generated JWT secret, nanoid() vs crypto.randomBytes() which is stronger
Which method will generate stronger secret?
64 character secret generated by nanoid (https://www.npmjs.com/package/nanoid) with characters: ...
0
votes
0
answers
21
views
Is it necessary to verify the access token signature in the context of a TLS connection with .well-known endpoint?
I'm developing a custom Authentication Socialite ADFS Provider using OpenID Connect: Authentication Flow.
Since I have a TLS connection between the client App and the Authentication server that issues ...
- 1
2
votes
0
answers
335
views
How to hash a JWT signature using Public & private key (Have both key in JSON format & X.509 PEM Format), using ES256 algo for JWT
I want to hash my signature of JWT using public & private key, since we are using ES-256 algorithm in JWT. But the problem is that I have both the keys in JSON & .PEM format, so how can I do ...
- 21
0
votes
1
answer
72
views
How to verify that a JWT was in fact generated by the claimed issuer (iss)?
JSON Web Tokens (JWTs) (RFC, introduction) are digitally signed using a secret key (which can be symmetric, but for distributed use cases will typically be asymmetric). The signature forms the third ...
1
vote
1
answer
422
views
best HMACSHA signed JWT secret length
I would like to use JWT but one thing I'm still thinking is ¿what is the best length for the secret?
If I'm using HS512 as a signing method the secret should have a length of 512 bits as far as I ...
- 13
2
votes
1
answer
712
views
is this how RS256 works in JWT?
I'm a newbie that is studying about JWT using RS256 algorithm for signing and verification. I have drawn a diagram that represents my understanding of how RS256 works.
Basically, below is what I ...
- 121
2
votes
0
answers
35
views
Fusion auth versus jose4j library for jwt using secp256k [closed]
I am a beginner in-terms of JWT libraries in programming.
How the keypair used (secp256k1) is related with the algorithmic header used for creation of JWT?
And why authfusion doesn't need an ...
- 21
0
votes
1
answer
544
views
How to exchange keys in JWT between server and client and between shared servers?
I'm not sure I have a full understanding of JWT when it comes to the signature. The signature, as I get it, validates to the server that the header/payload that was transfer from the client is legit.
...
- 101
0
votes
1
answer
78
views
What is the proper format/ notation for JSON Web Tokens?
A JSON Web Token is supposed to have the following format:
token = encodeBase64(header) + '.' + encodeBase64(payload) + '.' + encodeBase64(signature)
When I use ...
- 5
0
votes
0
answers
239
views
Is it secure to sign a JWT using RS256?
I have implemented an authentication scheme using JWT with assymetric keys (RS256). The idea is that (assuming some microservice-based acrhitecture) the authentication service will sign all JWTs with ...
3
votes
1
answer
1k
views
A way to get the public key of a RS256 JWT from its headers and payload?
I have a RS256 JWT, I'd like to find out its public key. Because I know the header, payload and I have the encrypted signature, is there a way to obtain the public key that made the signature from ...
- 33
2
votes
1
answer
5k
views
Does the signature length of RS256 depend on the size of the RSA key used for signing?
The following NodeJS code, when run (v16.8.0), logs 512 to stdout.
...
- 125
0
votes
0
answers
27
views
Match any string from list to a single hash
This might be a noob question, I've searched the web but couldn't find anything remotely close to what I would like to achieve. Maybe I don't have the correct jargon, so please bear with me.
Basically,...
- 101
0
votes
0
answers
67
views
Securely transmit signed token (e.g., JWT) over insecure channel
Apologies if this is already answered somewhere, but I could not find it.
I have a setup where a client has a JWT (RSA- or ECDSA-signed), and needs to prove that fact to the peer which issued the ...
- 1
1
vote
1
answer
188
views
How can JWE support an integrity check given that it uses a public key to encrypt the message?
As far as I know JWE (JSON Web Encryption) supports both integrity and confidentiality. I agree about the confedintiality because only the recepient with a private key can decrypt a message. What ...
1
vote
1
answer
161
views
Which Cryptographic Standard ensures cryptographic agility and good adapotion
Which cryptographic message standards are recommended to ensure cryptographic agility in the future and have good adoption trough different programming languages such as .NET and Go?
The standard ...
- 151
1
vote
0
answers
136
views
How many JWT tokens may be securely generated with one secret?
I can remember from my crypto classes, that there is a limit on how many blocks can be securely encrypted with the same key. Before we reach the limit, we should rotate the key. Does it also hold true ...
- 373
3
votes
1
answer
220
views
What is a "set synchronized CSPRNG"?
I'm looking to implement a performant revocation method for JWTs. I'm reading a paper, in which the following section's second paragraph states:
If we use the client hashing approach described ...
- 131
1
vote
1
answer
358
views
How RSA is implemented by authentication protocols?
I am a beginner in cryptography, i recently learned about RSA algorithm : In short, my understanding for this is :
Sender needs receiver's public key to encrypt the message to a cipher so that only ...
- 111
0
votes
1
answer
263
views
Validating JWT works with small changes to public key, why?
I was trying to verify the following JWT on JWT.io with the following public key:
...
- 115
0
votes
1
answer
158
views
JWTs vs Capability Tokens
One of the primary advantages of JWTs is that they serve as capability tokens, allowing for a portable verification of capabilities/ privileges. However, JWTs are often criticized for a number of ...
- 117
2
votes
1
answer
596
views
Are there any security drawbacks for simply encrypting and MACing my JWS token (JWT)?
This question, while related, doesn't answer the security aspect I have in mind. I understand that signatures make it impossible for the tokens to be modified. But if I want the JWS token content to ...
4
votes
4
answers
1k
views
JWT Login Security
I am new to security and I am wondering if JWT is secure enough.
From what I have read online the flow goes like this:
Clients log in by sending their credentials to the identity
provider.
The ...
- 41
1
vote
3
answers
2k
views
Base64 encoding of strings
I have read everywhere that base64 encoding of unique binary/hex values results in unique output. The following two string encode to virtually the same output.
...
- 21
22
votes
1
answer
13k
views
How can one validate with a public key a JWT signature generated with a private key?
As I understand it, a JSON Web Token (JWT) consists of 3 parts:
the header, specifying the hashing algorithm to use for the signature;
the payload itself; and
the signature, which is a hash of the ...
3
votes
1
answer
5k
views
AES-CBC then SHA vs AES-GCM for encrypting and authenticating a web token
I am trying to have something like JWT but kinda ad hoc and encrypted. The token itself is simply a stringified JSON that contains the user ID and Unix timestamp.
Now, I tried to use AES-128-GCM, ...
- 919
1
vote
1
answer
214
views
Is symmetric encryption with a key containing the userId passes as authentication?
The scenario:
There is a web application where ownership check is time expensive so during the development all users were able to access all other user's objects (let's say apples) by changing the ...
- 113
10
votes
1
answer
12k
views
HMAC-SHA256 vs HMAC-SHA512 for JWT API authentication
Which algorithm is recommended to use when encoding / decoding JWT web application tokens? Is using HMAC-SHA256 enough or would using ...
- 203
1
vote
1
answer
487
views
sign data and append certificate VS sign data and certificate
I am currently writing my masters thesis in which I need to develop a licensing module for an application.
The license itself is a JSON Web Token which is signed using a RSA private key.
Since we ...
- 13
2
votes
1
answer
455
views
JWT Common Practices
I had a few questions in regards to certain practices used by JWT developers.
I'm relatively new to both encryption and JWTs and the context given is for developing a system on nodejs.
How should ...
- 23
3
votes
1
answer
919
views
Compromise between HMAC and Digital Signature, by encrypting and sending secret key?
For achieving stateless authentication tokens (like JWT), is there a compromise between the performance of HMAC, and public key distribution of Digital Signature?
Scenario:
Sender is a centralized ...
- 33
34
votes
2
answers
16k
views
HMAC vs ECDSA for JWT
I will be implementing JSON web tokens into my website and have a question about implementing them. I have a choice of using two algorithms, HMAC-SHA256 and ECDSA-SHA256. I have used HMAC-SHA256 in ...
- 443
9
votes
1
answer
4k
views
what are the advatanges and disavantages of the digital signature algorithms for JWT?
I am using a Java JWT library jose4j.
There is a list of digital signatures algorithms which can be used.
HMAC using SHA-2
RSASSA-PKCS1-V1_5 Digital Signatures with with SHA-2
Elliptic Curve Digital ...
1
vote
2
answers
669
views
Padding to increase entropy and size of (otherwise) small JSON objects
Maybe this better fits, the security stackexchange...
I'm building a web API. We want to enable some relatively simple encryption, instead of going full-blown OAuth2 (which frankly, IMO, sucks). So I ...
- 121