Questions tagged [jwt]

JWT specifies JSON web tokens. It is defined in RFC 7519: JSON Web Token (JWT)

Filter by
Sorted by
Tagged with
0
votes
0answers
34 views

Securely transmit signed token (e.g., JWT) over insecure channel

Apologies if this is already answered somewhere, but I could not find it. I have a setup where a client has a JWT (RSA- or ECDSA-signed), and needs to prove that fact to the peer which issued the ...
0
votes
0answers
31 views

How can JWE support an integrity check given that it uses a public key to encrypt the message?

As far as I know JWE (JSON Web Encryption) supports both integrity and confidentiality. I agree about the confedintiality because only the recepient with a private key can decrypt a message. What ...
0
votes
1answer
98 views

Which Cryptographic Standard ensures cryptographic agility and good adapotion

Which Cryptographic Message Standards are recommended to ensure cryptographic agility in the future and good adapotion trough different programming languages (.NET and Go)? (PublicKey with ...
1
vote
1answer
55 views

What is a “set synchronized CSPRNG”?

I'm looking to implement a performant revocation method for JWTs. I'm reading a paper, in which the following section's second paragraph states: If we use the client hashing approach described ...
1
vote
0answers
31 views

How many JWT tokens may be securely generated with one secret?

I can remember from my crypto classes, that there is a limit on how many blocks can be securely encrypted with the same key. Before we reach the limit, we should rotate the key. Does it also hold true ...
1
vote
1answer
65 views

How RSA is implemented by authentication protocols?

I am a beginner in cryptography, i recently learned about RSA algorithm : In short, my understanding for this is : Sender needs receiver's public key to encrypt the message to a cipher so that only ...
14
votes
1answer
9k views

How can one validate with a public key a JWT signature generated with a private key?

As I understand it, a JSON Web Token (JWT) consists of 3 parts: the header, specifying the hashing algorithm to use for the signature; the payload itself; and the signature, which is a hash of the ...
0
votes
1answer
80 views

JWTs vs Capability Tokens

One of the primary advantages of JWTs is that they serve as capability tokens, allowing for a portable verification of capabilities/ privileges. However, JWTs are often criticized for a number of ...
0
votes
1answer
94 views

Validating JWT works with small changes to public key, why?

I was trying to verify the following JWT on JWT.io with the following public key: ...
1
vote
1answer
172 views

Are there any security drawbacks for simply encrypting and MACing my JWS token (JWT)?

This question, while related, doesn't answer the security aspect I have in mind. I understand that signatures make it impossible for the tokens to be modified. But if I want the JWS token content to ...
3
votes
1answer
3k views

AES-CBC then SHA vs AES-GCM for encrypting and authenticating a web token

I am trying to have something like JWT but kinda ad hoc and encrypted. The token itself is simply a stringified JSON that contains the user ID and Unix timestamp. Now, I tried to use AES-128-GCM, ...
1
vote
2answers
512 views

Padding to increase entropy and size of (otherwise) small JSON objects

Maybe this better fits, the security stackexchange... I'm building a web API. We want to enable some relatively simple encryption, instead of going full-blown OAuth2 (which frankly, IMO, sucks). So I ...
1
vote
1answer
405 views

sign data and append certificate VS sign data and certificate

I am currently writing my masters thesis in which I need to develop a licensing module for an application. The license itself is a JSON Web Token which is signed using a RSA private key. Since we ...
1
vote
1answer
107 views

Is symmetric encryption with a key containing the userId passes as authentication?

The scenario: There is a web application where ownership check is time expensive so during the development all users were able to access all other user's objects (let's say apples) by changing the ...
3
votes
1answer
704 views

Compromise between HMAC and Digital Signature, by encrypting and sending secret key?

For achieving stateless authentication tokens (like JWT), is there a compromise between the performance of HMAC, and public key distribution of Digital Signature? Scenario: Sender is a centralized ...
1
vote
3answers
725 views

Base64 encoding of strings

I have read everywhere that base64 encoding of unique binary/hex values results in unique output. The following two string encode to virtually the same output. ...
7
votes
1answer
3k views

what are the advatanges and disavantages of the digital signature algorithms for JWT?

I am using a Java JWT library jose4j. There is a list of digital signatures algorithms which can be used. HMAC using SHA-2 RSASSA-PKCS1-V1_5 Digital Signatures with with SHA-2 Elliptic Curve Digital ...
3
votes
1answer
6k views

HMAC-SHA256 vs HMAC-SHA512 for JWT API authentication

Which algorithm is recommended to use when encoding / decoding JWT web application tokens? Is using HMAC-SHA256 enough or would using ...
2
votes
1answer
416 views

JWT Common Practices

I had a few questions in regards to certain practices used by JWT developers. I'm relatively new to both encryption and JWTs and the context given is for developing a system on nodejs. How should ...
25
votes
2answers
11k views

HMAC vs ECDSA for JWT

I will be implementing JSON web tokens into my website and have a question about implementing them. I have a choice of using two algorithms, HMAC-SHA256 and ECDSA-SHA256. I have used HMAC-SHA256 in ...
4
votes
4answers
1k views

JWT Login Security

I am new to security and I am wondering if JWT is secure enough. From what I have read online the flow goes like this: Clients log in by sending their credentials to the identity provider. The ...