Questions tagged [jwt]
JWT specifies JSON web tokens. It is defined in RFC 7519: JSON Web Token (JWT)
36 questions
1
vote
2
answers
210
views
What are the implications of insufficient entropy when signing a payload using a SHA-RSA256 private key?
I have an embedded environment without access to entropy, trying to sign a message using RSA-SHA256 (JWT).
Would it be insecure to ignore the entropy requirements forcefully, and sign without any &...
- 13
0
votes
2
answers
99
views
New Service to Service Protocol Presented for Public Scrutiny (Time-based Token Signing), Is it Safe?
I came up with the following protocol to provide a life-time for JWT tokens while differentiating services to communicate securely with web services (service-to-service) using symmetric key signing ...
2
votes
2
answers
3k
views
sign a JWT with RS256 using a RSA-PSS SHA256 key pair?
Given a private key using algorithm RSA-PSS with SHA256 is it possible to use this key to sign a JWT using algorith RS256 (RSA with SHA256) instead of PS256 (RSA-PSS with SHA256)?
The German ...
- 123
0
votes
0
answers
407
views
Node.js generated JWT secret, nanoid() vs crypto.randomBytes() which is stronger
Which method will generate stronger secret?
64 character secret generated by nanoid (https://www.npmjs.com/package/nanoid) with characters: ...
2
votes
0
answers
698
views
How to hash a JWT signature using Public & private key (Have both key in JSON format & X.509 PEM Format), using ES256 algo for JWT
I want to hash my signature of JWT using public & private key, since we are using ES-256 algorithm in JWT. But the problem is that I have both the keys in JSON & .PEM format, so how can I do ...
- 21
0
votes
1
answer
385
views
How to verify that a JWT was in fact generated by the claimed issuer (iss)?
JSON Web Tokens (JWTs) (RFC, introduction) are digitally signed using a secret key (which can be symmetric, but for distributed use cases will typically be asymmetric). The signature forms the third ...
3
votes
1
answer
4k
views
best HMACSHA signed JWT secret length
I would like to use JWT but one thing I'm still thinking is ¿what is the best length for the secret?
If I'm using HS512 as a signing method the secret should have a length of 512 bits as far as I ...
- 33
2
votes
1
answer
5k
views
is this how RS256 works in JWT?
I'm a newbie that is studying about JWT using RS256 algorithm for signing and verification. I have drawn a diagram that represents my understanding of how RS256 works.
Basically, below is what I ...
- 121
2
votes
0
answers
58
views
Fusion auth versus jose4j library for jwt using secp256k [closed]
I am a beginner in-terms of JWT libraries in programming.
How the keypair used (secp256k1) is related with the algorithmic header used for creation of JWT?
And why authfusion doesn't need an ...
- 21
0
votes
1
answer
1k
views
How to exchange keys in JWT between server and client and between shared servers?
I'm not sure I have a full understanding of JWT when it comes to the signature. The signature, as I get it, validates to the server that the header/payload that was transfer from the client is legit.
...
- 101
0
votes
1
answer
414
views
What is the proper format/ notation for JSON Web Tokens?
A JSON Web Token is supposed to have the following format:
token = encodeBase64(header) + '.' + encodeBase64(payload) + '.' + encodeBase64(signature)
When I use ...
- 5
0
votes
0
answers
560
views
Is it secure to sign a JWT using RS256?
I have implemented an authentication scheme using JWT with assymetric keys (RS256). The idea is that (assuming some microservice-based acrhitecture) the authentication service will sign all JWTs with ...
3
votes
1
answer
3k
views
A way to get the public key of a RS256 JWT from its headers and payload?
I have a RS256 JWT, I'd like to find out its public key. Because I know the header, payload and I have the encrypted signature, is there a way to obtain the public key that made the signature from ...
- 33
3
votes
1
answer
13k
views
Does the signature length of RS256 depend on the size of the RSA key used for signing?
The following NodeJS code, when run (v16.8.0), logs 512 to stdout.
...
- 135
0
votes
0
answers
38
views
Match any string from list to a single hash
This might be a noob question, I've searched the web but couldn't find anything remotely close to what I would like to achieve. Maybe I don't have the correct jargon, so please bear with me.
Basically,...
- 101