6 ms·
I am curious why more folks don't use rsa keys anyways? Seems like that makes signature validation even easier (publish the location of the public key for valid
by spydum 10y ago
I am curious why more folks don't use rsa keys anyways? Seems like that makes signature validation even easier (publish the location of the public key for validation). Then your endpoints don't need to exchange secrets at all?
- davewritescode 10y agoIt makes rotating the secret a hell of a lot easier as well.
- lvh 10y agoI'm not sure I follow. You still need to communicate the public key securely.
- deleted 10y ago[deleted]
- crgwbr 10y agoWe use RSA signed JWTs for quite a few services and it's been a joy so far. Makes key rotation without downtime super easy and (obviously) doesn't have any of the dangers associated with a shared secret. https://github.com/crgwbr/asymmetric_jwt_auth https://github.com/crgwbr/asymmetric_jwt_auth
- nrjdhsbsid 10y agoSigning jwt with RSA is a bad idea. Asymmetrical encryption methods are orders of magnitude slower than hmac. It sounds like a nice thing to do but it's really really slow compared to hmac. That's why TLS only uses the public key to exchange a symmetric key then switches over to AES or whatever.