3 ms·
Is there a reason why they don't encrypt both the token and the permissions? This would remove the needs of a signature altogether.
by siscia 7y ago
Is there a reason why they don't encrypt both the token and the permissions?
This would remove the needs of a signature altogether.
- theacodes 7y agoBecause JWT is well specified and supported and it's useful in our case for proxy users to be able to inspect the token.
- yardstick 7y agoYou still need an integrity check or signature on the encrypted data, otherwise it’s potentially possible for someone to tamper with the ciphertext to change specific parts, such as the permissions. If you are encrypting using an AEAD cipher like AES-GCM or ChaCha20-Poly1305 then it is already built in. But AES-CBC and others need an explicit verification on top.
- nkrisc 7y agoOk I'm a bit of a cryptography noob, but are you saying it's possible to alter the encrypted token such that when decrypted by the private key the permissions are changed, in this example, but the real GitHub token is not? Edit: nevermind, I think I've just misunderstood the process outlined in the article. I confused the tokens.
- deleted 7y ago[deleted]