3 ms·

Thank you for a superb response! If the length of the token was important, and you wanted to issue the shortest possible (yet secure) token: what would you rec

• lvh 7y ago
  You mean massive in general not relative to the encrypt+sign-JWT combo detailed in the blog post? Any kind of encryption is going to make the ctext be effectively random bits, and is going to add a MAC tag that's some number of bits wide, and introduce some randomization (IV or nonce). You can tweak the size of some of those, but I feel the biggest cost you're paying is probably the b64 encoding. What are you encapsulating this thing in? An HTTP response?
  • porker 7y ago
    Yes in general, not the JWT version. I was thinking in terms of issuing API tokens like this, and how the longer they are, the more room for copy and paste errors. SHA256 has been a good length to provide to people, and encrypting real text is going to make it longer than that; but do some ciphers require less padding? Changing the encoding to say b85 will help.