2 ms·
ok, and what happens if / when a vulnerability is found? You increase the version number? How is that different than a versioned JOSE?
by thefounder 7y ago
ok, and what happens if / when a vulnerability is found? You increase the version number? How is that different than a versioned JOSE?
- CiPHPerCoder 7y agoIn addition to versioning, we're starting with a very limited set of functionality tuned to security not flexibility. If you're using v2, you're either signing with Ed25519 or encrypting with XChaCha20-Poly1305. There are no additional knobs or levers. Only boring cryptography. A versioned JOSE that limited flexibility is dead in the water. JOSE users will bikeshed over backeards compatibility until the end of time. Might as well specify a new standard at that point. Hence PASETO.