4 ms·

If someone wanted to utilize JWT in a new system, and therefore could freely choose any of the JWT options, what would the "most secure" be? It would probably

If someone wanted to utilize JWT in a new system, and therefore could freely choose any of the JWT options, what would the "most secure" be? It would probably save a lot people headaches if jwt.io published a chart of "use case" and "algo/cipher selection". From what I've researched, all the JWT code libraries give you a menu of selections, and it's on you to research which algo/cipher to use, and given the volume of selections, that's a substantial reading list. Is there a 'versioned' JWT that picks sane defaults as they are developed + improved?

Nursie 6y ago
Paseto appears to be something that attempts to be "JWT but with sensible choices already made". When it comes down to it, you need some crypto knowledge to make these choices. We constrain them to PS256 and ES256 in our system (but then you also need to make sure that the curve used for your keys for the ES256 signature is an acceptable one)
- StavrosK 6y ago
  Yeah, at this point, just use PASETO and be done with it. It's not worth trying to figure out which JWT misconfiguration will burn you next.
  - jamescontrol 6y ago
    From pypaseto “ This is still in early development. It has not been reviewed in a security audit yet, so please be aware that it is not expected to be ready for use in production systems.”
    - timvdalen 6y ago
      Is that remark about that specific implementation or the spec as a whole?
      - kingemer 6y ago
        Just for the specific implementation. The reference implementation is the PHP version here: https://github.com/paragonie/paseto https://github.com/paragonie/paseto And has had a lot more attention.
ajessup 6y ago
The SPIFFE JWT-SVID standard attempts this, although for a specific context: https://github.com/spiffe/spiffe/blob/master/standards/JWT-SVID.md https://github.com/spiffe/spiffe/blob/master/standards/JWT-S...
user5994461 6y ago
Here's your recommendations: https://security.stackexchange.com/a/233863/111020 https://security.stackexchange.com/a/233863/111020 And yes I just spent 2 hours writing that. There can't be a great authentication/crypto that can improve over time. In theory, it must block old things to be state of the art. In practice, it's used in client-server communications, that would break all communications if nothing could talk unless they're always on the exact same version.
- rishav_sharan 6y ago
  Lovely. Thanks for writing this.
- drivebycomment 6y ago
  Good recommendation. I should add that RSA is faster on verification but slower on signing than ECDSA. For most application, the amount of traffic is small enough that the difference doesn't matter but for large enough traffic, you should consider the difference. The performance of course depends on a lot of factors but https://connect2id.com/blog/nimbus-jose-jwt-6 https://connect2id.com/blog/nimbus-jose-jwt-6 would give some reasonable idea on the practical difference on modern hardware.

Nursie 6y ago

Paseto appears to be something that attempts to be "JWT but with sensible choices already made". When it comes down to it, you need some crypto knowledge to make these choices. We constrain them to PS256 and ES256 in our system (but then you also need to make sure that the curve used for your keys for the ES256 signature is an acceptable one)

StavrosK 6y ago
Yeah, at this point, just use PASETO and be done with it. It's not worth trying to figure out which JWT misconfiguration will burn you next.
- jamescontrol 6y ago
  From pypaseto “ This is still in early development. It has not been reviewed in a security audit yet, so please be aware that it is not expected to be ready for use in production systems.”
  - timvdalen 6y ago
    Is that remark about that specific implementation or the spec as a whole?
    - kingemer 6y ago
      Just for the specific implementation. The reference implementation is the PHP version here: https://github.com/paragonie/paseto https://github.com/paragonie/paseto And has had a lot more attention.

ajessup 6y ago

The SPIFFE JWT-SVID standard attempts this, although for a specific context: https://github.com/spiffe/spiffe/blob/master/standards/JWT-SVID.md https://github.com/spiffe/spiffe/blob/master/standards/JWT-S...

user5994461 6y ago

Here's your recommendations: https://security.stackexchange.com/a/233863/111020 https://security.stackexchange.com/a/233863/111020 And yes I just spent 2 hours writing that. There can't be a great authentication/crypto that can improve over time. In theory, it must block old things to be state of the art. In practice, it's used in client-server communications, that would break all communications if nothing could talk unless they're always on the exact same version.

rishav_sharan 6y ago
Lovely. Thanks for writing this.
drivebycomment 6y ago
Good recommendation. I should add that RSA is faster on verification but slower on signing than ECDSA. For most application, the amount of traffic is small enough that the difference doesn't matter but for large enough traffic, you should consider the difference. The performance of course depends on a lot of factors but https://connect2id.com/blog/nimbus-jose-jwt-6 https://connect2id.com/blog/nimbus-jose-jwt-6 would give some reasonable idea on the practical difference on modern hardware.