4 ms·

Here's your recommendations: https://security.stackexchange.com/a/233863/111020 https://security.stackexchange.com/a/233863/111020 And yes I just spent 2 hours

Here's your recommendations: https://security.stackexchange.com/a/233863/111020 https://security.stackexchange.com/a/233863/111020 And yes I just spent 2 hours writing that. There can't be a great authentication/crypto that can improve over time. In theory, it must block old things to be state of the art. In practice, it's used in client-server communications, that would break all communications if nothing could talk unless they're always on the exact same version.

rishav_sharan 6y ago
Lovely. Thanks for writing this.
drivebycomment 6y ago
Good recommendation. I should add that RSA is faster on verification but slower on signing than ECDSA. For most application, the amount of traffic is small enough that the difference doesn't matter but for large enough traffic, you should consider the difference. The performance of course depends on a lot of factors but https://connect2id.com/blog/nimbus-jose-jwt-6 https://connect2id.com/blog/nimbus-jose-jwt-6 would give some reasonable idea on the practical difference on modern hardware.