3 ms·
It looks like in the case of MS they simply trusted an incorrect key in the validation path? I fail to see how PASETO would have solved that. There were no toke
by cyberax 1y ago
It looks like in the case of MS they simply trusted an incorrect key in the validation path? I fail to see how PASETO would have solved that. There were no token format shenanigans.
`alg=none` and `hsa=rsa` were really the only ones that are JWT-specific. Invalid curves are algorithm-specific, and JWT allows the Ed25519 signatures.
- francislavoie 1y agoYes it allows Ed25519, but it doesn't disallow other curves. That's the whole point. If you allow primitives that have potential issues, it's risky to use.
- cyberax 1y agoThere is no standard saying that implementations MUST support P-256. So you're free to just turn on Ed25519. And so far, I don't think NIST curves have been cracked? iOS secure enclave only supports them, for example.
- francislavoie 1y agoIt's not about the curves being cracked. https://auth0.com/blog/critical-vulnerability-in-json-web-encryption/ https://auth0.com/blog/critical-vulnerability-in-json-web-en...