I am curious why more folks don't use rsa keys anyways? Seems like that makes signature validation even easier (publish the location of the public key for validation). Then your endpoints don't need to exchange secrets at all?

We use RSA signed JWTs for quite a few services and it's been a joy so far. Makes key rotation without downtime super easy and (obviously) doesn't have any of the dangers associated with a shared secret.

https://github.com/crgwbr/asymmetric_jwt_auth

Signing jwt with RSA is a bad idea. Asymmetrical encryption methods are orders of magnitude slower than hmac. It sounds like a nice thing to do but it's really really slow compared to hmac.

That's why TLS only uses the public key to exchange a symmetric key then switches over to AES or whatever.

It makes rotating the secret a hell of a lot easier as well.

I'm not sure I follow. You still need to communicate the public key securely.

Definitely, you would be surprised by the amounts of JWT using very simple secrets

Yeah - that's unfortunate. The spec clearly outlines a required minimum key length and it could be easily enforced in JWS libraries to make things more secure.

JWT with RSA or Ed25519 is definitely not a bad idea there.

JWT does not define Ed25519 as part of the spec. It is supported "off-label" in one JWT library I could find (Joken) for a relatively uncommon language (Elixir).

Frustratingly, JWT defines a tons of stuff, where few are required but some are "Recommended" and some are "Recommended+". I'm not sure what "Recommended+" means, but apparently it means "has known cryptographic flaws", because RSA with PKCSv15 padding is "Recommended+".

I kinda went over the standard on that.

The Go library I use allows to define custom algorithms, so I just set alg to ED2 and use it.

It's within the app only so it doesn't hurt much.

Also agree, it's rather frustrating that JWT is so well defined but something as simple as using Ed25519 is not part of the standard yet.

Out of interest, if you're going to go off-standard, why not just use libsodium and get decent crypto?

Lazy I guess.

The JWT Lib does most of the work and I just stuff in the Ed keys on both ends, don't need to do anything beyond that.

Here's a draft: https://tools.ietf.org/html/draft-ietf-jose-cfrg-curves-06

ES256 is in the spec at least

The last thing the Internet needs more of is foot-bullety ECDSA deployed at scale.

Point of order: Does ES256 enforce RFC 6979? If not, how do you know you aren't repeating k-values?

The only sane crypto in the JWT specification is, sadly, HMAC.