Brute forcing JSON Web Tokens in C

Re:Brute forcing JSON Web Tokens in C by spydum on Saturday January 21, 2017 @02:14PM (#13451558)

I am curious why more folks don't use rsa keys anyways? Seems like that makes signature validation even easier (publish the location of the public key for validation). Then your endpoints don't need to exchange secrets at all?

[ Parent | on HN ]

Re:Brute forcing JSON Web Tokens in C by crgwbr on Saturday January 21, 2017 @07:16PM (#13452857)

We use RSA signed JWTs for quite a few services and it's been a joy so far. Makes key rotation without downtime super easy and (obviously) doesn't have any of the dangers associated with a shared secret.

https://github.com/crgwbr/asymmetric_jwt_auth

[ Parent | on HN ]

Re:Brute forcing JSON Web Tokens in C by nrjdhsbsid on Sunday January 22, 2017 @04:26PM (#13457590)

Signing jwt with RSA is a bad idea. Asymmetrical encryption methods are orders of magnitude slower than hmac. It sounds like a nice thing to do but it's really really slow compared to hmac.

That's why TLS only uses the public key to exchange a symmetric key then switches over to AES or whatever.

[ Parent | on HN ]

Re:Brute forcing JSON Web Tokens in C by davewritescode on Saturday January 21, 2017 @02:20PM (#13451587)

It makes rotating the secret a hell of a lot easier as well.

[ Parent | on HN ]

Re:Brute forcing JSON Web Tokens in C by lvh on Saturday January 21, 2017 @04:44PM (#13452310)

I'm not sure I follow. You still need to communicate the public key securely.

[ Parent | on HN ]