Brute forcing JSON Web Tokens in C

Re:Brute forcing JSON Web Tokens in C by scandox on Saturday January 21, 2017 @04:08PM (#13452168)

I ran it against some JWTs produced by one of my systems and it reported success. The secret it gave was about 5 characters in length. The secret we actually use is 64 characters in length.

[ Parent | on HN ]

Re:Brute forcing JSON Web Tokens in C by porpoisemonkey on Saturday January 21, 2017 @04:30PM (#13452255)

If you sign a JWT with the 5 character secret does it generate a token that you can verify with the 64 character secret? I'm wondering if it could be a key collision.

[ Parent | on HN ]

Re:Brute forcing JSON Web Tokens in C by scandox on Monday January 23, 2017 @10:23AM (#13462755)

I couldn't no. Made sure I was using everything the same, but I couldn't determine any relationship between original secret and one produced by program. However contrary to my original statement it turned out secret in use was actually only 30 characters long. I've passed on more detailed info to OP.

[ Parent | on HN ]

Re:Brute forcing JSON Web Tokens in C by porpoisemonkey on Tuesday January 24, 2017 @01:32PM (#13474098)

Thanks for checking.

> However contrary to my original statement it turned out secret in use was actually only 30 characters long.

I'm guessing it's 32 characters long? (256 bits) That matches to the spec and is a good key - as referenced in other threads anything longer is mostly a waste as the key input gets hashed down to a fixed size.

[ Parent | on HN ]

Re:Brute forcing JSON Web Tokens in C by brendanrius on Saturday January 21, 2017 @04:45PM (#13452314)

If it is not sensitive information, I would be curious to know the JWT you tested with, the key used, and the key that program found

[ Parent | on HN ]

Re:Brute forcing JSON Web Tokens in C by scandox on Monday January 23, 2017 @10:14AM (#13462673)

Sent you an email on this. Sorry for slow response.

[ Parent | on HN ]