News for hackers. Stuff that matters.
Re:Brute forcing JSON Web Tokens in C by tscs37 on Saturday January 21, 2017 @04:43PM (#13452302)
I kinda went over the standard on that.

The Go library I use allows to define custom algorithms, so I just set alg to ED2 and use it.

It's within the app only so it doesn't hurt much.

Also agree, it's rather frustrating that JWT is so well defined but something as simple as using Ed25519 is not part of the standard yet.

Re:Brute forcing JSON Web Tokens in C by lvh on Saturday January 21, 2017 @04:47PM (#13452319)
Out of interest, if you're going to go off-standard, why not just use libsodium and get decent crypto?
Re:Brute forcing JSON Web Tokens in C by tscs37 on Saturday January 21, 2017 @04:52PM (#13452344)
Lazy I guess.

The JWT Lib does most of the work and I just stuff in the Ed keys on both ends, don't need to do anything beyond that.