News for hackers. Stuff that matters.

A comment on Brute forcing JSON Web Tokens in C. Parent comment

Re:Brute forcing JSON Web Tokens in C by buckhx on Saturday January 21, 2017 @05:34PM (#13452474)
ES256 is in the spec at least
[ Parent | on HN ]
Re:Brute forcing JSON Web Tokens in C by CiPHPerCoder on Saturday January 21, 2017 @05:40PM (#13452494)
The last thing the Internet needs more of is foot-bullety ECDSA deployed at scale.

Point of order: Does ES256 enforce RFC 6979? If not, how do you know you aren't repeating k-values?

The only sane crypto in the JWT specification is, sadly, HMAC.

[ Parent | on HN ]