News for hackers. Stuff that matters.

A comment on Why to not use JWT (2021). Parent comment

Re:Why to not use JWT (2021) by diroussel on Friday September 30, 2022 @05:17PM (#33040921)
You only need a cryptographically secure RNG to generate a key pair. Assuming asymetric keys. That private key can then be used to sign many many JWTS.

Whereas generating new session ids will always need fresh entropy.

[ Parent | on HN ]
Re:Why to not use JWT (2021) by dontlaugh on Monday October 03, 2022 @05:55AM (#33065376)
That depends on the algorithm, some depend on randomness like IVs.
[ Parent | on HN ]
Re:Why to not use JWT (2021) by diroussel on Monday October 03, 2022 @06:35AM (#33065661)
Maybe you are thinking of JWE?

If the signing of the JWT wasn’t deterministic, then it would be hard to verify.

[ Parent | on HN ]
Re:Why to not use JWT (2021) by dontlaugh on Tuesday October 04, 2022 @05:11AM (#33078016)
Correct. Some auth systems use JWE. Some even use it interchangeably with just JWS.
[ Parent | on HN ]