Re:Critical Vulnerabilities in JSON Web Token Libraries
by btilly on Wednesday April 01, 2015 @02:05PM
(#9305557)
You didn't read carefully enough.
Your site may well find both HMAC and RSA to be acceptable algorithms. However if you can be tricked into using HMAC to verify something actually signed with RSA, then anyone can forge content you accept as valid.
What is important is not that the algorithm is acceptable. It is that the algorithm you use for verification is the algorithm that actually should be used.
Your site may well find both HMAC and RSA to be acceptable algorithms. However if you can be tricked into using HMAC to verify something actually signed with RSA, then anyone can forge content you accept as valid.
What is important is not that the algorithm is acceptable. It is that the algorithm you use for verification is the algorithm that actually should be used.