Hacker News Reader

Comment by rvz | Hacker News Reader

Well the fact that you need to 'choose' a cryptographic protocol out of the suite of ciphers reminds me of why the creator of WireGuard opted for no cryptographic agility and instead chose versioned protocols, unlike OpenVPN.

From the Wireguard paper [0]:

> 'Finally, WireGuard is cryptographically opinionated. It intentionally lacks cipher and protocol agility. If holes are found in the underlying primitives, all endpoints will be required to update. As shown by the continuing torrent of SSL/TLS vulnerabilities, cipher agility increases complexity monumentally.'

[0] https://www.wireguard.com/papers/wireguard.pdf

View on HN

If someone wanted to utilize JWT in a new system, and therefore could freely choose any of the JWT options, what would the "most secure" be?

It would probably save a lot people headaches if jwt.io published a chart of "use case" and "algo/cipher selection". From what I've researched, all the JWT code libraries give you a menu of selections, and it's on you to research which algo/cipher to use, and given the volume of selections, that's a substantial reading list.

Is there a 'versioned' JWT that picks sane defaults as they are developed + improved?

Paseto appears to be something that attempts to be "JWT but with sensible choices already made".

When it comes down to it, you need some crypto knowledge to make these choices. We constrain them to PS256 and ES256 in our system (but then you also need to make sure that the curve used for your keys for the ES256 signature is an acceptable one)

Yeah, at this point, just use PASETO and be done with it. It's not worth trying to figure out which JWT misconfiguration will burn you next.

From pypaseto

“ This is still in early development. It has not been reviewed in a security audit yet, so please be aware that it is not expected to be ready for use in production systems.”

Is that remark about that specific implementation or the spec as a whole?

Just for the specific implementation. The reference implementation is the PHP version here:

https://github.com/paragonie/paseto

And has had a lot more attention.

The SPIFFE JWT-SVID standard attempts this, although for a specific context: https://github.com/spiffe/spiffe/blob/master/standards/JWT-S...

Here's your recommendations: https://security.stackexchange.com/a/233863/111020

And yes I just spent 2 hours writing that.

There can't be a great authentication/crypto that can improve over time. In theory, it must block old things to be state of the art. In practice, it's used in client-server communications, that would break all communications if nothing could talk unless they're always on the exact same version.

Lovely. Thanks for writing this.

Good recommendation. I should add that RSA is faster on verification but slower on signing than ECDSA. For most application, the amount of traffic is small enough that the difference doesn't matter but for large enough traffic, you should consider the difference. The performance of course depends on a lot of factors but

https://connect2id.com/blog/nimbus-jose-jwt-6

would give some reasonable idea on the practical difference on modern hardware.

Reply on news.ycombinator.com