Comments (3)
Is 256 bits considered secure enough here?
Yes.
These could take an optional key length, preferably with guidance in the documentation as to which length to choose?
At no point in the Paseto protocol is the key size dynamic.
- Version 1:
- RSA: 2048-bit
- AES: 256-bit
- Version 2:
- Ed25519: 256-bit (Elliptic Curve Cryptography)
- ChaCha20: 256-bit
This is all hard-coded into each protocol version. The goal of Paseto was to reduce the number of knobs and levers that developers have to mess with.
from paseto.
Thanks for the quick response.
I must have missed the part about static key lengths; but my point still stands. It should be easy to generate keys for use with each protocol version, and standardizing (in code) how keys are generated in each version would remove another opportunity for doing the wrong thing.
I love this project by the way. :)
from paseto.
That was a good idea, and it also uncovered a deficiency in the implementation. 👍
from paseto.
Related Issues (20)
- How to use public private key pair? HOT 1
- PHP 8 support HOT 2
- DOWN : paseto.io HOT 1
- New Registered Claim: Token Generation? HOT 2
- Support Multiple Keys in Builders/Parsers HOT 1
- Null salt? HOT 5
- Mention paserk-php in README HOT 2
- Parser::parse(): Expiration check skipped if no other rules are defined HOT 1
- Class \"ParagonIE\\Paseto\\Protocol\\Version4\ Not found HOT 5
- Non-string claim values? HOT 3
- Is there a standard way to generate paseto tokens with human-readable payload without verification? HOT 2
- Questions on Assymetric Keys HOT 5
- I can't get Version 3 working HOT 2
- Invalid MAC for given ciphertext HOT 2
- Attempting to Catch Invalid ed25519 Private Keys HOT 6
- Cannot read pem created with encodePem HOT 4
- [Version 3] Cannot create token from encoded private key
- Undefined array key "ParagonIE\Paseto\Keys\SymmetricKey" HOT 1
- v4: read claims of an expired token HOT 2
- [V1] Vulnerability flag due to phpseclib/phpseclib < 3 HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from paseto.