Comments (5)
Wrote a Go implementation today and have some feedback on this issue. I tried implementing the package by only reading the docs but had to dig through the source code on several occasions to figure out what to do.
https://github.com/ericchiang/go-past
https://github.com/paragonie/past/tree/master/docs
Some parts of the doc that I found underspecified:
v1.enc
is underspecified.- Info tags for HKDF isn't documented ("past-encryption-key", "past-auth-key-for-aead").
- Which half of the nonce is used for the key split vs. the CTR IV isn't clear.
- Input to PAE isn't specified. What order are the arguments provided?
- Header, payload, (optional nonce,) footer?
- Is the header
v1.enc
orv1.enc.
? - Footer is always supplied to PAE even if its empty and not added to the final token.
- Payload is sometimes included in PAE input, sometimes not?
- LE64 encoding isn't well defined. Do all bytes have to be ASCII escaped? Are ASCII valid points okay?
- Does
LE64(64)
encode as@\x00\x00\x00\x00\x00\x00\x00
or\x40\x00\x00\x00\x00\x00\x00\x00
?
- Does
- How are the MACs and nonces combined with the payload to produce the third token component?
- It can be
base64(payload|mac)
orbase64(nonce|ciphertext|mac)
orbase64(nonce|ciphertext)
.
- It can be
Happy to volunteer some time for reviews or writing up docs.
from paseto.
What is the level of specificity you need right now?
Currently, the plan is to hammer out any warts and ambiguities in the reference implementation, then write a formal RFC draft. The main reason I'm not delving into this right now is that such a document will be an incredible timesink that involves redefining e.g. XChaCha20-Poly1305 since there isn't an internet standard that defines HChaCha20 or the extended-nonce AEAD construction used in libsodium.
from paseto.
I think I understand now.... I'd have to wait till the RFC is ready then.
from paseto.
I'm going to track the progress of writing drafts in #16. Feel free to leave this open until the moment you're satisfied with the progress in the other issue.
from paseto.
Some of the work in #24 should help here.
Happy to volunteer some time for reviews or writing up docs.
Thanks @ericchiang, if you'd give it a look over before I merge it, I'd greatly appreciate it.
from paseto.
Related Issues (20)
- obscene amount of avertisement for a protocol?
- How to use public private key pair? HOT 1
- PHP 8 support HOT 2
- DOWN : paseto.io HOT 1
- New Registered Claim: Token Generation? HOT 2
- Support Multiple Keys in Builders/Parsers HOT 1
- Null salt? HOT 5
- Mention paserk-php in README HOT 2
- Parser::parse(): Expiration check skipped if no other rules are defined HOT 1
- Class \"ParagonIE\\Paseto\\Protocol\\Version4\ Not found HOT 5
- Non-string claim values? HOT 3
- Is there a standard way to generate paseto tokens with human-readable payload without verification? HOT 2
- Questions on Assymetric Keys HOT 5
- I can't get Version 3 working HOT 2
- Invalid MAC for given ciphertext HOT 2
- Attempting to Catch Invalid ed25519 Private Keys HOT 6
- Cannot read pem created with encodePem HOT 4
- [Version 3] Cannot create token from encoded private key
- Undefined array key "ParagonIE\Paseto\Keys\SymmetricKey" HOT 1
- v4: read claims of an expired token HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from paseto.