Arbitrary payload signing use cases? about paseto HOT 4 CLOSED

There's actually two components to PASETO:

1. The encryption/signing layer.
2. The JSON token (claims) layer.

You can pull out just Version1 and Version2 and use them for arbitrary text. We just built a token API on top of them in PASETO proper.

Alternatively: drop everything into a footer if you're only using v2.public (which uses Ed25519), since those are arbitrary data.

from paseto.

@paragonie-scott in your second example where everything is dropped into a footer if only v2.public is used, is it assumed that the message, m, is therefore empty and the footer, f, houses the arbitrary data? As written, the spec seems to require a message, m and only the footer, f, is optional. Thus the message format becomes as follows:

version.purpose.footer

from paseto.

@anweiss The message part contains the signature and/or MAC, so it's not possible to have an empty message there.

from paseto.

I'm going to close this. If you still have a question, please let us know.

https://github.com/paseto-standard/paseto-spec is where the specification lives now

from paseto.