Comments (3)
Removing the support for specifying nonces in the public libsodium APIs is a breaking change.
Any breaking changes to libsodium would land in libosdium 2.0.0, not 1.0.z or 1.y.
from paseto.
I think the actual question here is around the intent of the change. Specifically: does making step 3 optional have the intent of letting PASETO implementations use libsodium bindings which do not surface nonces in their APIs, where step 2 is performed by libsodium (i.e. APIs like jedisct1/swift-sodium's which auto-generate the nonce, and don't allow it to be specified)?
If the answer is yes, then use of these APIs still isn't possible due to the the inclusion of the nonce that will be used for encryption in the preAuth value (i.e. this requires a deterministic encryption API, which is not available in swift-sodium). So I'm thinking that the more likely answer is no?
from paseto.
So far, libsodium 2.0.0 has not materialized. I don't think we should worry too much about what @jedisct1 does with 2.0.0 until it has landed and everyone is using it.
from paseto.
Related Issues (20)
- How to use public private key pair? HOT 1
- PHP 8 support HOT 2
- DOWN : paseto.io HOT 1
- New Registered Claim: Token Generation? HOT 2
- Support Multiple Keys in Builders/Parsers HOT 1
- Null salt? HOT 5
- Mention paserk-php in README HOT 2
- Parser::parse(): Expiration check skipped if no other rules are defined HOT 1
- Class \"ParagonIE\\Paseto\\Protocol\\Version4\ Not found HOT 5
- Non-string claim values? HOT 3
- Is there a standard way to generate paseto tokens with human-readable payload without verification? HOT 2
- Questions on Assymetric Keys HOT 5
- I can't get Version 3 working HOT 2
- Invalid MAC for given ciphertext HOT 2
- Attempting to Catch Invalid ed25519 Private Keys HOT 6
- Cannot read pem created with encodePem HOT 4
- [Version 3] Cannot create token from encoded private key
- Undefined array key "ParagonIE\Paseto\Keys\SymmetricKey" HOT 1
- v4: read claims of an expired token HOT 2
- [V1] Vulnerability flag due to phpseclib/phpseclib < 3 HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from paseto.