At the end of this month, April 2018, version 1.1.0 of web-token/jwt-framework will be released along with all its components (see the previous article).
It also marks the creation of a new branch: v1.2.
That branch will be the occasion to add a new component: web-token/jwt-experimental. It will hold every feature judged worth having but considered unstable, either because no specification covers it or because that specification is still a draft.
Among the first experimental features, mostly new algorithms taken from side specifications. A non-exhaustive list:
- For signature:
- HS1: the SHA-1 hash function, no more and no less. It is considered unsafe, and this algorithm should only be used where compatibility with an older system is required.
- HS256/64: identical to HS256, but the signature is truncated to 64 bits.
- For encryption:
- RSA-OAEP-384 and RSA-OAEP-512: you already know RSA-OAEP and RSA-OAEP-256. These round out the family.
- ChaCha20-Poly1305: everybody has been talking about that pair for months.
- A128CTR, A192CTR and A256CTR: to be handled with care, as these algorithms carry risk. For compatibility with older systems only.
- A128CBC, A192CBC and A256CBC: not to be confused with A256CBC-HS512, for instance. Risky as well, so again for compatibility with older systems only.
None of these features should ever be used in production. If you use the Symfony Debug Toolbar, warnings will tell you when one of them is in play.