Articles
Release notes, design decisions and notes from the libraries.
-
Understanding JSON Web Tokens: choosing an algorithm
RFC 7518 lists dozens of algorithms. In practice the choice comes down to three questions, and a couple of names you should stop using.
-
Wrapping a key is not the same as encrypting it
AES Key Wrap exists because encrypting a key has requirements that encrypting a message does not. RFC 3394 and RFC 5649, in practice.
-
Understanding JSON Web Tokens: the keys, with JWK
A key format that travels as JSON, key sets you can publish, thumbprints that identify a key by its content, and rotation without downtime.
-
Understanding JSON Web Tokens: encrypting with JWE
Encryption hides the payload from everyone but its recipient. Five parts instead of three, two keys instead of one, and a vocabulary worth learning once.
-
Understanding JSON Web Tokens: signing with JWS
A signature turns two JSON objects into something a recipient can trust. How JWS works, what the three parts of a compact token are, and why the header…
-
Understanding JSON Web Tokens: structure
What a JWT actually is, why the format exists, which standards describe it, and what its two JSON objects contain.
-
AEAD without the tag: a ChaCha20-Poly1305 story
The authentication tag was computed, then dropped. What remained looked like an AEAD and authenticated nothing. GHSA-6vvh-pxr4-25r7.
-
One number, one denial of service: PBES2 and p2c
A password-based algorithm lets the token say how many iterations to run. Nothing said it had to be a reasonable number. GHSA-3prj-6hqw-cm82.
-
A padding oracle in RSA1_5, and what constant-time rejection means
Distinguishing a bad padding from a good one is enough to decrypt without the key. Bleichenbacher, twenty-seven years later, and the fix that looks like doing nothing.
-
Algorithm confusion: when alg comes from the wrong header
A single array spread, and the algorithm a verifier trusts came from a header nobody signed. GHSA-jc38-x7x8-2xc8, found and fixed in JWT-Framework.