Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a method for generating a correct SecretKey #342

Closed
sberyozkin opened this issue Dec 8, 2020 · 1 comment · Fixed by #400
Closed

Add a method for generating a correct SecretKey #342

sberyozkin opened this issue Dec 8, 2020 · 1 comment · Fixed by #400

Comments

@sberyozkin
Copy link
Contributor

A good number of projects (Jose4J itself, JJWT and others) have the utility code for generating the keys. Jose4J itself will enforce that the key length meets the algorithm constraints so the users are not able to use the wrong key size, and Jose4J would report the required length, but having a correct key upfront would be useful.

This feature is not that important for the asymmetric algorithms, in the production one would expect the keys already distributed or available.

This is mainly of interest for generating the correct SecretKey - in scope of creating a JWT cookie, as again, one would expect the key be available on both ends.

KeyUtils.generateSecretKey already exists, but takes a String. So we need another one taking a signature or key encryption algorithm which will return the right key length. Jose4j may already have it so we will just wrap around it

ejba added a commit to ejba/smallrye-jwt that referenced this issue Jan 26, 2021
ejba added a commit to ejba/smallrye-jwt that referenced this issue Jan 26, 2021
ejba added a commit to ejba/smallrye-jwt that referenced this issue Jan 31, 2021
ejba added a commit to ejba/smallrye-jwt that referenced this issue Jan 31, 2021
ejba added a commit to ejba/smallrye-jwt that referenced this issue Feb 7, 2021
ejba added a commit to ejba/smallrye-jwt that referenced this issue Feb 7, 2021
ejba added a commit to ejba/smallrye-jwt that referenced this issue Feb 7, 2021
ejba added a commit to ejba/smallrye-jwt that referenced this issue Feb 7, 2021
ejba added a commit to ejba/smallrye-jwt that referenced this issue Feb 21, 2021
ejba added a commit to ejba/smallrye-jwt that referenced this issue Feb 21, 2021
ejba added a commit to ejba/smallrye-jwt that referenced this issue Feb 21, 2021
ejba added a commit to ejba/smallrye-jwt that referenced this issue Feb 23, 2021
ejba added a commit to ejba/smallrye-jwt that referenced this issue Feb 23, 2021
ejba added a commit to ejba/smallrye-jwt that referenced this issue Feb 23, 2021
@darranl
Copy link
Contributor

darranl commented Feb 23, 2021

I know this came up in the earlier discussions, I am actually in the middle of something similar in WildFly but for a completely different purpose - one thing I am questioning is if we should really prefer a KeyFactory over populating the SecretKeySpec manually in case a user is using some form of cerified cryptographic provider.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants