-
Notifications
You must be signed in to change notification settings - Fork 49
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add a method for generating a correct SecretKey #342
Comments
ejba
added a commit
to ejba/smallrye-jwt
that referenced
this issue
Jan 26, 2021
ejba
added a commit
to ejba/smallrye-jwt
that referenced
this issue
Jan 26, 2021
ejba
added a commit
to ejba/smallrye-jwt
that referenced
this issue
Jan 31, 2021
ejba
added a commit
to ejba/smallrye-jwt
that referenced
this issue
Jan 31, 2021
ejba
added a commit
to ejba/smallrye-jwt
that referenced
this issue
Feb 7, 2021
ejba
added a commit
to ejba/smallrye-jwt
that referenced
this issue
Feb 7, 2021
ejba
added a commit
to ejba/smallrye-jwt
that referenced
this issue
Feb 7, 2021
ejba
added a commit
to ejba/smallrye-jwt
that referenced
this issue
Feb 7, 2021
ejba
added a commit
to ejba/smallrye-jwt
that referenced
this issue
Feb 21, 2021
ejba
added a commit
to ejba/smallrye-jwt
that referenced
this issue
Feb 21, 2021
ejba
added a commit
to ejba/smallrye-jwt
that referenced
this issue
Feb 21, 2021
ejba
added a commit
to ejba/smallrye-jwt
that referenced
this issue
Feb 23, 2021
ejba
added a commit
to ejba/smallrye-jwt
that referenced
this issue
Feb 23, 2021
ejba
added a commit
to ejba/smallrye-jwt
that referenced
this issue
Feb 23, 2021
I know this came up in the earlier discussions, I am actually in the middle of something similar in WildFly but for a completely different purpose - one thing I am questioning is if we should really prefer a KeyFactory over populating the SecretKeySpec manually in case a user is using some form of cerified cryptographic provider. |
sberyozkin
pushed a commit
that referenced
this issue
Feb 24, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
A good number of projects (Jose4J itself, JJWT and others) have the utility code for generating the keys. Jose4J itself will enforce that the key length meets the algorithm constraints so the users are not able to use the wrong key size, and Jose4J would report the required length, but having a correct key upfront would be useful.
This feature is not that important for the asymmetric algorithms, in the production one would expect the keys already distributed or available.
This is mainly of interest for generating the correct
SecretKey
- in scope of creating a JWT cookie, as again, one would expect the key be available on both ends.KeyUtils.generateSecretKey already exists, but takes a String. So we need another one taking a signature or key encryption algorithm which will return the right key length.
Jose4j
may already have it so we will just wrap around itThe text was updated successfully, but these errors were encountered: