Move MACs to Project Goals #2

New Issue

jaiden · 2021-12-06T16:31:00Z

jaiden commented

2021-12-06 16:31:00 +00:00

Rationale

Unfortunately MACs in JWTs are used enough to justify supporting them. This is particularly tricky due to the fundamental problems with JWTs.

Avoiding Type Confusion

alg, kid, and other distinguishing and/or specifying fields cannot be trusted in a token. No matter what, it is very likely to cough-up a type confusion vulnerability. While the mismatches are obviously errors, matches don't mean anything useful.

I have thought of several mitigations:

Not allowing MACs and signatures in the same keyset.
- You should know whether you will be dealing with a signature or MAC beforehand.
- Having to support both from the same source is a fundamental failure of a system.
Deny every key type by default and make the developer build a profile. The profile will also not allow mixing MACs and signatures.
- Keep in mind that that this shouldn't be the only interface. Otherwise people will develop a mindset for enabling lots of types by default. However, this codepath should still be the simplest and recommended way.

## Rationale Unfortunately MACs in JWTs are used enough to justify supporting them. This is particularly tricky due to the fundamental problems with JWTs. ## Avoiding Type Confusion `alg`, `kid`, and other distinguishing and/or specifying fields cannot be trusted in a token. No matter what, it is very likely to cough-up a type confusion vulnerability. While the mismatches are obviously errors, matches don't mean *anything useful*. I have thought of several mitigations: * Not allowing MACs and signatures in the same keyset. - You **should** know whether you will be dealing with a signature or MAC beforehand. - Having to support both from the same source is a fundamental failure of a system. * Deny every key type by default and make the developer build a profile. The profile will also not allow mixing MACs and signatures. - Keep in mind that that this shouldn't be the only interface. Otherwise people will develop a mindset for enabling lots of types by default. However, this codepath should still be the simplest and recommended way.

jaiden added the

feature

label 2021-12-06 16:31:00 +00:00

jaiden added this to the v0.0.1 milestone 2021-12-06 16:33:30 +00:00

jaiden added a new dependency 2021-12-06 16:34:14 +00:00

#1 Unmarshalling with encoding/json doesn't handle duplicates

jaiden removed a dependency 2021-12-06 16:34:20 +00:00

#1 Unmarshalling with encoding/json doesn't handle duplicates

jaiden self-assigned this 2021-12-06 16:35:46 +00:00

Sign in to join this conversation.