I need to

  • encrypt JSON payload (not just sign)
  • not share private key
  • verify the payload is generated with the shared public key and RSA fitting all of these.

As I’ve only made auth with JWT so far, I’m not sure. If I use RSA, I guess I have to put the encrypted text in the body.

Do you think it can be used? Any other suggestions?

  • colossus@infosec.pubEnglish
    1·
    2 years ago

    Sounds like you’re proposing WebAuthn which already exists. Keep in mind that there are attacks against RSA with PKCS1 padding. I’d use a more secure cryptographic primitive than RSA (I.e. elliptic curves) - there’s a reason cryptographic experts don’t look towards RSA these days.

  • asudox@lemmy.asudox.devEnglish
    1·
    8 days ago

    Is there a particular reason you want to use your own implementation instead of JWT? If you just want an alternative to JWT, there is also PASETO.

    • iso@lemy.lolOPEnglish
      2·
      8 days ago

      I wanted to let my users encrypt their payload with my public key so only I can decrypt that payload. Just like how PGP works. Eventually I’ve used hybrid encryption with AES for encrypting the payload and RSA for encrypting AES secret key.

      Just to let you know this post is almost 2 years old :)