Live data from Hacker News

Show HN: PAST, a secure alternative to JWT

github.com

121–130 of 140 posts

Re: Show HN: PAST, a secure alternative to JWT

#121
post #84
post #52

Earlier quoted context omitted.

Just a small 'way forward' for those wanting to have the ability to revoke a JWT after I came up with a solution on my last project: A 'Gateway' - use OpenResty to verify the JWT ID stored in a redis cache using a proxy pass. When the Authentication service grants a JWT add its ID to this cache along with a way of identifying the user. That way the entire advantage/disadvantage of decentralised authentication is not…

Congratulations, you’ve just invented session tokens. Don’t get me wrong: stateless tokens (like JWT) are terrible in part because they’re irrevocable, but then why bother reimplementing session tokens with JWT? Just use plain old session tokens instead.

They are not irrevocable - just harder to revoke.

If you want something that avoids storing all tokens, you can use a blacklist. You don't even have to check for revocation on any call - you could perfectly use short-lived (say 10 minute) access tokens and force frequent refresh using a refresh token and then only check the refresh token calls.

Whether you want to use it or not is a matter of making the right trade-offs. Stateful tokens are simpler to implement on the surface, but you have to keep in mind that the database lookup itself could be vulnerable to timing attacks.

Unfortunately, most database-based token implementations I've seen perform lookup based on the token string, instead of looking up the user and then checking all of the user's tokens, one by one.

And if you're not a small startup and actually have to handle loads north of 10,000 QPS (some of us do), these stateful tokens become quite expensive.

Re: Show HN: PAST, a secure alternative to JWT

#122
post #4

This is better than JWT. In particular: the whole protocol is versioned, rather than serving as a metaprotocol that negotiates the underlying cryptography. If you speak "v2" of this protocol, and refuse to accept any other version, then you're getting a token that is basically just Nacl. My only nit --- apart from the "auth enc seal sign" names, which aren't coherent --- is why do public key at all? Yes, Nacl support…

> My only nit --- apart from the "auth enc seal sign" names, which aren't coherent --- is why do public key at all? > Why not punt "seal" and "sign" into a "v3", when/if it's needed? Would you be happier seeing something like this? - v1: HMAC-SHA2, AES-CTR+HMAC-SHA2 - v2: RSA and all its sins - v3: Libsodium crypto_aead_* - v4: Libsodium crypto_{box,sign}_* > What's the use case for it? Who's asking for it? Specifica…

I would happily do away with v1 completely. In my unfortunate experience you're still giving developers enough rope to hang themselves with by choosing older ciphers just because they are well-known.

Re: Show HN: PAST, a secure alternative to JWT

#123
post #69

I really don't get the whole "the spec supports choosing of algorithm, therefore the whole implementation is bad" If my server-side application sends a JWT with a "good" algorithm, and disallows any other alg's, wouldn't that prevent attacks? Why do we need a whole new implementation?

> If my server-side application sends a JWT with a "good" algorithm, and disallows any other alg's, wouldn't that prevent attacks? It does not. Unless you have specifically hardened your server to refuse to even try verifying tokens which use "bad" algorithms, a client can still present a key signed with one of those algorithms, and attempting to verify it may pose a risk.

But my code can just ignore the alg passed by the user and use whatever one I want to use.

Re: Show HN: PAST, a secure alternative to JWT

#124

Earlier quoted context omitted.

I've read about Macaroons and the lack of a standard to encode caveats (mainly from the google group about macaroons) but I'm interested in your take, so more details would be great!

If you compare it to JWT in JWT claims are basically a string name (like "exp") and a JSON value. It's pretty simple. You need to check of the value for exp is a number and is greater than current millis. In Macaroons the entire caveat (a.k.a. claim) is just a byte array. The majority of libraries use predicates "X op Y" encoded in UTF-8 (e.g. time Unfortunately that's where the simplicity of Macaroons end because ev…

Awesome, thanks for the details.

One of the issues that I saw being discussed on the forums was precisely the lack of a standard format for caveats and even some suggestions to create one.

I think it's a very cool project but for some reason I don't think it has caught on. Do you think if someone came up with a suitable standard built it would see broader use? or what is your take on the lack of interest (IMHO) for this awesome idea?

Edit: Any way I could contact you to discuss this a bit more, if you are open to it? :)

Re: Show HN: PAST, a secure alternative to JWT

#125
post #113

Earlier quoted context omitted.

I've written about this at length here: https://paragonie.com/blog/2017/03/jwt-json-web-tokens-is-ba... (It's also the first link in the README for the project this Show HN is linking to, FWIW)

Those are mostly the drawbacks of JWT, less so using stateless sessions altogether. I found some additional reasons from a page that was linked from that last link here: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-fo... * They take up more space * You cannot invalidate individual JWT tokens The other reasons seem a bit weaker. In your opinion, are those also the reasons why you wouldn't use PAST for sta…

> In your opinion, are those also the reasons why you wouldn't use PAST for stateless sessions?

Yep

Re: Show HN: PAST, a secure alternative to JWT

#126
post #81

Earlier quoted context omitted.

I spent two weeks (my Christmas vacation) working on rough drafts for several problems I wanted to solve in 2018. PAST was one of items I listed. (The list is here: https://github.com/paragonie-scott/public-projects/issues/6 ) 99.9% of that time was spent trying to come up with a better name/acronym, without success. I decided to just give it a plain/obvious name until a better one surfaced.

Refer to it with a version number: PAST2, PAST3, etc.. You could also drop the use mapping: change 'sign' to 'public-auth' and explain that it's a 'sign' operation (a.k.a. digital signatures)

my favourite is PAST4 tee-hee

Re: Show HN: PAST, a secure alternative to JWT

#127

Earlier quoted context omitted.

> My only nit --- apart from the "auth enc seal sign" names, which aren't coherent --- is why do public key at all? > Why not punt "seal" and "sign" into a "v3", when/if it's needed? Would you be happier seeing something like this? - v1: HMAC-SHA2, AES-CTR+HMAC-SHA2 - v2: RSA and all its sins - v3: Libsodium crypto_aead_* - v4: Libsodium crypto_{box,sign}_* > What's the use case for it? Who's asking for it? Specifica…

I would happily do away with v1 completely. In my unfortunate experience you're still giving developers enough rope to hang themselves with by choosing older ciphers just because they are well-known.

To extend on that, I can give list the lessons I learned from actually running a similar scheme internally in production for a while now:

1. Give developers the minimum amount of knobs. If they need to choose between 'auth', 'enc', 'seal' and 'sign' it's still going to be confusing. In my case they can personally come to me and ask "Which version should I use? Which type should I use?", but it's not clear.

I'm still undecided whether supporting an unencrypted authenticated token is useful, but 'enc' should ideally be the default, with users going a little bit more out of their way to do anything else.

2. Asymmetrically signed payloads with an expiry are this strange bird that looks like a duck, quacks like a duck but unfortunately _are not a duck_. They're certainly useful, but when I was calling them 'tokens', my users were confused whether they should use them as access tokens.

It's great to have a simple and robust encoding format for packaging payloads with an Ed25519 signature, but it's better to clearly call it something other than 'token', or you'll end up with users deciding they should use asymmetric access tokens just because it makes the key more secure.

3. You want to have some mechanism to specify key ID or key version in the wrapper, because this allows you to do automatic key rotation gracefully. You can use the optional (AEAD) payload for that, but that wouldn't be entirely clear to the users how.

Let's say you want to rotate the key every week, but your longest token has a TTL of 24 hours: you will need to have a window where you would support two different encryption keys. In other rotation scenarios (e.g. rotating every 24 hours with longest token TTL being 30 days) you can have many more encryption keys supported concurrently. You can iterate and try all possible keys of course, but having key ID/version is much cleaner.

Re: Show HN: PAST, a secure alternative to JWT

#128
post #73
post #69

I really don't get the whole "the spec supports choosing of algorithm, therefore the whole implementation is bad" If my server-side application sends a JWT with a "good" algorithm, and disallows any other alg's, wouldn't that prevent attacks? Why do we need a whole new implementation?

I think one of the issues is a very practical one. When everything is called JWT, it's hard for users to figure out whether it's a secure or insecure implementation. It's completely possible to do secure things with JWT, especially if you control every producer and consumer, but it's not guaranteed.

It's completely possible to do insecure things with PAST.

There is always going to be someone who hardcodes the root password into a public GitHub repo.

The problem with JWT is IMO largely that things became too easy, so people coded without thinking. I'm not sure that's easy to prevent. I don't blame the JWT spec for mistakes that are so obvious.

Re: Show HN: PAST, a secure alternative to JWT

#129
post #123

Earlier quoted context omitted.

> If my server-side application sends a JWT with a "good" algorithm, and disallows any other alg's, wouldn't that prevent attacks? It does not. Unless you have specifically hardened your server to refuse to even try verifying tokens which use "bad" algorithms, a client can still present a key signed with one of those algorithms, and attempting to verify it may pose a risk.

But my code can just ignore the alg passed by the user and use whatever one I want to use.

If you're going to ignore compatibility anyway, you could also use good crypto. The JWT doesn't define what "Recommended" and "Recommended+" means but apparently RSA+PKCSv15 is Recommended+ so I guess it means "crypto known to be broken in the 90s".

Re: Show HN: PAST, a secure alternative to JWT

#130
post #99

A common security issue I've seen with uses of JWT doesn't have to do with JWT itself but how it's used by front-end developers. It's commonly stored in localStorage instead of an HttpOnly cookie, which creates a cross-site scripting vulnerability. More details here: http://cryto.net/~joepie91/blog/2016/06/13/stop-using-jwt-fo... Shockingly, the advice I've seen to protect against this by folks like Auth0 is "keep yo…

If something is a HttpOnly cookie, and I get XSS, why can't I just hit your API as much as I like anyway?
Post reply on HN