search

brycx / pasetors

PASETOrs: PASETO tokens in pure Rust
MIT License
91 stars 10 forks source link

Bind Keys to Version and Purpose #14

Closed paragonie-security closed 2 years ago

paragonie-security commented 3 years ago

https://github.com/brycx/pasetors/blob/fa3360d32ba089cc9a74cd9225266a8df92e7543/src/version2.rs#L162

See https://github.com/paseto-standard/paseto-spec/blob/master/docs/02-Implementation-Guide/03-Algorithm-Lucidity.md

Right now, byte arrays are accepted by this API. There's no mechanism to prevent a user from using a v2 public key as a v2 local key.

brycx commented 3 years ago

Thanks for the suggestion @paragonie-security. This sounds like a good idea.

I'll include this in the next release.