SHA-256 not FIPS-202 compliant and a SHA-3 Update Required by NIST

[TheRook]

The list of supported algorithms needs to be updated to accommodate the new changes to JWT and guidance from NIST:

https://pyjwt.readthedocs.io/en/stable/algorithms.html

NIST (which represents the top cryptographers in the world) does not approve of the use of SHA256 because old and deprecated methods cannot be used in high security environments, SHA3 must be used. This means that the pyjwt library currently cannot be used in some government, finical and other high-security industries that require FIPS-202: https://csrc.nist.gov/projects/hash-functions

This list of supported algorithms in pyjwt probably fine when it was written, but NIST has approved SHA-3, and not only is it much more secure - but also faster as it was designed for 64bit architecture. It would b wonderful if you called out that HS3-256 should be preferred as it is the most performant method that is difficult to crack so long as the key is sufficiently long and kept safe.

However i strongly recommend marking large hmacs like 385 and 512 as deprecated or removed entirely, as a Cryptographer and a security expert we should remove these because someone unfortunate engineer might accidentally turn them on. I can assure you that these key sizes could not help anyone, makes the server even easier to DDoS, and it might make someone feel safer than they actually are. A key size here lowers the bar not raises it, and very few engineers are aware enough to know why.

[auvipy]

thanks for the report! we will try follow ASAP. is it possible for you to start a contribution?

[TheRook]

I'd be happy to, just send a pr?

On Tue, Nov 7, 2023, 8:43 PM Asif Saif Uddin @.***> wrote:

thanks for the report! we will try follow ASAP. is it possible for you to start a contribution?

— Reply to this email directly, view it on GitHub https://github.com/jpadilla/pyjwt/issues/924#issuecomment-1801076283, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAD7MN55YSCAJ26PRK63E5LYDMEVLAVCNFSM6AAAAAA6TAVZH6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQMBRGA3TMMRYGM . You are receiving this because you authored the thread.Message ID: @.***>

[auvipy]

yeah sure start with that please!

[github-actions[bot]]

This issue is stale because it has been open 60 days with no activity. Remove stale label or comment or this will be closed in 7 days