search

o1egl / paseto

Platform-Agnostic Security Tokens implementation in GO (Golang)
MIT License
833 stars 34 forks source link

Bind Keys to Version and Purpose #32

Open paragonie-security opened 2 years ago

paragonie-security commented 2 years ago

https://github.com/o1egl/paseto/blob/f1000e3be0ce1d221c08cebbe13e184414a092f6/v2.go#L78

https://github.com/o1egl/paseto/blob/f1000e3be0ce1d221c08cebbe13e184414a092f6/v2.go#L138

See https://github.com/paseto-standard/paseto-spec/blob/master/docs/02-Implementation-Guide/03-Algorithm-Lucidity.md

Right now, byte arrays are accepted by this API. There's no mechanism to prevent a user from using a v2 public key as a v2 local key.