paragonie-scott
commented
6 years ago
- Is the body and its claims always encrypted? If not, when it is it not encrypted?
As documented here, the body is encrypted for v1.local, v2.local, ...
Local-scoped tokens means that the issuer is also the verifier, and you're storing encrypted data.
Public-scoped tokens means that the issuer is a third party, and therefore the contents are only needed to be signed.
- Is the footer always unencrypted?
Yes.
- Is the footer signed?
Yes, it is always authenticated.
- If you want the website frontend to see certain claims or data, would you advise putting that in a json objected in the footer, instead of into the body?
From the documentation:
Thus, if you want unencrypted, but authenticated, tokens, you can simply set your payload to an empty string and your footer to the message you want to authenticate.
Conversely, if you want to support key rotation, you can use the unencrypted footer to store the Key-ID.
If you want data to be unencrypted, but signed, in a local-only environment, you can dump everything in the footer and the payload can be empty.
- Is the footer validated against anything? Or is it just a grab bag of whatever I want to put in it, including nothing?
For local tokens, it is included in the authentication tag attached to the ciphertext. For public tokens, it's included in the signature calculation. This prevents attacks based on footer truncation or malleability.
However, beyond that, you can do whatever you want with it.
- Which claims are "built into the standard" and are expected to be validated or read by the implementing libraries?
This was being documented in the RFC draft. The Markdown source is available online, but at some point the compiled .txt output was erroneously removed from the Git repository. (Note to self: Re-add this.)
I've copied the table below in case the RFC changes so you can have a point-in-time copy for future reference:
Registered Claims
The following keys are reserved for use within PASETO. Users SHOULD NOT write arbitrary/invalid data to any keys in a top-level PASETO in the list below:
Key Name Type Example iss Issuer string {"iss":"paragonie.com"} sub Subject string {"sub":"test"} aud Audience string {"aud":"pie-hosted.com"} exp Expiration DtTime {"exp":"2039-01-01T00:00:00+00:00"} nbf Not Before DtTime {"nbf":"2038-04-01T00:00:00+00:00"} iat Issued At DtTime {"iat":"2038-03-17T00:00:00+00:00"} jti Token ID string {"jti":"87IFSGFgPNtQNNuw0AtuLttP"} kid Key-ID string {"kid":"stored-in-the-footer"} In the table above, DtTime means an ISO 8601 compliant DateTime string. See [#keyid-support] for special rules about
kidclaims.Any other claims can be freely used. These keys are only reserved in the top-level JSON object.
The keys in the above table are case-sensitive.
Implementors (i.e. library designers) SHOULD provide some means to discourage setting invalid/arbitrary data to these reserved claims.
For example: Storing any string that isn't a valid ISO 8601 DateTime in the
expclaim should result in an exception or error state (depending on the programming language in question).
We prefer ISO 8601 over UNIX Timestamps because of i18n and timezone issues.
- Should Paseto be used for sending session id's and non-confidential data about the user to the website frontend, to be stored in secure cookies? (ie: what most people use JWT's for)
See Was "Stateless Session Tokens" one of Paseto's Design Goals? from the documentation.
veqryn
paragonie-security
I became interested in your paseto standard after feeling a bit uneasy about JWT's, but I have a few questions and wasn't sure how else to ask but to make a github issue (feel free to add the answers to your documentation).
Is the body and its claims always encrypted? If not, when it is it not encrypted?
Is the footer always unencrypted?
Is the footer signed?
If you want the website frontend to see certain claims or data, would you advise putting that in a json objected in the footer, instead of into the body?
Is the footer validated against anything? Or is it just a grab bag of whatever I want to put in it, including nothing?
Which claims are "built into the standard" and are expected to be validated or read by the implementing libraries?
Should Paseto be used for sending session id's and non-confidential data about the user to the website frontend, to be stored in secure cookies? (ie: what most people use JWT's for)