search

ticarpi / jwt_tool

:snake: A toolkit for testing, tweaking and cracking JSON Web Tokens
GNU General Public License v3.0
5.47k stars 671 forks source link

key length VS hash length #25

Closed floyd-fuh closed 4 years ago

floyd-fuh commented 4 years ago

Thanks for the tool, it works very well. However, I was a little confused when I resigned a token with RS256 with a private key I had because the tool asked me for the key length. So i checked the private key and it was a key with a key length of 1024bit, but I was only able to choose from an option of 256, 384, 512: https://github.com/ticarpi/jwt_tool/blob/09fb9e5cab278ec08fd9a9b360f1d5f6e8d403d7/jwt_tool.py#L335 https://github.com/ticarpi/jwt_tool/blob/master/jwt_tool.py#L1035 So what you wanted to ask was the hash length (or signature length), because you will use it to determine the hash algorithm to use. Key length is something different.

ticarpi commented 4 years ago

Wow, how have I not noticed this?! Thanks for the issue, I'll clean that up in 1.3.x shortly to avoid confusing anyone else. Major version release in a few days and it'll be fixed there too. Cheers.

floyd-fuh commented 4 years ago

Indeed, RSA-256 would be awkwardly short :) Btw. I saw that there are probably some more places where you should clean up "RS" VS "RSA"

ticarpi commented 4 years ago

Thanks again, now fixed in v1.3.5

FWIW the refs in the code to "RS" are all used alongside "HS", "ES", "PS" as shorthand for the groupings of JWT alg (RS256, RS384 etc), which makes sense contextually as a prefix. I like this for brevity and readability, so more of a stylistic choice really.