New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bind Keys to Version and Purpose #14

Closed

paragonie-security opened this issue Aug 5, 2021 · 1 comment · Fixed by #15

paragonie-security commented Aug 5, 2021

pasetors/src/version2.rs

Line 162 in fa3360d

secret_key: &[u8],

See https://github.com/paseto-standard/paseto-spec/blob/master/docs/02-Implementation-Guide/03-Algorithm-Lucidity.md

Right now, byte arrays are accepted by this API. There's no mechanism to prevent a user from using a v2 public key as a v2 local key.

Owner

brycx commented Aug 5, 2021

Thanks for the suggestion @paragonie-security. This sounds like a good idea.

I'll include this in the next release.

brycx mentioned this issue

Implement version 4 and add algorithm lucidity #15

Merged

brycx closed this as completed in #15

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment