Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

use correct hash algorithms in PBES2-HS384+A192KW and PBES2-HS512+A256KW #33

Closed
overheadhunter opened this issue Apr 25, 2024 · 1 comment

Comments

@overheadhunter
Copy link

overheadhunter commented Apr 25, 2024

Currently, SHA-256 seems to be hardcoded in the KDF:

jwt-webtool/src/js/app.js

Lines 274 to 278 in 03fd42c

return jose.JWA.derive(
"PBKDF2-SHA-256",
Buffer.from(keyvalue, "utf-8"),
kdfParams
);

However, the RFC specifically asks for SHA-384 and SHA-512 respectively, not just different key lengths.

@DinoChiesa
Copy link
Owner

Ahhh, thank you for the bug report.
Fixed in this commit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants