Skip to content

Commit b8e13b2

Browse files
committed
Add key extraction to readme.
1 parent 2027073 commit b8e13b2

File tree

1 file changed

+12
-0
lines changed

1 file changed

+12
-0
lines changed

README.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,18 @@ sk.base64(b64)
9999

100100
When in doubt, invoking the `inject` method with a raw `Buffer` is always the safest way to make sure `paseto.js` employs the key properly.
101101

102+
##### Key Extraction
103+
104+
To extract raw keying material for storage, you may use either the `encode` or `raw` methods on key objects. The former returns the key material encoded in Base64 (url safe), the latter returns a `Buffer` with raw bytes.
105+
106+
```js
107+
const b64sk = sk.encode();
108+
```
109+
110+
The `inject` and associated methods discussed above then allow this keying material to be used for future token processing.
111+
112+
Secure handling and storage of keying material is outside the scope of the library.
113+
102114
##### V1 or V2
103115

104116
At present PASETO specifies two variants, `V1` and `V2`. Choosing between these is simple - always pick `V2`. The specification of `V1` is intended for when you do not have a choice, and legacy or non-technical considerations force the use of older, less efficient and secure cryptographic constructions. Whenever possible, it is _strongly recommended_ that `V2` is used. For more, see [here](https://github.com/paragonie/paseto/tree/master/docs/01-Protocol-Versions).

0 commit comments

Comments
 (0)