Skip to content

latchset/jwcrypto

This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

Folders and files

NameName
Last commit message
Last commit date
Apr 4, 2024
Feb 22, 2024
Jul 8, 2024
Jul 10, 2015
Dec 7, 2023
Feb 22, 2024
Mar 5, 2015
May 12, 2022
Feb 7, 2024
May 11, 2022
Dec 26, 2023
Oct 27, 2021
Feb 13, 2024
Feb 7, 2024

Repository files navigation

PyPI Changelog Build Status ppc64le Build Code Scan Documentation Status

JWCrypto

An implementation of the JOSE Working Group documents:

  • RFC 7515 - JSON Web Signature (JWS)
  • RFC 7516 - JSON Web Encryption (JWE)
  • RFC 7517 - JSON Web Key (JWK)
  • RFC 7518 - JSON Web Algorithms (JWA)
  • RFC 7519 - JSON Web Token (JWT)
  • RFC 7520 - Examples of Protecting Content Using JSON Object Signing and Encryption (JOSE)

Installation

pip install jwcrypto

Documentation

http://jwcrypto.readthedocs.org

Deprecation Notices

2020.12.11: The RSA1_5 algorithm is now considered deprecated due to numerous implementation issues that make it a very problematic tool to use safely. The algorithm can still be used but requires explicitly allowing it on object instantiation. If your application depends on it there are examples of how to re-enable RSA1_5 usage in the tests files.

Note: if you enable support for RSA1_5 and the attacker can send you chosen ciphertext and is able to measure the processing times of your application, then your application will be vulnerable to a Bleichenbacher RSA padding oracle, allowing the so-called "Million messages attack". That attack allows to decrypt intercepted messages (even if they were encrypted with RSA-OAEP) or forge signatures (both RSA-PKCS#1 v1.5 and RSASSA-PSS).

Given JWT is generally used in tokens to sign authorization assertions or to encrypt private key material, this is a particularly severe issue, and must not be underestimated.