Why JWT alg HS512 is commented?

kepkin · July 3, 2018, 7:37am

Hello!

What’s the reason for commenting out hs512 algorithm for JWT? We would like to use it.

Kong/kong/blob/master/kong/plugins/jwt/jwt_parser.lua#L30


local string_sub = string.sub
local table_concat = table.concat
local setmetatable = setmetatable
local encode_base64 = ngx.encode_base64
local decode_base64 = ngx.decode_base64


--- Supported algorithms for signing tokens.
local alg_sign = {
["HS256"] = function(data, key) return openssl_hmac.new(key, "sha256"):final(data) end,
--["HS384"] = function(data, key) return openssl_hmac.new(key, "sha384"):final(data) end,
--["HS512"] = function(data, key) return openssl_hmac.new(key, "sha512"):final(data) end,
["RS256"] = function(data, key) return openssl_pkey.new(key):sign(openssl_digest.new("sha256"):update(data)) end,
["RS512"] = function(data, key) return openssl_pkey.new(key):sign(openssl_digest.new("sha512"):update(data)) end,
["ES256"] = function(data, key)
  local pkeyPrivate = openssl_pkey.new(key)
  local signature = pkeyPrivate:sign(openssl_digest.new("sha256"):update(data))


  local derSequence = asn_sequence.parse_simple_sequence(signature)
  local r = asn_sequence.unsign_integer(derSequence[1], 32)
  local s = asn_sequence.unsign_integer(derSequence[2], 32)
  assert(#r == 32)

thibaultcha · July 3, 2018, 9:24pm

Proposing a PR (with tests) that uncomments it should be fine

kepkin · July 4, 2018, 6:31pm