Conversation

Notices

1. Embed this notice
   Erin 💽✨ (erincandescent@akko.erincandescent.net)'s status on Monday, 23-Dec-2024 05:13:37 JST Erin 💽✨

   I find myself working with JOSE (not my choice, protocol dictates :<) at the moment and I’m slowly going insane at the levels of recursive base64 involved :floofWoozy:

   e.g. if you end up doing signed-and-encrypted JWTs you end up with base64(encrypt(base64(json)))

   • Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Erin 💽✨ (erincandescent@akko.erincandescent.net)'s status on Monday, 23-Dec-2024 06:21:32 JST Erin 💽✨

     in reply to

     JSON and Cryptography: It’s not a good mix.

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Erin 💽✨ (erincandescent@akko.erincandescent.net)'s status on Monday, 23-Dec-2024 06:21:33 JST Erin 💽✨

     in reply to

     Of course the signing key’s ID is base64 of a truncated sha256 hash so that bit ends up being base64(encrypt(base64(json(base64(truncated-hash))))) :floofWoozy:

   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Monday, 23-Dec-2024 06:22:12 JST Haelwenn /элвэн/ :triskell:

     in reply to
     @erincandescent At least no JSON canonization *hisses towards LD Signatures*.
   • Embed this notice
     soc (soc@chaos.social)'s status on Monday, 23-Dec-2024 06:22:22 JST soc

     in reply to

     @erincandescent When you look at shit and it has %3D%3D%3D at the end and you realize people couldn't even bother to disable padding...

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Monday, 23-Dec-2024 06:23:21 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • Haelwenn /элвэн/ :triskell:
     @erincandescent Also I hope the hash doesn't matters much because truncating hashes is an awful idea.
   • Embed this notice
     Erin 💽✨ (erincandescent@akko.erincandescent.net)'s status on Monday, 23-Dec-2024 07:43:50 JST Erin 💽✨

     in reply to

     • Haelwenn /элвэн/ :triskell:

     @lanodan in this case its just the hash of the key fingerprint in order to generate a probablistically unique key ID. It doesn’t even need to be unique, duplicates just mean multiple trial verifications until the recipient finds the right key.

     Haelwenn /элвэн/ :triskell: likes this.