DEF CON 26 CRYPTO AND PRIVACY VILLAGE - Scott Arciszewski - No Way JOSE! Designing Cryptography
DEFCONConference2 HN recommenders · recommended in 2 months, 2019–2020
talk · intermediate · evergreen · 2019–2020 on HN
Scott Arciszewski's DEF CON 26 Crypto and Privacy Village talk critiquing the JOSE standards (JWT, JWS, JWE) and showing how to design cryptographic tokens more safely.
HN recommends it as the video version of the argument that JOSE/JWT is a flawed standard, and as a help in understanding token design choices.
Up next
6 mo on HNThe more general uncertainty principle, regarding Fourier transforms
3Blue1Brown
7 HN recommender · 2019–2025
11 mo on HN🚀 TDD, Where Did It All Go Wrong (Ian Cooper)
DevTernity Conference
11 HN recommender · 2018–2024
11 mo on HNBehind the Scenes of iOS Security
Black Hat
9 HN recommender · 2016–2026
11 mo on HNWhy Electronic Voting Is Still A Bad Idea
Tom Scott
11 HN recommender · 2020–2026
11 mo on HNBut how does bitcoin actually work?
3Blue1Brown
15 HN recommender · 2017–2024
8 mo on HNDiffie-Hellman Key Exchange
Art of the Problem
9 HN recommender · 2016–2024
7 mo on HNBlackHat USA 2011: SSL And The Future Of Authenticity
Christiaan008
9 HN recommender · 2011–2017
8 mo on HNBlockchains Are a Bad Idea (James Mickens)
HBS Digital Initiative
8 HN recommender · 2018–2023
6 mo on HNLine Goes Up – The Problem With NFTs
Folding Ideas
12 HN recommender · 2022–2026
7 mo on HNTheory and Practice of Cryptography
Google TechTalks
5 HN recommender · 2011–2019
6 mo on HNWhy Electronic Voting is a BAD Idea - Computerphile
Computerphile
7 HN recommender · 2015–2025
5 mo on HNThe Future is a Dead Mall - Decentraland and the Metaverse
Folding Ideas
6 HN recommender · 2023–2025
3 comments from Hacker News
I've been doing a similar thing recently. I found PASETO to be interesting ( link ), which is a lot like JWT but is simpler and more opinionated (e.g. there is no plaintext option; symmetric and asymmetric operations are cleanly separated; etc.). I especially enjoyed watching this video ▶ this video I still decided to go with JWT, since PASETO isn't yet standard and its software hasn't been around for long, but it definitely helped me understand more about the choice I was making. In particular, PASETO distinguishes between "local" tokens (producer and consumer can both use the same symmetric key) versus "public" tokens (producer and consumer can't use the same key, e.g. third party services run by different organisations; hence asymmetric keys are needed). PASETO encourages local tokens to be used when possible, since their keys can be shorter, they generate shorter tokens, they're faster to encrypt/decrypt, they're easier to rotate, etc.; public tokens are essentially a last resort when we must interact with a third party. I was originally considering 'public' JWTs (i.e. asymmetric keys) for my use case, since we're using AWS API Gateway and that has the option to check the signatures of 'public' JWTs, and reject invalid ones before they ever hit my code. However, I eventually went with 'local' JWTs (i.e. symmetric keys), since the convenience of having AWS discard some tokens for us wasn't worth the (mostly logistical) overhead of using asymmetric keys. My choice to use the J
If you like video consumption, a DEFCON 2018 talk by the author Scott Arciszewski on this same topic can be found here: No Way JOSE! Designing Cryptography: ▶ this video You're welcome :) Edit: Clarify that Scott is the author of both post and video.
Blog post: link DEFCON CPV talk: link + ▶ this video Alternative design that isn't radioactive: link Apologies if this wasn't more readily available or commonly known. I'm worse at marketing than I am at engineering.