Promoting Misuse-Resistance in PASETO Libraries
September 16, 2021 by P.I.E. Staff
Last month, Thomas Ptacek wrote API Tokens: A Tedious Survey on the fly.io blog, which talks about all things API Token.
His post covered JWT, PASETO (our design), and a few other token formats. He went on to clarify, on Hacker News, that:
The one thing I'm not super comfortable about here is my PASETO take. My attitude going in was that PASETO has a lot of boosters and not a lot of critical takes. I can beat up on Macaroons because we're using them, and I'm going to follow up with a post about what our Macaroons like like. I'm not doing that with PASETO. So, like, I stand by it, but take it for what it's worth.
What was his take, exactly? Our succinct understanding of the criticisms laid out in the fly.io article are as follows:
- There are too many versions; the old ones should be deprecated.
- PASETO's specification spells out how to avoid algorithm confusion for implementors.
- Decide between symmetric and asymmetric; don't support both use-cases.
- NIST algorithm support and CFRG involvement are unnecessary and possibly counterproductive.
Out of these criticisms, the first two are actionable and warrant further inspection, while the latter are Thomas's opinion.
Continue Reading this Blog Post »
