[rjzzleep]

Wasn't there an issue with JWT that was summarized as this:

"This is a good idea, but it doesn't solve the underlying problem: attackers control the choice of algorithm" ?

Here's another quote from the Wireguard paper[1]:

"Finally, WireGuard is cryptographically opinionated. It intentionally lacks cipher and protocol agility. If holes are found in the underlying primitives, all endpoints will be required to update"

[1]: https://www.wireguard.com/papers/wireguard.pdf

[benjaminjackman]

Sorry I wasn’t suggesting allowing any algorithm to be used just whichever one was chosen next it be encoded in a way that if it needs to be replaced again it could, and also if possible that numeric id for that algorithm be standardized beyond just git.

https://github.com/multiformats/multihash/blob/master/README...

[abritinthebay]

That’s only true of JWT if you allow your server to accept all algorithms.

You don’t actually have to.

[rblatz]

Correct, your token authority should specify which algorithms are valid, and your clients should self configure via a secure back channel to only accept the algorithms your token authority issues.

[abritinthebay]

Exactly! JWT is a much misunderstood system it seems. Though it doesn’t exactly help itself by being quite complex