aboutsummaryrefslogtreecommitdiffstats
path: root/util/paseto.lua
Commit message (Collapse)AuthorAgeFilesLines
* util.paseto: Do strict type check in pae() functionKim Alvefur2022-07-111-0/+3
| | | | | Fixes a test failure on Lua 5.4 where ipairs("") does not produce an error.
* util.paseto: Drop custom wrappers around key objectsMatthew Wild2022-07-111-46/+5
| | | | | | | | | | The PASETO spec recommends - no, *requires* - that implementations enforce type safety for keys, and e.g. do not pass them around as arbitrary byte strings. Typed wrapper objects are recommended. I originally followed this advice when starting the lib. However, key wrapping and type safety is now also a feature of util.crypto. All we're doing is duplicating it unnecessarily with this additional wrapper code.
* util.paseto: Export similar API to new util.jwt for ease and consistencyMatthew Wild2022-07-111-0/+21
|
* util.paseto: Error early on invalid keysMatthew Wild2022-07-111-0/+2
|
* util.paseto: Fix to decode footer before comparisonMatthew Wild2022-07-111-0/+1
|
* util.paseto: Implementation of PASETO v4.public tokensMatthew Wild2022-06-241-0/+123
PASETO provides an alternative to JWT with the promise of fewer implementation pitfalls. The v4.public algorithm allows asymmetric cryptographically-verified token issuance and validation. In summary, such tokens can be issued by one party and securely verified by any other party independently using the public key of the issuer. This has a number of potential applications in a decentralized network and ecosystem such as XMPP. For example, such tokens could be combined with XEP-0317 to allow hats to be verified even in the context of a third-party MUC service.