The Core of your Trust Infrastructure … Access Tokens

We are increasingly moving to trust infrastructures that are based on claims to the usage of services, and these are granted with signed tokens that provide access. The trust level is defined by the entity that signed the token.

For a JWT token, we can either sign with a MAC (Message Authentication Code) or use public key encryption (EC or RSA). As an introduction, here are the basic methods:

• HMAC signing: https://asecuritysite.com/jwt/tink_jwt2
• EC (Elliptic Curve) signing: https://asecuritysite.com/jwt/tink_jwt
• RSA signing: https://asecuritysite.com/tokens/jwt2

What’s a token?

Do you know the difference between a MAC (Message Authentication Code) and public key signing? Well a MAC uses a secret key that is shared between Bob and Alice, while public key signing involves Bob signing with his private key, and Alice proving the signature with his public key. Overall, public key signing of tokens is generally more secure and trust, but has the overhead of needing to distribute the public key. Many organisations use a MAC approach to signing tokens, but if Eve discovers the shared secret key, there can be a significant loss of trust.