Skip to content

Utility to find the best alg for a given key #49

Open
@azmeuk

Description

@azmeuk

I was wondering if this was interesting to add an utility to JWSRegistry and JWERegistry that would guess the alg for a given key, depending on criterias such as security or the fact that the algo is recommended. I was thinking of something in this fashion:

>>> key = jwk.RSAKey.generate_key(2048)
>>> reg = jws.JWSRegistry(algorithms=["HS256", "RS256", "RS384", "RS512"])
>>> reg.find_alg(key, strategy=JWSRegistry.recommended_algs)
"RS256"
>>> reg.find_alg(key, strategy=JWSRegistry.most_secure_algs)
"RS512"
>>> reg.find_alg(key, strategy=user_defined_strategy)
...

Maybe the strategy could even be attached to the registry, so the alg encode header could be optional when a registry is used:

>>> reg = jws.JWSRegistry(algorithms=["HS256", "RS256", "RS384", "RS512"], strategy=JWSRegistry.most_secure_algs)
>>> jwt.encode(None, {"foo", "bar"}, key, registry=reg)

What do you think?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions