Hellow guys, Welcome to my website, and you are watching HS256 vs RS256 with JSON Web Tokens (JWTs). and this vIdeo is uploaded by Jan Goebel at 2021-10-04T06:00:28-07:00. We are pramote this video only for entertainment and educational perpose only. So, I hop you like our website.
| Name | HS256 vs RS256 with JSON Web Tokens (JWTs) |
| Video Uploader | Video From Jan Goebel |
| Upload Date | This Video Uploaded At 04-10-2021 13:00:28 |
| Video Discription | 🔥More exclusive content: https://productioncoder.com/you-decide-what-we-build-next Twitter: https://twitter.com/_jgoebel Website: https://jangoebel.com Blog: https://productioncoder.com 00:00 Difference between HS256 and RS256 in JWTs 01:35 RS256 and asymmetric cryptosystems 02:48 RS256 provides non-repudiation 03:50 conclusion When you are working with JSON Web Tokens (JWTs), you might ask yourself which algorithm you should use to create the digital signature or the MAC at the end of the token. HS256 uses HMAC and SHA-256 under the hood. So HS256 basically just means creating an HMAC with a particular secret by using the SHA256 function. RS256 means that you use the asymmetric RSA cryptosystem together with SHA256. Contrary to HS256, you create a digital signature with RS256 whereas with HS256 you only generate a MAC (Message Authentication Code). RS256 With HMAC, you need to have a shared secret. This means that to create an HMAC you need to know the secret and in order to validate an HMAC, you need to know the same secret as well. This can sometimes be a problem in case the entity that creates the token and the entity that verifies the token don't trust each other. To mitigate this, you can use RS256 or ES256. With RS256 and ES256 you generate a key pair with a private and a public key. You can only create a digital JWT signature with a private key. However you can verify the digital signature with the public key pair. This has the advantage that you do not need to share a secret with a party that you don't trust. And even if you do trust the verifying party (which you never should anyway), using a digital signature based JWT follows the principle of "need to know": only the party that creates the token knows the private key. If you have the choice, you should run with ES256 because it is based on a harder mathematical problem and you can have similar security guarantees like RSA but with much shorter key sizes |
| Category | Education |
| Tags | hs256 vs rs256 | hs256 vs hs512 | hs256 jwt attack | hs256 jwt exploit | rs256 | rs256 jwt | rs256 algorithm | jwt rsa 256 | rsassa-pkcs1-v1_5 | jws rs256 | json web tokens tutorial | jwt token | jwt mac key | jwt signature verification |
