Abusing JWT public keys without the public key(blog.silentsignal.eu)

2 pointsby dnetvor 5 Jahren2 comments

blog.silentsignal.eu

Abusing JWT public keys without the public key

https://blog.silentsignal.eu/2021/02/08/abusing-jwt-public-keys-without-the-public-key/

2 comments

> The main lesson is: one should not rely on the secrecy of public keys

... that might be why they are called "public" keys

dnetvor 5 Jahren

Yet we've had people argue that they wouldn't give us the public part of their JWT RSA signing keypair, because "they wouldn't publish that anyway", hence this post.