ed25519-unsafe-libs
List of unsafe ed25519 signature libs (by MystenLabs)
paseto
Platform-Agnostic Security Tokens (by paragonie)
ed25519-unsafe-libs | paseto | |
---|---|---|
5 | 26 | |
212 | 3,187 | |
-0.5% | -0.2% | |
3.8 | 4.7 | |
6 months ago | 13 days ago | |
Rust | PHP | |
MIT License | GNU General Public License v3.0 or later |
The number of mentions indicates the total number of mentions that we've tracked plus the number of user suggested alternatives.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
ed25519-unsafe-libs
Posts with mentions or reviews of ed25519-unsafe-libs.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2022-07-04.
-
Is my transaction signature system secure for my blockchain? (audit)
I tried to explain to you last time you asked about "your own crypto" that the answer always will be "it's not good, don't do it". First thing that strikes me is that you take public key from the provided data, which suggests a trivial attack like in https://github.com/MystenLabs/ed25519-unsafe-libs
- Vulnerability in the elliptic curve lib used by Trezor (among others)! Has this been disclosed by Trezor team?
- List of unsafe ed25519 signature libs
-
Initial impact report about this week's EdDSA Double-PubKey Oracle attack in 40 affected crypto libs
original findings and audit report by MystenLabs' Cryptography Chief + continuously updated list of affected libs: https://github.com/MystenLabs/ed25519-unsafe-libs
-
40 unsafe ed25519 libs where private key can be leaked via signing api misuse
TL;DR A new audit report revealed that the signing api of many ed25519 libs (some of them very popular) unfortunately expects a public key as input. An attacker may extract the private key by requesting two different signatures for the same message and private key, but on purpose for a different public key. Applications should not expose this api publicly and should refactor it to protect devs against accidental api misuse. Read more: https://github.com/MystenLabs/ed25519-unsafe-libs and https://blog.safeheron.com/blog/safeheron-originals/analysis-on-ed25519-use-risks-your-wallet-private-key-can-be-stolen
paseto
Posts with mentions or reviews of paseto.
We have used some of these posts to build our list of alternatives
and similar projects. The last one was on 2023-12-02.
-
JSON Web Proofs
Might I suggest Paseto (https://paseto.io/) - it solves a lot of the headaches of JWT. Signing and encryption are two different things that require two different sets of keys, so you can't mess it up.
(Full disclosure, I've written one implementation: https://github.com/auth70/paseto-ts)
-
Full-stack authentication system using rust (actix-web) and sveltekit
Though we'll be building a session-based authentication system, it's noteworthy that with the introduction of some concepts which will be discussed in due time, you can turn it into JWT- or, more securely and appropriately, PASETO-based authentication system.
- Biscuit 3.0
-
Securing Your Golang Application: Unleashing the Power of Authentication and Authorization
Time we ditch it and use paseto
- Paseto is everything you love about JWT without any of the design deficits
- Why JWTs Suck as Session Tokens (2017)
-
Looking for advice for Go Backend REST API for a Front End React/NodeJS
The PASETO web site goes over it. Mostly it's designed to make you do things the right way and avoid all the security holes you can fall into with JWT.
- Initial impact report about this week's EdDSA Double-PubKey Oracle attack in 40 affected crypto libs
-
Stop Storing Authentication Tokens in JS-accessible Storage
If this is too much to handle, you shouldn't have to! There's already solutions that handle it for you