Add version byte to token format
hgmnz opened this issue · 2 comments
hgmnz commented
- Start with
0x80
, per #6 (comment) - Fernet code should reject formats it cannot handle.
kr commented
The proposed format is:
VERSION(1 byte) + HMAC (32b) + TIMESTAMP (8b) + IV (16b) + ciphertext
where the hmac is computed on
version + timestamp + iv + ciphertext
This makes me a little sad, since I'd prefer if the hmac input were also
exactly present in the token. It would be a little easier to compute and
verify that way.
Here's another possible approach to format changes:
Don't explicitly represent the "version" at all in the token, just try all
supported formats one by one. If any verifies, return success.
What do you think?
cc @tmaher
hgmnz commented
done