o1egl/paseto

Bind Keys to Version and Purpose

paragonie-security opened this issue · 0 comments

paseto/v2.go

Line 78 in f1000e3

func (*V2) Decrypt(token string, key []byte, payload, footer interface{}) error {

paseto/v2.go

Line 138 in f1000e3

func (*V2) Verify(token string, publicKey crypto.PublicKey, payload, footer interface{}) error {

See https://github.com/paseto-standard/paseto-spec/blob/master/docs/02-Implementation-Guide/03-Algorithm-Lucidity.md

Right now, byte arrays are accepted by this API. There's no mechanism to prevent a user from using a v2 public key as a v2 local key.