Developers - Critical flaw alert! Stop using JSON encryption

Well, you know a patch/fix is forthcoming. When is the question? This sounds VERY nasty.

A vulnerability in a JSON-based web encryption protocol could allow attackers to retrieve private keys. Cryptography experts have advised against developers using JSON Web Encryption (JWE) in their applications in the past, and this vulnerability illustrates those very dangers.

Software libraries implementing the JWE, or RFC 7516, specification suffer from a classic Invalid Curve Attack, wrote Antonio Sanso, a senior software engineer at Adobe Research Switzerland and part of the Adobe Experience Manager security team. The JSON Web Token (JWT) is a JSON-based open standard defined in the OAuth specification family used for creating access tokens, and JWE is a set of signing and encryption methods for JWT. Developers using JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) are affected. 

Read more.

Da Boss!

Website: www.digitalsmind.com Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

Latest Content

  • Remote Server Administration Tools for Windows 10
    Written by

    Da Boss!

    Remote Server Administration Tools for Windows 10 Download away!
    Read more...
  • How to make use of (Microsoft) Edge’s nifty reading features
    Written by

    Da Boss!

    How to make use of (Microsoft) Edge’s nifty reading features Not a fan of the Edge browser myself but a…
    Read more...
  • Whats new in Windows 10 Bash/WSL & Windows Console
    Written by

    Da Boss!

    Whats new in Windows 10 Bash/WSL & Windows Console I love how Microsoft is embracing Open Source with Windows 10.…
    Read more...
  • Activision announces 'Call Of Duty: World War II'
    Written by

    Da Boss!

    Activision announces 'Call Of Duty: World War II' So, it seems we are headed back to WW II…
    Read more...
  • WD Purple 1TB Surveillance Hard Disk Drive - 39.99 - WOOT Deal
    Written by

    Da Boss!

    WD Purple 1TB Surveillance Hard Disk Drive - 39.99 - WOOT Deal Only 15 hours left so if you want one you…
    Read more...

Visit the Digitalsmind Video YouTube Page!

Did you know we have a video page on YouTube? 

Well... WE DO! 

Check us out! 

- Our Video page.