Developers - Critical flaw alert! Stop using JSON encryption

Well, you know a patch/fix is forthcoming. When is the question? This sounds VERY nasty.

A vulnerability in a JSON-based web encryption protocol could allow attackers to retrieve private keys. Cryptography experts have advised against developers using JSON Web Encryption (JWE) in their applications in the past, and this vulnerability illustrates those very dangers.

Software libraries implementing the JWE, or RFC 7516, specification suffer from a classic Invalid Curve Attack, wrote Antonio Sanso, a senior software engineer at Adobe Research Switzerland and part of the Adobe Experience Manager security team. The JSON Web Token (JWT) is a JSON-based open standard defined in the OAuth specification family used for creating access tokens, and JWE is a set of signing and encryption methods for JWT. Developers using JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) are affected. 

Read more.

Da Boss!

Website: www.digitalsmind.com Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

Latest Content

  • Windows Patch Cleaner
    Written by
    Windows Patch Cleaner This is one of those utilities I will be installing…
    Read more...
  • The Coolest Thing On Instagram I Have Ever Seen
    Written by
    The Coolest Thing On Instagram I Have Ever Seen Honestly, this might he coolest thing I have ever seen…
    Read more...
  • Retired Husband (Humor) WalMart is Involved.
    Written by
    Retired Husband (Humor) WalMart is Involved. It's been a REALLY crappy week so far and this…
    Read more...
  • Outlook known issues in the June 2017 security updates
    Written by
    Outlook known issues in the June 2017 security updates Well folks, these issues cover every version of Outlook back…
    Read more...
  • Steam Summer Sale Confirmed - 6-22-17 - 1:00 PM EST
    Written by
    Steam Summer Sale Confirmed - 6-22-17 - 1:00 PM EST Find Visa wife doesn't know about? - check! 
    Read more...

Visit the Digitalsmind Video YouTube Page!

Did you know we have a video page on YouTube? 

Well... WE DO! 

Check us out! 

- Our Video page.