joserfc icon indicating copy to clipboard operation
joserfc copied to clipboard

Utility to find the best `alg` for a given key

Open azmeuk opened this issue 9 months ago • 0 comments

I was wondering if this was interesting to add an utility to JWSRegistry and JWERegistry that would guess the alg for a given key, depending on criterias such as security or the fact that the algo is recommended. I was thinking of something in this fashion:

>>> key = jwk.RSAKey.generate_key(2048)
>>> reg = jws.JWSRegistry(algorithms=["HS256", "RS256", "RS384", "RS512"])
>>> reg.find_alg(key, strategy=JWSRegistry.recommended_algs)
"RS256"
>>> reg.find_alg(key, strategy=JWSRegistry.most_secure_algs)
"RS512"
>>> reg.find_alg(key, strategy=user_defined_strategy)
...

Maybe the strategy could even be attached to the registry, so the alg encode header could be optional when a registry is used:

>>> reg = jws.JWSRegistry(algorithms=["HS256", "RS256", "RS384", "RS512"], strategy=JWSRegistry.most_secure_algs)
>>> jwt.encode(None, {"foo", "bar"}, key, registry=reg)

What do you think?

azmeuk avatar May 01 '25 10:05 azmeuk