Weave Code
Jwt Encryption Algorithm Pbes2 Laravel Package
web-token/jwt-encryption-algorithm-pbes2
Adds PBES2 password-based encryption algorithms for JWT/JWE in the web-token stack. Enables PBES2-HS256+A128KW, PBES2-HS384+A192KW and PBES2-HS512+A256KW support for secure key wrapping when encrypting tokens.
[READ ONLY] PBES2 Based Key Encryption Algorithms
Frequently asked questions about Jwt Encryption Algorithm Pbes2
- How do I integrate this PBES2 package with Laravel’s tymon/jwt-auth for JWT encryption?
- First, install the package via Composer: `composer require web-token/jwt-encryption-algorithm-pbes2 web-token/jwt-framework`. Then, configure your JWT auth provider to use PBES2 algorithms (e.g., `PBES2-HS256+A128KW`) in the token generation/validation logic. Override the default algorithm in your `JWTAuth` configuration or middleware to pass the PBES2 algorithm string. Ensure your password-derived key (PDK) is securely stored and passed during token creation.
- Which Laravel versions officially support this PBES2 package?
- This package is PHP 8.0+ compatible, so it works with Laravel 9.x, 10.x, and 11.x. However, Laravel’s built-in JWT libraries (like `tymon/jwt-auth`) may require manual adjustments to support PBES2 algorithms. Test thoroughly in your Laravel version, as no official Laravel-specific documentation exists for this package.
- What are the performance implications of using PBES2 for JWT encryption in production?
- PBES2 is computationally heavier than AES-GCM or RSA-OAEP due to its iterative key derivation process. Benchmark your token generation/validation latency in staging, especially for high-throughput APIs. Consider caching derived keys for short-lived tokens or using PBES2 only for long-lived tokens (e.g., admin sessions) where security outweighs performance costs.
- Can I use this package with laravel/sanctum for API token encryption?
- While `laravel/sanctum` primarily uses Laravel’s session-based auth, you can integrate this PBES2 package by extending Sanctum’s custom token logic. Override Sanctum’s token generation/validation methods to use `web-token/jwt-framework` with PBES2 algorithms. Note that Sanctum doesn’t natively support JWT encryption, so this requires custom middleware or service providers.
- How do I configure PBES2 parameters like iteration count or salt length for RFC 8037 compliance?
- The package follows RFC 8037 defaults, but you can customize parameters by configuring the `Pbes2` algorithm class directly. Set values like `iterationCount` (e.g., 10000) and `saltLength` (e.g., 16 bytes) during key derivation. Validate these against your security policy, as higher iteration counts improve security but increase latency. Document your choices for audit compliance.
- Are there alternatives to PBES2 for password-derived key encryption in Laravel?
- Yes. For modern systems, consider Argon2id (via `paragonie/sodium_compat`) for key derivation, paired with AES-GCM for encryption. PBES2 is legacy-focused (e.g., FIPS 140-2 compliance) and lacks post-quantum resistance. If compliance isn’t mandatory, AES-256-GCM or RSA-OAEP with a key derived via Argon2 may offer better performance and future-proofing.
- How do I securely store and rotate password-derived keys (PDKs) for PBES2 in Laravel?
- Never hardcode PDKs. Use Laravel’s `.env` files for development or a dedicated Key Management System (KMS) like AWS KMS or HashiCorp Vault in production. Rotate keys by generating new PDKs, re-encrypting existing tokens with the new key, and phasing out old keys. Implement a secure key derivation process (e.g., using `password_hash()` with a unique salt) to avoid brute-force risks.
- Does this package support token pre-encryption (client-side) or only server-side PBES2?
- This package works for both client-side and server-side PBES2 encryption, but the implementation depends on your JWT library. For client-side encryption, ensure your frontend uses a compatible JWT library (e.g., `web-token/jwt-framework` in JavaScript) to generate PBES2-encrypted tokens. Server-side, use Laravel middleware or services to validate PBES2 tokens. Document your workflow to avoid mismatches in algorithm parameters.
- How can I test PBES2 JWT tokens for interoperability with other systems?
- Use RFC 8037 test vectors to validate your implementation. Generate tokens with known inputs (e.g., specific passwords, salts, and iteration counts) and verify them against expected outputs. Test with multiple JWT libraries (e.g., `lucadegasperi/oauth2-server`) to catch edge cases. For Laravel, mock the JWT auth provider in PHPUnit to isolate PBES2 logic from other dependencies.
- What maintenance risks should I consider before adopting this low-starred package?
- The package has limited adoption (3 stars), so monitor for updates or forks. Engage the maintainer for long-term support or prepare to fork the repo if critical bugs arise. Check for OpenSSL dependencies (required but typically enabled in Laravel) and test for PHP version compatibility. Subscribe to PHP cryptography announcements, as PBES2 may become obsolete if newer standards (e.g., libsodium-based schemes) gain traction.
Weaver
How can I help you explore Laravel packages today?