Authentication with JWT with Symmetric and Asymmetric encryption (Part 2)

Tram Ho

In the previous article , we learned about the basic knowledge and working mechanism of JWT. In this article, we will continue to learn together about the part that I think is the best when it comes to JWT, which is applying Symmetric Encryption and Asymmetric Encryption in JWT authentication.

I will use NodeJS and MongoDB to implement the encryption for JWT. As for the idea, how to apply, you can use any programming language.

JWT Authentication with Symmetric Encryption and Asymmetric Encryption

1. JWT Authentication with Symmetric Encryption

Symmetric encryption is a method of encrypting data that uses the same key to both encrypt and decrypt information.
This method is probably no stranger to you when you first come into contact with JWT.

The basic implementation is as follows:

z4224827978942_f37dc2546f9e320d7d8b34ba37bbef00.jpg

For this implementation, we create a JWT with a payload containing information about the userid and email.

  1. We use the jwt method. sign () to encrypt this information with the key secretKey and the lifetime of the token is 1 hour.
  2. Then we use the jwt. verify () to authenticate the JWT with the key secretKey and get the information.

Please refer to the GIT source code here.

B1: Import the library and initialize secretKey

B2: Create JWT . constructor

B3: Create JWT . authentication function

B4: Check the results

  • Advantages :
    • Easy to do because it uses a single key to both encrypt and decrypt information.
    • Reduces pressure on the server side as there is no need to save any additional data for authentication.
  • Cons : Not safe because when hackers steal that key, it will be easy to create fake JWTs, which can access and attack the application.

2. JWT Authentication with Asymmetric Encryption

Asymmetric encryption uses two different keys ( public key and private key ) to encrypt and decrypt information. In it, the public key is shared with everyone and the private key is kept secret.

  • The private key is used to encrypt (sign) the information that generates the JWT.
  • The public key is used to decrypt (verify) that JWT, not the other way around. So even if the hacker gets the Public key, he can’t create a fake JWT to access the application.

The implementation method is as follows:

feef4e0f664dba13e35c.jpg

For this implementation, we create a JWT with a payload containing information about the userid and email

  1. We use MongoDB to create a KeyToken table that stores the userId and publicKey.
  2. Generate 2 keys privateKey and publicKey using rsa algorithm through crypto library.
  3. We use the jwt method. sign () to encrypt this information with the privateKey and the token’s lifetime is 1 hour.
  4. We use the jwt method. verify () to authenticate the JWT with the publicKey and get the information.

Please refer to the GIT source code here.

B1: Initialize MongoDB connection

B2: Create a table (collection) Key to store Public key

B3: Create function genToken. In the function handle 2 things: Save public key to DB + Use privateKey to encrypt to create JWT

B4: Create validateToken function to handle validation JWT: Get publicKey from DB + Verify token from publicKey.

B5: Check the results

  • Cons : Having to save more Public key to the DB and access to the DB to get the Public key when needing to authenticate, leading to performance impact. However, it is possible to improve performance by using a Cache like MemoryCache or RedisCache.
  • Advantages :
    • Although it increases the pressure on the server when it has to save more Public keys to the DB and retrieve it when it needs to be authenticated, it helps our system increase security a lot.
      (Because as I said above, even if the hacker can read the Public key information from the DB, it is not possible to create a fake JWT to access the application because the Private key is only used to encrypt (sign) the information to create the JWT, Public key is only used to decrypt JWT to get information, not vice versa .
    • Solve some disadvantages of JWT as I have shown you in part 1:
      1. Regarding the issue of security risks, when applying the asymmetric encryption method, we can be completely assured because the security has been much improved (I explained above).
      2. As for the issue of Can’t cancel token and No session management support, then when applying this method, since we have stored publicKey in DB, it’s better to simply cancel token or cancel user’s login session simple, we just need to delete that publicKey from the DB.

Please refer to the GIT source code here.

Conclude

To summarize a bit, when you apply symmetric encryption to JWT, it will be easier to do and the server does not need to save any more information for authentication, thereby increasing performance, but reducing security. because hackers only need to get the sercetKey to be able to fake JWT to access the system. When applying asymmetric encryption, we need to store more publicKeys in the DB, which can reduce performance a bit, but in return it helps us to increase security a lot.

If you have any suggestions or discussions, please comment below the article. Tks all!!!

Share the news now

Source : Viblo