Comment

Comment by porpoisemonkey

This software attempts to determine the private key for the HMAC-SHA256 (HS256) signature algorithm.

The example provided has a private key length of 32 bits which is far too short to be secure. Based on the JSON Web Algorithms (RFC 7518) the key length must be at least the length of the output hash (256 bits) to be used in accordance with the standard.

> A key of the same size as the hash output (for instance, 256 bits for "HS256") or larger MUST be used with this algorithm.

https://tools.ietf.org/html/rfc7518

Discussion

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton