DEV Community

Discussion on: JWTs: Which Signing Algorithm Should I Use?

Collapse
 
jillesvangurp profile image
Jilles van Gurp

Yeah my point is that is only the case when you can control who uses your tokens. When you can't, you have to assume at least some users will be unable to use EdDSA.

IMHO the cryptographic arguments for preferring that over ECDSA in the context of authentication/authorization use cases are not that compelling. When we are talking about protecting financial assets stored in a blockchain, you want the strongest thing humanly possible; which is probably why they picked it. Or put differently, if somebody is trying to break crypto to hack your JWTs, you have some interesting other problems to worry about probably.