1073589 - Use pyjwkest for all JWT tasks

Status: RESOLVED WONTFIX

(Marketplace Graveyard :: Code Quality, defect, P3)

Description

[Allen Short [:ashort]]

this will let us drop M2Crypto, for one thing.

Comment 1

[Kumar McMillan [:kumar]]

How so? The pyjwkest docs don't say that it supports RSA signing which is what we needed m2crypto for.

"This is Mozilla's fork of PyJWT which adds RSA algorithms, fixes some timing attacks, and makes a few other adjustments." ~ https://github.com/rtilder/pyjwt

Comment 2

[Allen Short [:ashort]]

Hmm, it has jwkest.jwk.RSAKey, which supports signing etc. I didn't look at the docs.

Comment 3

[Kumar McMillan [:kumar]]

it doesn't really have docs :) Well, that may work. We just need RSA signing for receipts.

Comment 4

[Kumar McMillan [:kumar]]

if the code is based on PyJWT we should also check it for the timing attack: https://github.com/rtilder/pyjwt/commit/02956549b59da49d9e785164f1115ff4194e9375

Comment 5

[Wil Clouser [:clouserw]]

(In reply to Allen Short [:ashort] from comment #0)
> this will let us drop M2Crypto, for one thing.

yesss

Comment 6

[Kumar McMillan [:kumar]]

Unassigning some repoman stuff until desktop payments is stable