JWCrypto
An implementation of the JOSE Working Group documents:
- RFC 7515 - JSON Web Signature (JWS)
- RFC 7516 - JSON Web Encryption (JWE)
- RFC 7517 - JSON Web Key (JWK)
- RFC 7518 - JSON Web Algorithms (JWA)
- RFC 7519 - JSON Web Token (JWT)
- RFC 7520 - Examples of Protecting Content Using JSON Object Signing and Encryption (JOSE)
Installation
pip install jwcrypto
Documentation
http://jwcrypto.readthedocs.org
Deprecation Notices
2020.12.11: The RSA1_5 algorithm is now considered deprecated due to numerous implementation issues that make it a very problematic tool to use safely. The algorithm can still be used but requires explicitly allowing it on object instantiation. If your application depends on it there are examples of how to re-enable RSA1_5 usage in the tests files.
Note: if you enable support for RSA1_5 and the attacker can send you chosen
ciphertext and is able to measure the processing times of your application,
then your application will be vulnerable to a Bleichenbacher RSA padding
oracle, allowing the so-called "Million messages attack". That attack allows
to decrypt intercepted messages (even if they were encrypted with RSA-OAEP) or
forge signatures (both RSA-PKCS#1 v1.5 and RSASSA-PSS).
Given JWT is generally used in tokens to sign authorization assertions or to encrypt private key material, this is a particularly severe issue, and must not be underestimated.
3 maintainers
Metadata
3 maintainers
Release files for jwcrypto 1.6.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| jwcrypto-1.6.1.tar.gz | 116.3 kB | Without provenance | Details for jwcrypto-1.6.1.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| jwcrypto-1.6.1-py3-none-any.whl | Python 3 | none | any | Details for jwcrypto-1.6.1-py3-none-any.whl |
Total release size: 237.6 kB
Release files / jwcrypto-1.6.1.tar.gz
| Download URL | jwcrypto-1.6.1.tar.gz |
|---|---|
| Size | 116.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
a1e1570da5c2e35dbcd375ec1d2891a24de8eb35ee2c1fe8e91978efb72cfe90
|
|
BLAKE2b-256 checksum How to use checksums |
138fe802d77957903483129813ce6fa01a72a906f9cdd454039d1ec1e6d1e44a
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Release files / jwcrypto-1.6.1-py3-none-any.whl
| Download URL | jwcrypto-1.6.1-py3-none-any.whl |
|---|---|
| Size | 121.3 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
77e856818e514cb3d64a1043b6885a7d52f5cc37773f5e944de02103c8d3a54f
|
|
BLAKE2b-256 checksum How to use checksums |
31a4ee780473e42a3edaf65da1ad37f5c601a9c740e215c1e09db36bf90f3f59
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Security for jwcrypto 1.6.1
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
