jose/lib
Filip Skokan 5b53cb0155 fix: limit calculation of missing RSA private components
- this deprecates the use of `JWK.importKey` in favor of
`JWK.asKey`
- this deprecates the use of `JWKS.KeyStore.fromJWKS` in favor of
`JWKS.asKeyStore`

Both `JWK.importKey` and `JWKS.KeyStore.fromJWKS` could have resulted
in the process getting blocked when large bitsize RSA private keys
were missing their components and could also result in an endless
calculation loop when the private key's private exponent was outright
invalid or tampered with.

The new methods still allow to import private RSA keys with these
optimization key parameters missing but its disabled by default and one
should choose to enable it when working with keys from trusted sources

It is recommended not to use @panva/jose versions with this feature in
its original on-by-default form - v1.1.0 and v1.2.0 These will
2019-06-20 23:32:13 +02:00
..
help fix: limit calculation of missing RSA private components 2019-06-20 23:32:13 +02:00
jwa feat: add JWK key_ops support, fix .algorithms() op returns 2019-04-23 14:30:51 +02:00
jwe fix: limit calculation of missing RSA private components 2019-06-20 23:32:13 +02:00
jwk fix: limit calculation of missing RSA private components 2019-06-20 23:32:13 +02:00
jwks fix: limit calculation of missing RSA private components 2019-06-20 23:32:13 +02:00
jws fix: limit calculation of missing RSA private components 2019-06-20 23:32:13 +02:00
jwt fix: limit calculation of missing RSA private components 2019-06-20 23:32:13 +02:00
errors.js feat: add JWK key_ops support, fix .algorithms() op returns 2019-04-23 14:30:51 +02:00
index.d.ts fix: limit calculation of missing RSA private components 2019-06-20 23:32:13 +02:00
index.js feat: add JWT.sign/verify/decode 2019-02-27 22:38:30 +01:00