ciamweekly • 62 implied HN points • 09 Feb 26
- Pick your JWT algorithm based on tradeoffs: HMAC (HS) is very fast and simple but uses a shared secret and cannot provide non-repudiation, while asymmetric algorithms let you separate signing and verification.
- Prefer modern asymmetric schemes when possible: RSA-PSS is safer than old PKCS#1 v1.5, ECDSA gives small fast signatures but demands perfect nonce randomness, and EdDSA (Ed25519) is usually the best choice because it’s fast, secure, and uses deterministic nonces.
- Match algorithm to your environment and tooling: RSA has the widest compatibility but large signatures and slower signing, ECDSA risks come from RNG mistakes, and EdDSA may require checking HSM/KMS and library support before committing.