Re: [keycloak-dev] Access code length

Something, which comes to my mind: * Omit the header part with algorithm info and instead assume that code is always signed with rsa-256 (or whatever different algorithm) * Is it really needed to have System.currentTimeMillis() info here? I wonder if this timestamp info can be extracted to server side as well, so when code is later looked-up, you will also have info about the time when it was created without the need of pass this info as part of the code * It seems that the biggest part (around 170 characters) is signature. I wonder that it can be reduced by either: ** Use not so strong algorithm to sign the code (not sure if it's security issue as code is one time usage though and it's better than avoid signature at all...) ** Actually it's keycloak itself, which verifies signature. So I wonder if instead of passing the whole signature around, it can just pass the hash of signature (just few characters). Then later during verification phase, it has access to whole accessCode content, so it can sign the content again and compute again the hash of signature and compare it with the hash passed from code parameter. Marek On 28.7.2014 18:14, Stian Thorgersen wrote: