Regarding this, I wonder if we should add support for ECDSA based signatures as an alternative to RSA? Just went through some interesting blog [1] , which mentions that 256-bits ECDSA has around 9.5 times better performance of signature generation than 2048-bits RSA. The time of signature verification seems to be slightly worse for ECDSA (see second comment), however there is also increased security (256-ECDSA is equivalient of 3248 RSA according to blog). Maybe it's something we can look at?

Also the optional flag to skip IDToken generation will be good too IMO. AFAIK the point of IDToken is the compliance with OIDC specification. However in case of Keycloak accessToken usually contains all the info like IDToken (+ some more) and it's the accessToken, which is used in REST endpoints. So with regards to that, most of the Keycloak-secured applications can live just with access+refresh token and don't need ID Token at all. So if just 2 tokens needs to be signed instead of 3, we have performance gain "for free" (no decrease of security, just one less useless token).

[1] https://blog.cloudflare.com/ecdsa-the-digital-signature-algorithm-of-a-better-internet/

Marek

On 24/05/16 15:43, Bill Burke wrote:

Are you sure the performance gains are worth less security?  What kind of performance are you actually worried about?  Network (size of tokens) or CPU (signatures/marshaling/unmarshalling)?  If anything, these signatures are only going to get stronger in future releases.

On 5/24/16 5:46 AM, Matuszak, Eduard wrote:

Hello

 

Motivated by considerations on how to improve the performance of the token generation process I have two questions:

 

• I noticed that Keycloak’s token generation via endpoint “auth/realms/ccp/protocol/openid-connect/token” generates a triple of tokens (access-, refresh- and id-token). Is there any possibility to dispense with the id-token generation?

 

• Is there a possibility to cause Keycloak to generate more “simple” bearer tokens then complex jwt-tokens?

 

 

Best regards, Eduard Matuszak

 

_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user

_______________________________________________
keycloak-user mailing list
keycloak-user@lists.jboss.org
https://lists.jboss.org/mailman/listinfo/keycloak-user