14

I am using Guardian to realize JWT Authentication with an Elixir / Phoenix app. I'm using the HS512 algorithm. And I need a key for that. Are there any conditions for this key except that it has to be 512 bits or longer? It can be any arbitrary string, right?

5 Answers 5

29
openssl rand -base64 172 | tr -d '\n'

OpenSSL generates a secret of 129 bytes ((172 * 6) / 8). 129 bytes is good for HS512 (see https://github.com/ueberauth/guardian/issues/152).

tr removes newlines.

0
2

You need to run this command on a Linux machine with OpenSSL library installed:

echo -n "somevalue" | openssl sha512 -hmac "somekey"

The output of this command is the HS512 (HMAC SHA512) which you can use as the signing key with any JWT library.

1
  • 17
    The command simply generates HMAC512 using the signing key somekey for the message somevalue. The result is the HMAC of somevalue and should not be used as signing key. Aug 20, 2018 at 18:43
2

The signing key is a byte array of any value or length you wish. Most JWT libraries allow you to use any string as key, which is converted to byte array.

To generate a secure 20 byte key, bs64 encoded

dd if=/dev/random bs=20 count=1 status=none | base64
1

In case anyone visits this now: Guardian added a mix task for that.

mix guardian.gen.secret

https://hexdocs.pm/guardian/Mix.Tasks.Guardian.Gen.Secret.html#content

0

I'm pretty confident that any arbitrary string will work. Best practice would be to store that string in an environment variable and then have your app pull from that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.