[PR #582] [MERGED] Generated JWT secret is too small for HMAC SHA256 #679

Closed
opened 2026-02-26 10:33:30 +03:00 by kerem · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/ONLYOFFICE/Docker-DocumentServer/pull/582
Author: @LeSuisse
Created: 2/6/2023
Status: Merged
Merged: 2/7/2023
Merged by: @agolybev

Base: hotfix/v7.3.3Head: jwt-secret-too-small-hmac-sha256


📝 Commits (1)

  • 1147729 Generated JWT secret is too small for HMAC SHA256

📊 Changes

1 file changed (+1 additions, -1 deletions)

View changed files

📝 run-document-server.sh (+1 -1)

📄 Description

The key that is automatically generated weaken the security strength. As noted in RFC7518 section 3.2:

A key of the same size as the hash output (for instance, 256 bits for
"HS256") or larger MUST be used with this algorithm.  (This
requirement is based on Section 5.3.4 (Security Effect of the HMAC
Key) of NIST SP 800-117 [NIST.800-107], which states that the
effective security strength is the minimum of the security strength
of the key and two times the size of the internal hash value.)

Some JWT libraries are rejecting by default keys that are too small in a attempt to prevent misusages so generating a key that does not respect the minimal length can be problematic for OO integrations.

See #557 for the initial PR.


🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/ONLYOFFICE/Docker-DocumentServer/pull/582 **Author:** [@LeSuisse](https://github.com/LeSuisse) **Created:** 2/6/2023 **Status:** ✅ Merged **Merged:** 2/7/2023 **Merged by:** [@agolybev](https://github.com/agolybev) **Base:** `hotfix/v7.3.3` ← **Head:** `jwt-secret-too-small-hmac-sha256` --- ### 📝 Commits (1) - [`1147729`](https://github.com/ONLYOFFICE/Docker-DocumentServer/commit/11477295db16426dda68b8f69ff90faef17379c7) Generated JWT secret is too small for HMAC SHA256 ### 📊 Changes **1 file changed** (+1 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `run-document-server.sh` (+1 -1) </details> ### 📄 Description The key that is automatically generated weaken the security strength. As noted in [RFC7518 section 3.2](https://www.rfc-editor.org/rfc/rfc7518.html#section-3.2): ``` A key of the same size as the hash output (for instance, 256 bits for "HS256") or larger MUST be used with this algorithm. (This requirement is based on Section 5.3.4 (Security Effect of the HMAC Key) of NIST SP 800-117 [NIST.800-107], which states that the effective security strength is the minimum of the security strength of the key and two times the size of the internal hash value.) ``` Some JWT libraries are rejecting by default keys that are too small in a attempt to prevent misusages so generating a key that does not respect the minimal length can be problematic for OO integrations. See #557 for the initial PR. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
kerem 2026-02-26 10:33:30 +03:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/Docker-DocumentServer-ONLYOFFICE#679
No description provided.