OAuth 2.0 and PASETO: Simplifying Secure Delegated Authorization

PASETO

OAuth 2.0 is a widely used protocol for delegated authorization, while PASETO (Platform-Agnostic Security Tokens) is an emerging alternative to JWTs (JSON Web Tokens) designed with a focus on simplicity and robust security.

Combining OAuth 2.0 with PASETO tokens involves replacing JWTs with PASETO as the token format for transmitting authorization data. Here's an overview and a practical approach to using OAuth 2.0 with PASETO tokens:

Why Use PASETO with OAuth 2.0?

Simplicity: PASETO avoids common pitfalls of JWTs (e.g., insecure algorithms).
Built-in Security: PASETO uses modern cryptographic primitives, ensuring safe defaults.
Compatibility: While not natively supported by all OAuth 2.0 libraries, it can be integrated with minor modifications.

Key Concepts

Access Token: Generated by the OAuth 2.0 Authorization Server (AS), signed using PASETO.
Refresh Token: Optional; allows obtaining a new access token without reauthentication.
Scopes: Permissions granted by the token.

OAuth 2.0 and PASETO tokens primarily rely on cryptographic operations rather than traditional mathematical formulas. However, the underlying cryptographic algorithms, such as signing, encryption, and key derivation, use mathematical principles. Here's a breakdown of the relevant math-based operations:

1. PASETO Token Structure

PASETO tokens consist of a header and a payload. The cryptographic operations can be represented as formulas depending on the token type:

Signed Token (v2.public)

For a signed token, the Authorization Server (AS) generates a token using a signing key:

$$T=Base64(H∥Payload∥Signature)$$

Where:

Ø H: Header (e.g., version and purpose)

Ø Payload: JSON-encoded data (claims)

Ø Signature: Digital signature:

$$Signature = Sign_{privateKey}(H∥Payload)$$

The Sign operation often uses Ed25519:

Signature=r+s⋅privateKey mod n

Where r and s are ephemeral values, and n is the curve's order.

Encrypted Token (v2.local)

For an encrypted token, the payload is encrypted and encoded:

$$T=Base64(H∥Nonce∥Ciphertext)$$

Where:

Ø H: Header

Ø Nonce: Random value ensuring uniqueness

Ø Ciphertext: Encrypted payload:

$$Ciphertext=Encrypt_{key}(Payload,Nonce)$$

Encryption uses XChaCha20-Poly1305:

$$Ciphertext=ChaCha20_{k,n}(m)+Poly1305_{k,n}(m)$$

Where k is the encryption key, n is the nonce, and m is the message.

2. OAuth 2.0 Integration with PASETO

In OAuth 2.0, tokens issued by the AS encode claims (e.g., user ID, expiration time). PASETO ensures the token is securely signed or encrypted.

Token Issuance

Claims (e.g., C) are included in the payload:

Payload={"sub":"user123","exp":now+3600,"aud":"client−id"}

The AS signs/encrypts the payload to produce a PASETO token:

$$AccessToken=PASETO(H,Payload,key)$$

Token Validation

The Resource Server (RS) validates the token:

For Signed Tokens:$$Verify(Signature,H∥Payload,publicKey)=true$$

For Encrypted Tokens:

$$Decrypt(Ciphertext,key)=Payload$$

The server then extracts claims to validate:

$$Valid\Leftrightarrow now \lt \text{exp} \land \text{aud}=expectedAudience$$

3. Summary of Key Operations

Ø Signing: $Signature=Sign_{privateKey}(H∥Payload)$

Ø Encryption: $Ciphertext=Encrypt_{key}(Payload,Nonce)$

Ø Validation: $ Valid\Leftrightarrow now \lt \text{exp} \land \text{aud}=expectedAudience$

These formulas ensure secure and verifiable tokens within the OAuth 2.0 framework.

Steps to Integrate OAuth 2.0 with PASETO Tokens

1. Setup Authorization Server (AS)

Ø Use an OAuth 2.0 library or framework supporting extensibility for custom token formats.

Ø Implement token generation using PASETO instead of JWT.

Example Code for Token Generation (Java):

java

package com.kartik.paseto.secuirty;

import dev.paseto.Paseto;

import dev.paseto.Token;

import dev.paseto.keys.KeyPair;

import java.time.Instant;

public class PasetoTokenGenerator {

public static void main(String[] args) {

// Generate a key pair for signing

KeyPair keyPair = KeyPair.generate();

// Define token payload

Token token = Paseto.V2.LOCAL.builder()

.setAudience("example-client")

.setIssuer("https://auth.example.com")

.setExpiration(Instant.now().plusSeconds(3600)) // 1 hour expiry

.set("scope", "read write")

.setSubject("user123")

.build();

// Sign and serialize the token

String signedToken = Paseto.V2.SIGN.local(token, keyPair.getPrivateKey());

System.out.println("Generated PASETO Token: " + signedToken);

}

2. Token Validation

Ø The Resource Server (RS) should validate incoming PASETO tokens.

Ø Use PASETO libraries to verify token signatures and ensure claims validity (e.g., expiration, audience).

Validation Example:

java

package com.kartik.paseto.secuirty;
import dev.paseto.Paseto;

import dev.paseto.keys.KeyPair;

public class PasetoTokenValidator {

public static void main(String[] args) {

String signedToken = "..."; // Token from the client

// Use the public key to validate the token

KeyPair keyPair = KeyPair.generate(); // Match the signing key

Token verifiedToken = Paseto.V2.SIGN.verify(signedToken, keyPair.getPublicKey());

// Check claims

if (verifiedToken.getExpiration().isBefore(Instant.now())) {

throw new RuntimeException("Token is expired");

}

System.out.println("Valid Token: " + verifiedToken);

}

3. Authorization Flow

Ø Implement standard OAuth 2.0 flows (e.g., Authorization Code, Client Credentials).

Ø Replace JWT logic in token endpoints with PASETO generation and validation.

4. Client Implementation

Clients interact with the Authorization Server using standard OAuth 2.0 protocols. No modifications are needed for clients as they consume the tokens in a transparent manner.

5. Tools and Libraries

Ø PASETO Libraries: Java, Python, Node.js.

Ø OAuth Frameworks: Keycloak (custom token providers), Spring Security OAuth2 (custom token store).

To integrate OAuth 2.0 with PASETO tokens in a Spring Boot project

you need to customize the OAuth 2.0 Authorization Server (AS) and Resource Server (RS) implementations. Here’s a step-by-step guide:

1. Set Up Your Spring Boot Project

Dependencies: Add dependencies for Spring Security, Spring Boot Starter Web, and a PASETO library (e.g., java-paseto).

pom.xml:

xml

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-security</artifactId>

</dependency>

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-web</artifactId>

</dependency>

<groupId>dev.paseto</groupId>

<artifactId>paseto</artifactId>

</dependency>

</dependencies>

2. Implement the Authorization Server

The Authorization Server will issue PASETO tokens instead of JWTs. For this, you’ll need to customize the token generation.

2.1 Generate a PASETO Token

Create a service for generating and signing PASETO tokens.

PasetoTokenService.java:

java

package com.kartik.paseto.secuirty;
import dev.paseto.Paseto;

import dev.paseto.Token;

import dev.paseto.keys.KeyPair;

import java.time.Instant;

@Service

public class PasetoTokenService {

private final KeyPair keyPair = KeyPair.generate();

public String generateToken(String subject, String audience, String scope) {

Token token = Paseto.V2.LOCAL.builder()

.setSubject(subject)

.setAudience(audience)

.setIssuer("https://auth.example.com")

.setExpiration(Instant.now().plusSeconds(3600)) // 1 hour expiry

.set("scope", scope)

.build();

return Paseto.V2.SIGN.local(token, keyPair.getPrivateKey());

}

public boolean validateToken(String token) {

try {

Paseto.V2.SIGN.verify(token, keyPair.getPublicKey());

return true;

} catch (Exception e) {

return false;

}

2.2 Customize the OAuth 2.0 Token Endpoint

Override the default OAuth 2.0 token generation to use PASETO.

AuthorizationServerConfig.java:

java

package com.kartik.paseto.secuirty;
@Configuration

@EnableAuthorizationServer

public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdapter {

@Autowired

private PasetoTokenService pasetoTokenService;

@Override

public void configure(ClientDetailsServiceConfigurer clients) throws Exception {

clients.inMemory()

.withClient("client-id")

.secret("{noop}client-secret")

.authorizedGrantTypes("password", "refresh_token")

.scopes("read", "write");

}

@Override

public void configure(AuthorizationServerEndpointsConfigurer endpoints) {

endpoints.tokenEnhancer((accessToken, authentication) -> {

String pasetoToken = pasetoTokenService.generateToken(

authentication.getName(),

"example-client",

String.join(" ", authentication.getAuthorities().stream()

.map(GrantedAuthority::getAuthority)

.collect(Collectors.toList()))

);

((DefaultOAuth2AccessToken) accessToken).setValue(pasetoToken);

return accessToken;

});

}

3. Implement the Resource Server

The Resource Server will validate the incoming PASETO tokens.

ResourceServerConfig.java:

java

package com.kartik.paseto.secuirty;
@Configuration

@EnableResourceServer

public class ResourceServerConfig extends ResourceServerConfigurerAdapter {

@Autowired

private PasetoTokenService pasetoTokenService;

@Override

public void configure(ResourceServerSecurityConfigurer resources) {

resources.tokenServices(tokenServices());

}

@Bean

public ResourceServerTokenServices tokenServices() {

return new ResourceServerTokenServices() {

@Override

public OAuth2Authentication loadAuthentication(String accessToken) throws AuthenticationException {

if (!pasetoTokenService.validateToken(accessToken)) {

throw new InvalidTokenException("Invalid token");

}

// Extract claims from token for authentication

// Return OAuth2Authentication based on claims

return new OAuth2Authentication(

new OAuth2Request(null, "client-id", null, true, null, null, null, null, null),

new UsernamePasswordAuthenticationToken("user", null, AuthorityUtils.createAuthorityList("ROLE_USER"))

);

}

@Override

public OAuth2AccessToken readAccessToken(String token) {

return null; // Not required for Paseto

}

};

}

4. Test Your OAuth 2.0 with PASETO Integration

4.1 Token Request

Use a REST client (e.g., Postman) to request a token:

Ø URL: http://localhost:8080/oauth/token

Ø Method: POST

Ø Headers: Authorization: Basic <Base64(client-id:client-secret)>

Ø Body (form-data):

ü grant_type: password

ü username: <your-username>

ü password: <your-password>

4.2 Validate the Token

Send the token in the Authorization header to a protected endpoint.

Ø URL: http://localhost:8080/protected-endpoint

Ø Headers: Authorization: Bearer <paseto-token>

5. Security Enhancements

Ø Use a secure key management system (e.g., AWS KMS) to store signing keys.

Ø Ensure proper error handling in token validation logic.

Ø Implement token revocation mechanisms.

By following these steps, you can integrate OAuth 2.0 with PASETO tokens in your Spring Boot project. This setup enhances token security while maintaining compatibility with OAuth 2.0.

Advantages

Ø Enhanced security with no reliance on insecure algorithms (e.g., none in JWT).

Ø Easier implementation with reduced room for error.

Ø Compatible with modern OAuth workflows.

By replacing JWTs with PASETO, you can achieve a more secure and streamlined token handling mechanism in OAuth 2.0 systems.

For More Git related information, visit

Ø How to use github

Ø Git in IntelliJ and encountering the SSL certificate issue

For More Spring Related information, visit

Ø Mastering Debounce, Throttle, Rate Limit & Backoff in Java

Ø Deep understand of ThrottlingFilter with RewritePath filter in cloud gateway

Ø Setting up Custom Filters using Debouncing, Throttling, Rate Limiting, and Exponential Backoff