I am currently working at a company in which we have the need to design a token based authentication system. We will be the owners and controlers of two servers, one being the authentication server and the other the application server.
I am reasonably well versed on Computer Security concepts, threats, common vulnerabilities and their counter-measures, but one question I have not found an answer to is whether or not you need multiple rounds of hashing when using HMAC-SHA256 to sign a JWT token.
Since for something such as hashing a password using SHA256 the general rule I understand is to run 2^(year-2000) (give or take based on performance needs) rounds of hashing, I struggle to believe a single round of HMAC-SHA256 is good enough, yet I have not really seen anybody ask this question when I have researched the topic.
Therefore, given a secret key and a JWT token header and payload, which of the following is considered best practice for the token's signature:
- A single iteration of HMAC-SHA256 is considered secure for a JWT token signature.
- It is recommended to run HMAC-SHA256 many times over and over reusing the same secret key.
- Run HMAC-SHA256 once then run SHA256 hashing iterations on the product from HMAC's calculation. (This is what I would assume is best practice)
- I am totally wrong and it is something different.
Thank you very much for any help. Just want to make sure the system is designed as well as possible.