HMAC-SHA256 for JWT Token Signature

Question

I am currently working at a company in which we have the need to design a token based authentication system. We will be the owners and controlers of two servers, one being the authentication server and the other the application server.

I am reasonably well versed on Computer Security concepts, threats, common vulnerabilities and their counter-measures, but one question I have not found an answer to is whether or not you need multiple rounds of hashing when using HMAC-SHA256 to sign a JWT token.

Since for something such as hashing a password using SHA256 the general rule I understand is to run 2^(year-2000) (give or take based on performance needs) rounds of hashing, I struggle to believe a single round of HMAC-SHA256 is good enough, yet I have not really seen anybody ask this question when I have researched the topic.

Therefore, given a secret key and a JWT token header and payload, which of the following is considered best practice for the token's signature:

1. A single iteration of HMAC-SHA256 is considered secure for a JWT token signature.
2. It is recommended to run HMAC-SHA256 many times over and over reusing the same secret key.
3. Run HMAC-SHA256 once then run SHA256 hashing iterations on the product from HMAC's calculation. (This is what I would assume is best practice)
4. I am totally wrong and it is something different.

Thank you very much for any help. Just want to make sure the system is designed as well as possible.

Answer 1

HMAC and password hashing solve very different problems. With HMAC the secret is expected to be high quality (ie 128 bits of entropy), whereas passwords are expected to be low quality (30 bits of entropy is optimistic for most people).

A single round of a quick hash function is bad for passwords because it allows attackers to quickly attempt many common passwords, or do a brute force attack on a low entropy password. For HMAC that risk doesn't really exist (as long as the secret is generated by a CSPRNG), so one round is sufficient.

Side note: you didn't specify, but you shouldn't use SHA-256 directly for hashing passwords, even if you use many rounds. It's much easier to use PBKDF2 with SHA-256 from a standard library so you don't run into any pitfalls.