Is there a case to be made for authorizing with both a client side certificate and JWT for an IoT device?

Are JWTs good enough (assuming following of the specs)?

And if client side certs are truly needed, what of expiration dates? (set the client cert expiration way out into the future, etc)?

  • 1
    Is there a reason why you left out the (obvious?) case of only using certificates? – Tom K. Feb 7 '18 at 16:46
  • @TomK. Excellent question. Yes, we already use JWTs everywhere. Client side certs would be new for us. Also, JWT seems more resilient over time (new ones are generated as needed vs. with a set expiry date etc) – Nate Caleb Feb 7 '18 at 17:03
  • You might want to revisit your assumption that JWT is a useful general security measure: nemethgergely.com/building-secure-javascript-applications, youtube.com/watch?v=GdJ0wFi1Jyo, speakerdeck.com/rdegges/… – Julian Knight Feb 8 '18 at 13:06
  • @JulianKnight - Those references make sense for javascript type apps (browsers and SPAs), but I don't see the parallel for an IoT device authenticating to an API – Nate Caleb Feb 8 '18 at 15:15
  • It depends on the security requirements and the sensitivity of the data. JWT is only really secure for short lived tokens. The best use of JWT is for a single use token. If you want long-lived authentication, sessions are a much more appropriate and secure method - according to those references. – Julian Knight Feb 9 '18 at 20:52

Only reason you need the additional JWT is if there are going to be different claims and identities being used with the devices that require seperate privileges.

Now as this is IoT do you have a way to revocate and update certificates? Are you able to handle all the required certificate operations?

  • So, your answer makes it sound like a client cert is enough for security (as long as more claims aren't needed), but what about the reverse? What about JWT without any client side cert (still over tls)? – Nate Caleb Feb 8 '18 at 13:52

Let me explain with example: suppose you are using device provisioning service from Azure, it requires 509 certificate. But to get signed certificate we need key/pair to be generated on the device. so KEY plays important role and loosing it is risk. So we need to design in such a way that key is possessed based on request/demand. so to request or demand, we can initiate the trust by using JWT :) so this helps to secure the design

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.