Add enforce_hmac_key_length configuration option

[304]

Description

Add enforce_hmac_key_length configuration option to enforce minimum key lengths for HMAC algorithms. This is a security hardening measure that helps prevent brute-force attacks on weak keys.

Recommended minimum key lengths per RFC 7518 Section 3.2:

• HS256: 256 bits (32 bytes)
• HS384: 384 bits (48 bytes)
• HS512: 512 bits (64 bytes)

See: https://www.rfc-editor.org/rfc/rfc7518.html#section-3.2

Usage:

  JWT.configuration.decode.enforce_hmac_key_length = true

For backward compatibility, it's disabled by default (false). But it would be nice to enforce it in a future major version like it's done for RSA key validation (minimum 2048 bits). For now, users must explicitly opt-in.

Checklist

Before the PR can be merged be sure the following are checked:

• There are tests for the fix or feature added/changed
• A description of the changes and a reference to the PR has been added to CHANGELOG.md. More details in the CONTRIBUTING.md

[anakinj]

Could we instead of letting users set the min length just let the gem validate against the recommended minimums, so just enable or disable the feature. Then in future versions we could enable it by default. Something like enforce_hmac_key_length

I think this would be a bit less complex and easier for users to toggle on.

[anakinj]

Or is there a use-case where you would like to enforce a higher minimum than the default...

[304]

Good point! I initially considered making it configurable, but default minimums should be sufficient.

I’ve pushed new changes to the branch using the enforce_hmac_key_length boolean flag instead.

Thanks for the review, @anakinj! Could you please take another look?

[anakinj]

Future us could wonder where are these values coming from, a comment pointing to the RFC would be useful at this point.

[anakinj]

Great stuff, thanks for the addition. Next major release should swap the default to true