Cryptobench

Protocols

What the bench can produce and read

Each protocol lists the artifact it puts on the wire and the operations available today.

JOSE

Three dot-separated segments on one line — the token in an Authorization header.

JWTJWSJWEJWKS
Operations
sign · verify · encrypt · decrypt
Algorithms
RS256 · ES256 · EdDSA · HS256
Open on the bench

OpenPGP

The file dropped on an SFTP server: a raw packet stream, or the same message armored between BEGIN and END lines.

PGPGPG.gpg.asc.sig
Operations
sign · verify · encrypt · decrypt
Algorithms
RSA-4096 · Curve25519
Open on the bench

In the pipeline

X.509 / mTLS

Client certificates and chains, including expired and untrusted issuers.

PEMCSRmTLS
Operations
issue · validate chain
Algorithms
RSA-2048 · P-256

COSE

CBOR-encoded signatures for constrained and mobile payloads.

CBORCWT
Operations
sign · verify
Algorithms
ES256 · EdDSA

Detached HMAC

Webhook signature headers in the common vendor shapes.

X-Signaturewebhook
Operations
sign · verify
Algorithms
HMAC-SHA256

Reference

URL or embedded key?

Your app needs the public key to check a token. It can fetch it from a URL at runtime, or carry it as a file. Both are normal. The trade is always the same one: who controls rotation.

Fetch from the URLEmbed the key
RotationAutomatic on next fetchNeeds a redeploy
NetworkDepends on the URLNone
TrustWhatever the endpoint servesPinned to one key
SuitsA signer that rotates keysOffline, air-gapped, or pinned

Use the URL when the signer rotates its keys, which is what every identity provider does. That is why it became the norm, and it is usually a one-line config change.

Embed the key when you cannot make a network call while checking a token, or when you want your app pinned to one key so a compromised endpoint could not introduce another. Export the PEM from the Keysets tab.

One catch worth knowing: Spring Boot's public-key-location only loads RSA keys. An ES256 or EdDSA key needs a custom decoder, or the URL.