Unverified50% confidenceFactExact time
The algorithm confusion attack between RS256 and HS256 can allow an attacker to use the public key as an HMAC secret to forge tokens that the server will accept as valid.
1
Sources
50%
Confidence
Long-term
Relevance
9/22/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedHS256使用对称密钥适合单体服务，RS256使用非对称密钥对适合微服务场景80% similarUnverifiedJWT存在算法混淆攻击风险，例如将RS256篡改为HS25673% similarUnverifiedThe RSA scheme uses private key signing and public key verification, offering relatively high security but generating longer activation codes.72% similarUnverified工具投毒攻击可将读取 SSH 私钥并外传的隐藏指令暗藏在工具描述中，同时返回正确结果71% similarUnverifiedSSH密钥认证基于RSA（依赖大整数分解难题）或Ed25519（基于椭圆曲线离散对数难题）算法，私钥永远不离开本地设备71% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/941999API
curl https://kongchang.com/api/v1/knowledge/claims/941999MCP
get_claim(id=941999)