This message was deleted.

We have a LiveKit server configured with the following data:

apiKey="key"
apiSecret="4mAAqFyEfsm5Q7"

This works for API calls (creating a room) and the livekit-cli load-test also works. However when trying to generate an access token for the call on the server I get this error:

Error joining call, abort call io.jsonwebtoken.security.WeakKeyException: The signing key's size is 112 bits which is not secure enough for the HS256 algorithm.  The JWT JWA Specification (RFC 7518, Section 3.2) states that keys used with HS256 MUST have a size >= 256 bits (the key size must be greater than or equal to the hash output size).  Consider using the io.jsonwebtoken.security.Keys class's 'secretKeyFor(SignatureAlgorithm.HS256)' method to create a key guaranteed to be secure enough for HS256.  See <https://tools.ietf.org/html/rfc7518#section-3.2> for more information.

cc @eager-raincoat-52616 @polite-kilobyte-67570

hey @best-parrot-43500, just curious, where did you get that particular secret? typically we would recommend using a longer secret for that reason (the default

livekit-server generate-keys

generates is 44 chars long, or 352 bits)

This is obviously just a test setup and not something we would actually use in production. I believe the secret was just a randomly generated String. The point isn't, that we really want to use a key or secret like that. It's more about the different interpretations of "secure enough" between the SDKs / APIs. I agree an initial check would help to have more consistency

@dry-elephant-14928 forgot livekit-server default dev key is pretty short. I think a good solution might be to have no key checking on the sdks, and have server check the key length when not on --dev, what do you think?

yeah, I think that makes sense. We can make the server warn on short keys at startup. (when --dev isn't used)

nice guys, thanks for the fast implementation 👍

server-sdk-kotlin is updated to allow arbitrary key lengths in https://github.com/livekit/server-sdk-kotlin/pull/3