Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Support the new fully-specified JOSE algorithms #1110

@decentralgabe

Description

@decentralgabe

Abstract
Support for the updated fully specified JOSE algorithms as defined by this RFC.

Describe the proposed solution/change

At the least this code needs to be updated from:

	RegisterVerifier(jwa.EdDSA, VerifierFactoryFn(func() (Verifier, error) {
		return newEdDSAVerifier(), nil
	}))

to

	for _, alg := range []jwa.SignatureAlgorithm{jwa.EdDSA, jwa.Ed25519} {
		RegisterVerifier(alg, func(alg jwa.SignatureAlgorithm) VerifierFactory {
			return VerifierFactoryFn(func() (Verifier, error) {
				return newEdDSAVerifier(alg), nil
			})
		}(alg))
	}

It does not look like Ed448 is currently supported so that can be ignored. newEdDSAVerifier may be renamed to newEd25519Verifier.

Similar changes could be made for ESP256 (ECDSA using P-256 and SHA-256), ESP384 (ECDSA using P-384 and SHA-384), and ESP512 (ECDSA using P-521 and SHA-512) for completeness.

Analysis
This update provides the benefits of aligning with the latest standards, and avoids the confusion with so-called "polymorphic" algorithm identifiers, where information beyond the alg identifier is necessary to determine the cryptographic operation(s) to be performed. These new unambiguous identifiers provide clarity and implementation simplification.

Additional context
The only possible concern would be adopting the draft before it has an official RFC number. I understand if the maintainer(s) wish to wait until the Internet Draft is further along.

Waiting is tough for implementers, however, since we will get an unsupported signature alg error message when trying to use the new types.

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions