web-token · Spomky · Sep 13, 2026 · Sep 13, 2026
diff --git a/.ci-tools/phpstan-baseline.neon b/.ci-tools/phpstan-baseline.neon
@@ -3768,6 +3768,16 @@ parameters:
 			count: 1
 			path: ../src/Bundle/Helper/ConfigurationHelper.php
 
+		-
+			rawMessage: '''
+				Access to constant on deprecated class Jose\Component\Signature\Algorithm\EdDSA:
+				since 4.3.0, deprecated by RFC 9864. Use "Ed25519" (or "Ed448") instead; the keys are unchanged, only
+				the "alg" value differs.
+			'''
+			identifier: classConstant.deprecatedClass
+			count: 1
+			path: ../src/Bundle/Resources/config/Algorithms/signature_eddsa.php
+
 		-
 			rawMessage: Access to constant on internal class Jose\Component\Core\Util\Ecc\NistCurve.
 			identifier: classConstant.internalClass
@@ -4674,12 +4684,6 @@ parameters:
 			count: 1
 			path: ../src/Library/Encryption/Algorithm/KeyEncryption/AESGCMKW.php
 
-		-
-			rawMessage: 'Parameter #3 $length of function substr expects int|null, float|int<min, 0> given.'
-			identifier: argument.type
-			count: 1
-			path: ../src/Library/Encryption/Algorithm/KeyEncryption/AbstractECDH.php
-
 		-
 			rawMessage: Binary operation "." between mixed and "\000" results in an error.
 			identifier: binaryOp.invalid
@@ -5070,12 +5074,6 @@ parameters:
 			count: 1
 			path: ../src/Library/KeyManagement/JWKFactory.php
 
-		-
-			rawMessage: 'Parameter #3 $length of function substr expects int|null, float|int<min, 0> given.'
-			identifier: argument.type
-			count: 1
-			path: ../src/Library/KeyManagement/JWKFactory.php
-
 		-
 			rawMessage: 'Method Jose\Component\KeyManagement\KeyConverter\ECKey::__construct() has parameter $data with no value type specified in iterable type array.'
 			identifier: missingType.iterableValue
@@ -5166,23 +5164,17 @@ parameters:
 			count: 1
 			path: ../src/Library/KeyManagement/KeyConverter/RSAKey.php
 
-		-
-			rawMessage: 'Parameter #1 $signature of static method Jose\Component\Core\Util\ECSignature::fromAsn1() expects string, mixed given.'
-			identifier: argument.type
-			count: 1
-			path: ../src/Library/Signature/Algorithm/ECDSA.php
-
 		-
 			rawMessage: 'Call to internal static method ParagonIE_Sodium_Core_Ed25519::publickey_from_secretkey().'
 			identifier: staticMethod.internal
 			count: 1
-			path: ../src/Library/Signature/Algorithm/EdDSA.php
+			path: ../src/Library/Signature/Algorithm/AbstractEdDSA.php
 
 		-
-			rawMessage: 'Method Jose\Component\Signature\Algorithm\EdDSA::sign() should return non-empty-string but returns string.'
-			identifier: return.type
+			rawMessage: 'Parameter #1 $signature of static method Jose\Component\Core\Util\ECSignature::fromAsn1() expects string, mixed given.'
+			identifier: argument.type
 			count: 1
-			path: ../src/Library/Signature/Algorithm/EdDSA.php
+			path: ../src/Library/Signature/Algorithm/ECDSA.php
 
 		-
 			rawMessage: 'Method Jose\Component\Signature\Algorithm\RSAPKCS1::sign() should return string but returns mixed.'

diff --git a/src/Bundle/DependencyInjection/Source/Signature/SignatureSource.php b/src/Bundle/DependencyInjection/Source/Signature/SignatureSource.php
@@ -8,7 +8,8 @@
 use Jose\Bundle\JoseFramework\DependencyInjection\Source\Source;
 use Jose\Bundle\JoseFramework\DependencyInjection\Source\SourceWithCompilerPasses;
 use Jose\Component\Signature\Algorithm\ECDSA;
-use Jose\Component\Signature\Algorithm\EdDSA;
+use Jose\Component\Signature\Algorithm\Ed25519;
+use Jose\Component\Signature\Algorithm\Ed448;
 use Jose\Component\Signature\Algorithm\HMAC;
 use Jose\Component\Signature\Algorithm\RSAPSS;
 use Jose\Experimental\Signature\HS1;
@@ -21,7 +22,6 @@
 use Symfony\Component\DependencyInjection\Loader\PhpFileLoader;
 use function array_key_exists;
 use function count;
-use function extension_loaded;
 
 final readonly class SignatureSource implements SourceWithCompilerPasses
 {
@@ -112,8 +112,8 @@ private function getAlgorithmsFiles(): array
             RSAPSS::class => 'signature_rsa.php',
         ];
 
-        if (extension_loaded('sodium')) {
-            $algorithms[EdDSA::class] = 'signature_eddsa.php';
+        if (Ed25519::isSupported() || Ed448::isSupported()) {
+            $algorithms[Ed25519::class] = 'signature_eddsa.php';
         }
 
         return $algorithms;

diff --git a/src/Bundle/Resources/config/Algorithms/signature_eddsa.php b/src/Bundle/Resources/config/Algorithms/signature_eddsa.php
@@ -2,18 +2,38 @@
 
 declare(strict_types=1);
 
+use Jose\Component\Signature\Algorithm\Ed25519;
+use Jose\Component\Signature\Algorithm\Ed448;
 use Jose\Component\Signature\Algorithm\EdDSA;
 use Symfony\Component\DependencyInjection\Loader\Configurator\ContainerConfigurator;
 
+/*
+ * Each algorithm is registered only when the platform can run it: the algorithm manager factory instantiates every
+ * tagged algorithm when the container is built, and an unsupported one would throw there. "Ed25519" and the
+ * deprecated "EdDSA" need sodium, or OpenSSL on PHP 8.4; "Ed448" OpenSSL on PHP 8.4.
+ */
 return function (ContainerConfigurator $container): void {
     $container = $container->services()
         ->defaults()
         ->private()
         ->autoconfigure()
         ->autowire();
 
-    $container->set(EdDSA::class)
-        ->tag('jose.algorithm', [
-            'alias' => 'EdDSA',
-        ]);
+    if (Ed25519::isSupported()) {
+        $container->set(EdDSA::class)
+            ->tag('jose.algorithm', [
+                'alias' => 'EdDSA',
+            ]);
+        $container->set(Ed25519::class)
+            ->tag('jose.algorithm', [
+                'alias' => 'Ed25519',
+            ]);
+    }
+
+    if (Ed448::isSupported()) {
+        $container->set(Ed448::class)
+            ->tag('jose.algorithm', [
+                'alias' => 'Ed448',
+            ]);
+    }
 };
diff --git a/src/Bundle/Resources/config/analyzers.php b/src/Bundle/Resources/config/analyzers.php
@@ -17,6 +17,7 @@
 use Jose\Component\KeyManagement\Analyzer\MixedPublicAndPrivateKeys;
 use Jose\Component\KeyManagement\Analyzer\NoneAnalyzer;
 use Jose\Component\KeyManagement\Analyzer\OctAnalyzer;
+use Jose\Component\KeyManagement\Analyzer\OKPKeyAnalyzer;
 use Jose\Component\KeyManagement\Analyzer\UsageAnalyzer;
 use Jose\Component\KeyManagement\Analyzer\ZxcvbnKeyAnalyzer;
 use Symfony\Component\DependencyInjection\Loader\Configurator\ContainerConfigurator;
@@ -39,6 +40,7 @@
     $container->set(KeyIdentifierAnalyzer::class);
     $container->set(NoneAnalyzer::class);
     $container->set(OctAnalyzer::class);
+    $container->set(OKPKeyAnalyzer::class);
     $container->set(MixedKeyTypes::class);
     $container->set(MixedPublicAndPrivateKeys::class);
     $container->set(HS256KeyAnalyzer::class);

diff --git a/src/Library/Console/OkpKeyGeneratorCommand.php b/src/Library/Console/OkpKeyGeneratorCommand.php
@@ -19,7 +19,7 @@ final class OkpKeyGeneratorCommand extends GeneratorCommand
     protected function configure(): void
     {
         parent::configure();
-        $this->addArgument('curve', InputArgument::REQUIRED, 'Curve of the key.');
+        $this->addArgument('curve', InputArgument::REQUIRED, 'Curve of the key: Ed25519, Ed448, X25519 or X448.');
     }
 
     #[Override]

diff --git a/src/Library/Console/OkpKeysetGeneratorCommand.php b/src/Library/Console/OkpKeysetGeneratorCommand.php
@@ -24,7 +24,7 @@ protected function configure(): void
     {
         parent::configure();
         $this->addArgument('quantity', InputArgument::REQUIRED, 'Quantity of keys in the key set.')
-            ->addArgument('curve', InputArgument::REQUIRED, 'Curve of the keys.');
+            ->addArgument('curve', InputArgument::REQUIRED, 'Curve of the keys: Ed25519, Ed448, X25519 or X448.');
     }
 
     #[Override]