1. Brian Campbell Avatar Brian Campbell
  2. Untitled project
  3. jose4j
  4. Issues

support new RFC 8037 algs

Issue #72 closed
Brian Campbell repo owner created an issue

https://datatracker.ietf.org/doc/draft-ietf-jose-cfrg-curves/ is now RFC 8037 on CFRG ECDH and Signatures in JOSE https://www.ietf.org/mail-archive/web/jose/current/msg05610.html

'This document defines how to use the Diffie-Hellman algorithms "X25519" and "X448" as well as the signature algorithms "Ed25519" and "Ed448" from the IRTF CFRG elliptic curves work in JSON Object Signing and Encryption (JOSE).'

Comments (27)

  5. Uri Blumenthal

    Not sure. As the main issue seems to be not how to implement X25519 etc. in Java, but how to "marry" those with JSON crypto. The main difficulty IMHO is serialization/deserialization of JSON plaintext.

    And AFAIK, BouncyCastle now supports the above algorithms.

    What's your opinion?

  6. Brian Campbell reporter

    I'm not really sure, to be honest, I've just been adding the occasional comment as a note to maybe look at later as I run across things. This issue is kinda a placeholder for now (as I'm sure you've noticed). I'm not in a position to do any real work on this at this time. I'm hopeful that the RFC makes that 'marrying' reasonably doable. But that's just hope at this point.

  12. Uri Blumenthal

    EdDSA has its own problems and weaknesses. One should be careful choosing one over the other.

  14. Uri Blumenthal

    Rhetoric questions do not deserve an answer. My point was - it won’t be prudent to just move from ECDSA to EdDSA. And, regardless, presence of bugs in implementation of any algorithm is likely - it makes no sense to harp on a bug in one (albeit widespread) implementation.

  15. Sergey Beryozkin

    @Uri Blumenthal I’ve asked Brian to consider supporting EdDSA, so I've no idea what you are trying to prove with your elaborate comments

    ‌

  16. Sergey Beryozkin

    This issue is dedicated to supporting an algorithm such as EdDSA and I’d like to have our users the extra options. While I did refer to a recent EcDSA issue I did not come here to start a discussions about pros and cons of various algorithms

  17. Uri Blumenthal

    I’m trying to point that supporting EdDSA has been of interest since 2016, and it hasn’t become “more interesting now” because of ECDSA bug that got fixed.

  18. Sergey Beryozkin

    Fair enough, appreciate your input, thank you, and apologies. I propose though that in scope of this issue we focus on EdDSA.

  19. Uri Blumenthal

    I thought we all were in full agreement that adding EdDSA support to this JOSE implementation is a good thing. More importantly, Brian seems to support it.

  20. Sergey Beryozkin

    I thought we all were in full agreement that adding EdDSA support to this JOSE implementation is a good thing. More importantly, Brian seems to support it.

    +1. Hope you appreciate why the EcDSA vs EdDSA discussion is an orthogonal issue. I admit I made a mistake by referring to EcDSA.

    ‌

  28. Log in to comment
Assignee
–
Type
enhancement
Priority
minor
Status
closed
Votes
5
Watchers
7
Jira: the preferred issue tracker for Bitbucket. Join the team!