support new RFC 8037 algs
https://datatracker.ietf.org/doc/draft-ietf-jose-cfrg-curves/ is now RFC 8037 on CFRG ECDH and Signatures in JOSE https://www.ietf.org/mail-archive/web/jose/current/msg05610.html
'This document defines how to use the Diffie-Hellman algorithms "X25519" and "X448" as well as the signature algorithms "Ed25519" and "Ed448" from the IRTF CFRG elliptic curves work in JSON Object Signing and Encryption (JOSE).'
Comments (27)
-
-
reporter - changed title to support new RFC 8037 algs
- edited description
updated title/description to reflect newly available RFC 8037
-
reporter BC seems to be looking at it http://www.ietf.org/mail-archive/web/jose/current/msg05650.html per Anders and more http://www.ietf.org/mail-archive/web/jose/current/msg05651.html
-
-
Not sure. As the main issue seems to be not how to implement X25519 etc. in Java, but how to "marry" those with JSON crypto. The main difficulty IMHO is serialization/deserialization of JSON plaintext.
And AFAIK, BouncyCastle now supports the above algorithms.
What's your opinion?
-
reporter I'm not really sure, to be honest, I've just been adding the occasional comment as a note to maybe look at later as I run across things. This issue is kinda a placeholder for now (as I'm sure you've noticed). I'm not in a position to do any real work on this at this time. I'm hopeful that the RFC makes that 'marrying' reasonably doable. But that's just hope at this point.
-
reporter Matt's https://github.com/linuxwolf/jose-cookbook/tree/master/curve25519 "contains the signature example from CFRG ECDH and signatures in JOSE as well as some examples which are not in the document." (was moved to https://github.com/ietf-jose/cookbook/blob/master/curve25519/ecdh-es.json )
-
reporter https://twitter.com/seanjmullan/status/993483816546263041 maybe relevant for Java 11
-
reporter JEP 339: Edwards-Curve Digital Signature Algorithm (EdDSA) https://openjdk.java.net/jeps/339
-
Nice!
-
Hi Brian, @Brian Campbell Supporting EdDSA would be even more interesting now that ECDSA has caused more problems. https://bugs.openjdk.java.net/browse/JDK-8199231 has been resolved for Java 15, so it should work for supported Java 17/18.
Thanks, Sergey
-
EdDSA has its own problems and weaknesses. One should be careful choosing one over the other.
-
Doesn’t it apply to any JWA algorithm ?
-
Rhetoric questions do not deserve an answer. My point was - it won’t be prudent to just move from ECDSA to EdDSA. And, regardless, presence of bugs in implementation of any algorithm is likely - it makes no sense to harp on a bug in one (albeit widespread) implementation.
-
@Uri Blumenthal I’ve asked Brian to consider supporting
EdDSA, so I've no idea what you are trying to prove with your elaborate comments
-
This issue is dedicated to supporting an algorithm such as EdDSA and I’d like to have our users the extra options. While I did refer to a recent EcDSA issue I did not come here to start a discussions about pros and cons of various algorithms
-
I’m trying to point that supporting EdDSA has been of interest since 2016, and it hasn’t become “more interesting now” because of ECDSA bug that got fixed.
-
Fair enough, appreciate your input, thank you, and apologies. I propose though that in scope of this issue we focus on EdDSA.
-
I thought we all were in full agreement that adding EdDSA support to this JOSE implementation is a good thing. More importantly, Brian seems to support it.
-
I thought we all were in full agreement that adding EdDSA support to this JOSE implementation is a good thing. More importantly, Brian seems to support it.
+1. Hope you appreciate why the EcDSA vs EdDSA discussion is an orthogonal issue. I admit I made a mistake by referring to EcDSA.
-
OK, sure. We wait for Brian to step in?
-
reporter fwi and fwiw working on this in this branch https://bitbucket.org/b_c/jose4j/commits/branch/ed
-
reporter - changed status to resolved
done with f42a568
-
reporter - changed status to closed
v0.9.0 has been released with support for RFC 8037
-
Good news, thanks Brian
-
Hi @Brian Campbell , just FYI, thought I’d share
https://github.com/smallrye/smallrye-jwt/pull/662/files
(https://twitter.com/sberyozkin/status/1606438501330948098)
Your help is appreciated, cheers.
-
Thanks Sergey, appreciate hearing that.
- Log in to comment
Yes, that would be nice. Thanks for considering it.