Unclear section 5.4 of FAPI2 security profile

[Dag Sneeggen]

I was reading https://openid.net/specs/fapi-2_0-security-profile-ID2.html#name-cryptography-and-secrets today and this section is unclear to me.

The way it’s structure leads me to think that all AS have to use only elliptic keys for JWTs, but then later in the section it also mentions RSA keys.

The reason I’m confused is because there are 4 main subsections: (omitted parts for clarity)

1. Authorization Servers, Clients, and Resource Servers when creating or processing JWTs shall

   1. adhere to [RFC8725]
   2. use PS256, ES256, or EdDSA (using the Ed25519 subtype) algorithms
   3. not use or accept the none algorithm

2. RSA keys shall have a minimum length of 2048 bits.

3. Elliptic curve keys shall have a minimum length of 160 bits.
4. 128bit entropy section.

Does this mean that AS must only use EC keys for JWTs? or is section 1b here only applicable Ed25519 keys?

If AS must only use EC keys for JWTs then why does section 2 mention RSA keys?

Should there be a new “top-level” section between 3 and 4 that says something like “Elliptic curve subtype Ed25519 shall use PS256, ES256, or EdDSA algorithms" - is this the intent?

[Filip Skokan]

Does this mean that AS must only use EC keys for JWTs? or is section 1b here only applicable Ed25519 keys?

I don’t understand how it could be read as such.

The section is called Cryptography and Secrets and doesn’t only pertain to JWT/S

1) An AS can use either one of the three JWS Algorithms for its issued assertions

• PS256 is RSASSA-PSS using SHA-256 and MGF1 with SHA-256, as defined in the JWA spec it is already required to use keys of 2048 bit or larger
• ES256 is ECDSA using the P-256 NIST curve, no leeway for misinterpretation there
• EdDSA is Edwards-curve Digital Signature Algorithm and we’re futher requiring the use of only the Ed25519 variant

2 and 3) puts forth general restrictions for EC and RSA based cryptography that may be in used outside of JWA e.g. in the Network layer protections - TLS

4) talks about otherwise issued opaque artefacts such as authorization codes and their minimal length / entropy used to generate them

If AS must only use EC keys for JWTs then why does section 2 mention RSA keys?

It doesn’t have to only use EC keys for JWTs.

Should there be a new “top-level” section between 3 and 4 that says something like “Elliptic curve subtype Ed25519 shall use PS256, ES256, or EdDSA algorithms" - is this the intent?

That doesn’t make much sense to me.

‌

[Dag Sneeggen]

Thank you for the reply. The issue was that I got confused, I thought PS256 was also an EC algorithm but of course it is not.

Then it’s clear, you can resolve/close this issue.

[Brian Campbell]

also kinda related https://bitbucket.org/openid/fapi/issues/683/ec-keys-minimum-length