Skip to content

Conversation

@robotdan
Copy link
Member

@robotdan robotdan commented Nov 18, 2025

Summary

Add support for EdDSA. Note that this will be moving the min. version of java to 17.

  • JWT signing and verification
  • JWK parsing and building
  • EdDSA key generation
  • Support for Ed25519 and Ed448
  • Some fixes for some incomplete support for RSA PSS keys

Issue

@robotdan robotdan requested a review from a team as a code owner November 18, 2025 00:03
Copy link
Member

@voidmain voidmain left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A couple of comments and one possible error. Otherwise, looks good.


// The JCA does not ship with SHAKE256 which will be used to calculate the hash for Ed448.
// - Expect this to fail unless FIPS has been enabled.
try {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you replace this with a call to requireShake256?

KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(curve);
keyPairGenerator.initialize(new NamedParameterSpec(curve), new SecureRandom() {
public void nextBytes(byte[] bytes) {
System.arraycopy(privateKey, 0, bytes, 0, privateKey.length);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can this throw an exception if privateKey is longer than bytes?

key = privateKey;
}

key = Objects.requireNonNullElse(privateKey, publicKey);
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Join lines

case ES256:
case HS256:
case RS256:
leftMostBits = switch (algorithm) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Join lines with the variable declaration

verifier.initVerify(publicKey);
verifier.update(message);

if (!(verifier.verify(signature))) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Don't need the double parens

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants