IdentityPython · rohe · Oct 14, 2023 · Sep 12, 2023 · Sep 13, 2023 · Sep 13, 2023
@@ -75,6 +75,9 @@ def __init__(
                    "PS256",
                    "PS384",
                    "PS512",
+                    "EdDSA",
+                    "Ed25519",
+                    "Ed448",
                    "none",
                ]:
                    raise UnsupportedAlgorithm("Unknown algorithm: {}".format(alg))
@@ -93,6 +96,9 @@ def __init__(
                    "PS256",
                    "PS384",
                    "PS512",
+                    "EdDSA",
+                    "Ed25519",
+                    "Ed448",
                    "none",
                    "RSA1_5",
                    "RSA-OAEP",

@@ -10,6 +10,9 @@


 class EDDSASigner(Signer):
+    def __init__(self, algorithm=None):
+        self.algorithm = algorithm
+
    def sign(self, msg, key):
        """
        Create a signature over a message as defined in RFC7515 using an
@@ -20,6 +23,17 @@ def sign(self, msg, key):
        :return:
        """

+        if self.algorithm:
+            if self.algorithm == "Ed25519" and not isinstance(key, ed25519.Ed25519PrivateKey):
+                raise TypeError("The private key must be an instance of Ed25519PrivateKey")
+            if self.algorithm == "Ed448" and not isinstance(key, ed448.Ed448PrivateKey):
+                raise TypeError("The private key must be an instance of Ed448PrivateKey")
+
+        if not isinstance(key, (ed25519.Ed25519PrivateKey, ed448.Ed448PrivateKey)):
+            raise TypeError(
+                "The private key must be an instance of Ed25519PrivateKey or Ed448PrivateKey"
+            )
+
        if not isinstance(key, (ed25519.Ed25519PrivateKey, ed448.Ed448PrivateKey)):
            raise TypeError(
                "The private key must be an instance of Ed25519PrivateKey or Ed448PrivateKey"
@@ -37,6 +51,13 @@ def verify(self, msg, sig, key):
        :raises: BadSignature if the signature can't be verified.
        :return: True
        """
+
+        if self.algorithm:
+            if self.algorithm == "Ed25519" and not isinstance(key, ed25519.Ed25519PublicKey):
+                raise TypeError("The public key must be an instance of Ed25519PublicKey")
+            if self.algorithm == "Ed448" and not isinstance(key, ed448.Ed448PublicKey):
+                raise TypeError("The public key must be an instance of Ed448PublicKey")
+
        if not isinstance(key, (ed25519.Ed25519PublicKey, ed448.Ed448PublicKey)):
            raise TypeError(
                "The public key must be an instance of Ed25519PublicKey or Ed448PublicKey"

@@ -48,6 +48,8 @@
    "PS384": PSSSigner("SHA384"),
    "PS512": PSSSigner("SHA512"),
    "EdDSA": EDDSASigner(),
+    "Ed25519": EDDSASigner("Ed25519"),
+    "Ed448": EDDSASigner("Ed448"),
    "none": None,
 }


@@ -47,6 +47,10 @@ def alg2keytype(alg):
        return "RSA"
    elif alg.startswith("HS") or alg.startswith("A"):
        return "oct"
+    elif alg == "Ed25519":
+        return "OKP"
+    elif alg == "Ed448":
+        return "OKP"
    elif alg.startswith("ES") or alg.startswith("ECDH-ES"):
        return "EC"
    elif alg == "EdDSA":

@@ -225,7 +225,7 @@ def test_ignore_unknown_types():
            "-u6VtZ5rAdBo5fCjjy3LnkrsoK_QWrlKB08j_PcvwpAMfTEDHw5spepw",
            "use": "sig",
            "alg": "EdDSA",
-            "kty": "OKP",
+            "kty": "XXX",
            "crv": "Ed25519",
            "x": "FnbcUAXZ4ySvrmdXK1MrDuiqlqTXvGdAaE4RWZjmFIQ",
        }

@@ -446,24 +446,6 @@ def test_load_missing_key_parameter():
            "n": "68be-nJp46VLj4Ci1V36IrVGYqkuBfYNyjQTZD_7yRYcERZebowOnwr3w0DoIQpl8iL2X8OXUo7rUW_LMzLxKx2hEmdJfUn4LL2QqA3KPgjYz8hZJQPG92O14w9IZ-8bdDUgXrg9216H09yq6ZvJrn5Nwvap3MXgECEzsZ6zQLRKdb_R96KFFgCiI3bEiZKvZJRA7hM2ePyTm15D9En_Wzzfn_JLMYgE_DlVpoKR1MsTinfACOlwwdO9U5Dm-5elapovILTyVTgjN75i-wsPU2TqzdHFKA-4hJNiWGrYPiihlAFbA2eUSXuEYFkX43ahoQNpeaf0mc17Jt5kp7pM2w",
            "e": "AQAB",
        },
-        {
-            "kid": "q-H9y8iuh3BIKZBbK6S0mH_isBlJsk"
-            "-u6VtZ5rAdBo5fCjjy3LnkrsoK_QWrlKB08j_PcvwpAMfTEDHw5spepw",
-            "use": "sig",
-            "alg": "EdDSA",
-            "kty": "OKP",
-            "crv": "Ed25519",
-            "x": "FnbcUAXZ4ySvrmdXK1MrDuiqlqTXvGdAaE4RWZjmFIQ",
-        },
-        {
-            "kid": "bL33HthM3fWaYkY2_pDzUd7a65FV2R2LHAKCOsye8eNmAPDgRgpHWPYpWFVmeaujUUEXRyDLHN"
-            "-Up4QH_sFcmw",
-            "use": "sig",
-            "alg": "EdDSA",
-            "kty": "OKP",
-            "crv": "Ed25519",
-            "x": "CS01DGXDBPV9cFmd8tgFu3E7eHn1UcP7N1UCgd_JgZo",
-        },
    ]
 }


@@ -538,6 +538,11 @@ def test_load_missing_key_parameter():
            "n": "68be-nJp46VLj4Ci1V36IrVGYqkuBfYNyjQTZD_7yRYcERZebowOnwr3w0DoIQpl8iL2X8OXUo7rUW_LMzLxKx2hEmdJfUn4LL2QqA3KPgjYz8hZJQPG92O14w9IZ-8bdDUgXrg9216H09yq6ZvJrn5Nwvap3MXgECEzsZ6zQLRKdb_R96KFFgCiI3bEiZKvZJRA7hM2ePyTm15D9En_Wzzfn_JLMYgE_DlVpoKR1MsTinfACOlwwdO9U5Dm-5elapovILTyVTgjN75i-wsPU2TqzdHFKA-4hJNiWGrYPiihlAFbA2eUSXuEYFkX43ahoQNpeaf0mc17Jt5kp7pM2w",
            "e": "AQAB",
        },
+    ]
+}
+
+JWKS_EDDSA = {
+    "keys": [
        {
            "kid": "q-H9y8iuh3BIKZBbK6S0mH_isBlJsk"
            "-u6VtZ5rAdBo5fCjjy3LnkrsoK_QWrlKB08j_PcvwpAMfTEDHw5spepw",
@@ -556,6 +561,22 @@ def test_load_missing_key_parameter():
            "crv": "Ed25519",
            "x": "CS01DGXDBPV9cFmd8tgFu3E7eHn1UcP7N1UCgd_JgZo",
        },
+        {
+            "kid": "OF9xVk9NWE5iQ2N6OGhILTVGcXg4RE1FRk5NWVVsaXZLcFNRNUxCYk9vQQ",
+            "use": "sig",
+            "alg": "Ed25519",
+            "kty": "OKP",
+            "crv": "Ed25519",
+            "x": "M_D8nslNSecjPwiP6DwuNhWRdrgqp02U7f5xo4GhdlY",
+        },
+        {
+            "kid": "RUpoaXktM1JwT0hON3lzNWNfN0RUbVpiWExwbnJnNDRfYWhZY3htaTZ1Zw",
+            "use": "sig",
+            "alg": "Ed448",
+            "kty": "OKP",
+            "crv": "Ed448",
+            "x": "C3y5YN00IxyadHXm4NApPGAzv5w8s9e-fbGu2svYrrCuJDYDDZe-uEOPSobII6psCZCEvo2howmA",
+        },
    ]
 }

@@ -580,6 +601,16 @@ def test_get_ec_wrong_alg():
    assert k == []


+def test_get_eddsa():
+    kj = KeyJar()
+    kj.import_jwks(JWKS_EDDSA, "")
+    assert len(kj.get_issuer_keys("")) == 4
+    k = kj.get("sig", "OKP", alg="Ed25519")
+    assert k
+    k = kj.get("sig", "OKP", alg="Ed448")
+    assert k
+
+
 def test_keyjar_eq():
    kj1 = KeyJar()
    kj1.import_jwks(JWKS_SPO, "")

@@ -609,6 +609,20 @@ def test_signer_ps512():


 def test_signer_eddsa():
+    payload = "Please take a moment to register today"
+    okp = ed25519.Ed25519PrivateKey.generate()
+    _key = OKPKey().load_key(okp)
+    keys = [_key]
+    _jws = JWS(payload, alg="Ed25519")
+    _jwt = _jws.sign_compact(keys)
+
+    _pubkey = OKPKey().load_key(okp.public_key())
+    _rj = JWS(alg="Ed25519")
+    info = _rj.verify_compact(_jwt, [_pubkey])
+    assert info == payload
+
+
+def test_signer_eddsa_polymorphic():
    payload = "Please take a moment to register today"
    okp = ed25519.Ed25519PrivateKey.generate()
    _key = OKPKey().load_key(okp)
@@ -627,12 +641,12 @@ def test_signer_eddsa_fail():
    okp = ed25519.Ed25519PrivateKey.generate()
    _key = OKPKey().load_key(okp)
    keys = [_key]
-    _jws = JWS(payload, alg="EdDSA")
+    _jws = JWS(payload, alg="Ed25519")
    _jwt = _jws.sign_compact(keys)

    okp2 = ed25519.Ed25519PrivateKey.generate()
    _pubkey = OKPKey().load_key(okp2.public_key())
-    _rj = JWS(alg="EdDSA")
+    _rj = JWS(alg="Ed25519")
    try:
        info = _rj.verify_compact(_jwt, [_pubkey])
    except BadSignature: