This repository was archived by the owner on Mar 8, 2024. It is now read-only.
Change key curve and algorithm for generated keys #3
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
0xCLARITY
approved these changes
Sep 10, 2020
0xCLARITY
left a comment
0xCLARITY
left a comment
There was a problem hiding this comment.
LGTM.
Just to double-check, although we sign with ES256, we can verify a signature with any supported algorithm, correct?
Collaborator
Author
|
Yes, this only changes the default for signing. PayIDs signed with other supported JWS curves and algorithm can still be verified. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
High Level Overview of Change
Change default curve and algorithm to P-256 / ES256 because secp256k1 / ES256k does not have wide support by JWS libraries.
Context of Change
Per jwt.io, ES256k is not supported by the majority of JWT libraries, and none for .Net, Go, Rust, and browser-based JS libraries.
Type of Change
Before / After
Before: generate and sign commands would generate an sepc256k1 key and sign with ES256k.
After: generate and sign commands generate an P-256 key and sign with ES256.
Test Plan
Unit tests
Manually run the
keys generateandsigncommands and verify that the signed PayID has the expected curve and algorithm in the protected section.