Ed25519 support for signing

[johnptoohey]

Hi,
Just found this JWT crate and it looks to fullfill all our needs on storing Claims using JWTs. We currently us Curve25519 (curve25519-dalek) for signing headers and meta-data objects and would like to use it for signing our JWTs. Would this be possible with this JWT crate or must we use the Open-SSL support?

[mikkyang]

Short answer: it is not directly supported. While it seems like that algorithm is supported by PKey in the openssl crate, I believe you would have to create your own header type.

[roy-work]

I'd also love to see Ed25519 for signing, and for encryption (though I think that's X25519?).

My understanding is that OpenSSL's PKey supports Ed25519. The JOSE set of standards also supports Ed25519 & X25519, in RFC 8037 (which I don't think is the "main" RFC; I think it was standardized later).

I think at this point, it's just a matter of support in libraries like rust-jwt?

[hanusek]

@mikkyang What is the status of Ed25519?

[Dygear]

@mikkyang I would be willing to offer a code bounty for this of $500. It would be very helpful to have Ed25519 here.

[flying-kestrel]

@Dygear is the bounty still open? I was looking at implementing support for this but if it is, I'll definitely go forwards with it :)

[flying-kestrel]

Submitted two PRs for supporting Ed25519 via OpenSSL (#96) and ed25519-dalek (#97). I've done some light testing and made the code changes as small as I reasonably could.

[Dygear]

@flying-kestrel I ended up using a different crate for this, but it only seems fair that you get the code bounty should this get merged. (And sorry for the very late reply. I wasn't paying attention to GitHub notifications.)

[EDIT]

... Eh, the last time the author of this repo had any commits across his account was January 2022. I hope he is ok.

But it seems unfair to @flying-kestrel that he did the work and it's never going to get merged. Please send me your PayPal, and I'll send you the money. It would also be good if someone where to take over this project if possible. Looks like this repo might end up being dead in the water.