Skip to content

Conversation

Minipada
Copy link

@Minipada Minipada commented Apr 15, 2025

Summary

This patch adds support for signing OCSP responses with Ed25519 keys in CFSSL's vendored golang.org/x/crypto/ocsp package.

What's Changed

  • introduced OID for Ed25519 (1.3.101.112) in oidSignatureEd25519
  • added support for ed25519.PublicKey in signingParamsForPublicKey
  • updated signatureAlgorithmDetails to include x509.PureEd25519
  • when ed25519.PublicKey is detected, the appropriate signature algorithm is selected and crypto.SHA512 is set as the hash (dummy value — EdDSA does not use prehashing)
  • improved error message to reflect that EdDSA is now supported

Notes

  • while Ed25519 doesn't require a prehash, crypto.SHA512 is currently used as a placeholder to satisfy interfaces — in practice, the signing code path avoids hashing when Hash(0) is detected.
  • this is part of broader support for modern cryptographic algorithms within CFSSL’s OCSP response generation pipeline.

To use with golang/crypto#319

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant