Ed (edwards curve), EdDSA (Ed25519/Ed448) and XDH (X25519/X448) #105

ariawisp · 2025-09-04T01:50:21Z

This is a rebased version of #61 that also addresses the outstanding comments on the original PR, and adds Apple providers.

…nterfaces

…and XDH (X25519/X448) interfaces

whyoleg

Nice! Thanks for the PR! I've performed first round of review and left quite a lot of comments. Hope that most of them could be easily solved!

P.S. I'm quite curious, was any AI tool used to implement any part of the PR? There is no problem with it, just curiocity :)

docs/providers/jdk.md

docs/providers/openssl3.md

docs/providers/cryptokit.md

docs/providers/webcrypto.md

cryptography-providers/jdk/src/jvmMain/kotlin/algorithms/JdkEdDSA.kt

cryptography-providers/cryptokit/src/commonMain/kotlin/algorithms/CryptoKitEdDSA.kt

cryptography-providers/cryptokit/src/commonMain/kotlin/algorithms/CryptoKitXDH.kt

cryptography-providers/cryptokit/src/commonMain/kotlin/algorithms/CryptoKitEdDSA.kt

- Docs: remove duplicated EdDSA/XDH sections (JDK/OpenSSL3); fix CryptoKit notes; clarify WebCrypto availability wording and remove opt-in flag. - WebCrypto: drop engine gating + experimental flag; pass key.algorithm to EdDSA ops; fix private key JWK/RAW mapping; use KeyDeriveAlgorithm for ECDH. - JDK EdDSA: support RAW via PKCS8/SPKI wrap/unwrap. - OpenSSL3 EdDSA/XDH: add RAW key format via DER wrap/unwrap; pass curve through wrappers; extract shared derive to operations. - Tests: remove WebCrypto skips; align JDK EdDSA gating to JDK<11; add EdDSA/XDH compatibility tests; include in generator.

…9/X448)

…ers; Compatibility tests: include JWK for WebCrypto in EdDSA/XDH

…ot path); JDK: unify RAW SPKI/PKCS#8 unwrap via helper; wire OID constants

… fix curve param decoding for EdDSA/XDH compat tests; adjust ASN.1 AlgorithmIdentifier to allow missing parameters (RFC 8410).

… Tests: use context.provider.isCryptoKit in EdDSA/XDH default tests\n- Compatibility: skip Ed448/X448 for CryptoKit to match capabilities\n- ASN.1: tolerate absent/NULL AlgorithmIdentifier parameters (RFC 8410)\n- SwiftInterop: generate SPM platforms with .vN style; prefer OS runtime\n\nAlso includes current local changes in support files and providers.

…t EdDSA\n\n- Extract accumulating signature update logic to provider-base\n- Replace CryptoKit EdDSA local functions with shared base impls

…dDSA (RFC 8032) and XDH (RFC 7748)

ariawisp · 2025-09-05T01:54:40Z

Thanks for the review @whyoleg ! All the comments should be addressed now.

To answer your question regarding AI: yes, OpenAI's Codex CLI with GPT-5 (high reasoning) was used for the entirety of this PR.

Highlights of changes since your review:

Docs:
- jdk.md/openssl3.md: removed extra “EdDSA/XDH” sections to avoid duplication.
- cryptokit.md: clarified only Ed25519/X25519 supported; DER/PEM and RAW encodings available via provider APIs.
- webcrypto.md: clarified EdDSA/XDH were added later to WebCrypto; added RFC references (RFC 8032, RFC 7748).
WebCrypto:
- Removed engine detection and all gating; rely on runtime availability errors from the engine.
- Implemented JWK and RAW support for EdDSA/XDH (public/private) with PEM/DER wrapping via processors.
- Unified key derivation to use KeyDeriveAlgorithm (removed the separate ECDH variant).
OpenSSL3:
- Added RAW key format support for EdDSA/XDH via SPKI/PKCS#8 wrap/unwrap on encode/decode.
- Extracted shared-secret derivation into operations and reused it.
- Switched EdDSA to one‑shot mode (nullable hashAlgorithm) in digest-based sign/verify.
CryptoKit:
- Moved Ed25519/X25519 OIDs into asn1-modules and used them.
- Extracted accumulating sign/verify into provider-base (AccumulatingSignFunction/VerifyFunction) and adopted in EdDSA.
- Compatibility tests skip only unsupported curves (Ed448/X448).
JDK:
- Added RAW support to EdDSA (via SPKI/PKCS#8 wrap/unwrap).
- Tests now reflect correct split: XDH since JDK 11, EdDSA since JDK 15.
Tests:
- Fixed provider checks to use context.provider where appropriate.
- Simplified SupportedAlgorithmsTest gating (Apple vs others).
- Removed WebCrypto browser skip rules; let engines handle availability at runtime.
ASN.1:
- AlgorithmIdentifier deserializer now tolerates absent/NULL parameters (RFC 8410) to avoid decode errors on SPKI/PKCS#8.
- Added Edwards/Montgomery OIDs to asn1-modules.

whyoleg

The PR is really big so reviewing it becoming a bit hard, but here is the second round of review.

If the whole PR is done via AI - I will probably need some time more to review it locally and perform some additional manual changes, to split commits/changes, so that the history will be nicer. Or you can do it if you like :)
Depending on your answer, I will provide more instructions

whyoleg · 2025-09-06T10:45:10Z

docs/providers/cryptokit.md

@@ -8,6 +8,7 @@ For supported targets and algorithms, please consult [Supported primitives secti

 * KeyFormat: doesn't support `JWK` key format yet
 * AES.GCM supports only a default tag size of 96 bits
+* EdDSA/XDH: CryptoKit supports only Ed25519 and X25519. DER/PEM and RAW key encodings are available via the provider APIs.


Suggested change

* EdDSA/XDH: CryptoKit supports only Ed25519 and X25519. DER/PEM and RAW key encodings are available via the provider APIs.

* EdDSA/XDH: supports only Ed25519 and X25519

whyoleg · 2025-09-06T10:45:26Z

docs/providers/openssl3.md

@@ -21,6 +21,7 @@ For supported targets and algorithms, please consult [Supported primitives secti

 * KeyFormat: doesn't support `JWK` key format yet

+


Suggested change

whyoleg · 2025-09-06T10:51:25Z

docs/providers/webcrypto.md

@@ -9,10 +9,12 @@ For supported targets and algorithms, please consult [Supported primitives secti
 * only `suspend` functions are supported, because `WebCrypto` API is async by default
 * AES.* (browser only): may not support `192 bit` keys
 * AES.CBC: only `padding=true` is supported
+* EdDSA/XDH: These algorithms were added later to WebCrypto and might not be available in all engines/browsers yet (see [RFC 8032] and [RFC 7748]). If unsupported, operations will fail at runtime with an error from the underlying engine.


Suggested change

* EdDSA/XDH: These algorithms were added later to WebCrypto and might not be available in all engines/browsers yet (see [RFC 8032] and [RFC 7748]). If unsupported, operations will fail at runtime with an error from the underlying engine.

* EdDSA/XDH were added later to WebCrypto and might not be available in all browsers (https://github.com/w3c/webcrypto/pull/362)

whyoleg · 2025-09-06T10:51:54Z

docs/providers/webcrypto.md


 ## Example

 ```kotlin
+// default provider


Suggested change

// default provider

whyoleg · 2025-09-06T10:52:17Z

docs/providers/webcrypto.md

+
+[RFC 8032]: https://www.rfc-editor.org/rfc/rfc8032
+[RFC 7748]: https://www.rfc-editor.org/rfc/rfc7748


Suggested change

[RFC 8032]: https://www.rfc-editor.org/rfc/rfc8032

[RFC 7748]: https://www.rfc-editor.org/rfc/rfc7748

whyoleg · 2025-09-06T11:30:47Z

swiftinterop/src/main/kotlin/tasks/GenerateSwiftPackageDefinitionTask.kt

@@ -44,11 +44,12 @@ abstract class GenerateSwiftPackageDefinitionTask : DefaultTask() {
        outputDirectory.get().asFile.recreateDirectories()

        val swiftinteropModuleName = swiftinteropModuleName.get()
+        fun ver(v: String) = ".v$v"


those changes are most likely unrelated and should be reverted, why are they needed?

These changes were made to address linker/compiler issues on macOS 26 beta / Xcode 26.

whyoleg · 2025-09-06T11:30:51Z

swiftinterop/src/main/kotlin/tasks/GenerateSwiftPackageDefinitionTask.kt

@@ -69,7 +70,11 @@ abstract class GenerateSwiftPackageDefinitionTask : DefaultTask() {
                dependencies: [],
                targets: [
                    .target(
-                        name: "$swiftinteropModuleName"
+                        name: "$swiftinteropModuleName",
+                        swiftSettings: [


those changes are most likely unrelated and should be reverted, why are they needed?

These changes were made to address linker/compiler issues on macOS 26 beta / Xcode 26.

whyoleg · 2025-09-06T11:31:13Z

swiftinterop/src/main/kotlin/tasks/XcodebuildBuildTask.kt

@@ -45,13 +45,19 @@ abstract class XcodebuildBuildTask : DefaultTask() {

        exec.exec {
            it.workingDir(temporaryDir)
-            it.commandLine(
+            val developerDir = System.getenv("DEVELOPER_DIR") ?: ""


those changes are most likely unrelated and should be reverted, why are they needed?

These changes were made to address linker/compiler issues on macOS 26 beta / Xcode 26.

whyoleg · 2025-09-06T11:33:57Z

cryptography-serialization/asn1/modules/src/commonMain/kotlin/AlgorithmIdentifierSerializer.kt

-        val parameters = decodeParameters(algorithm)
-        check(decodeElementIndex(descriptor) == CompositeDecoder.DECODE_DONE)
-        parameters
+        when (val idx = decodeElementIndex(descriptor)) {


It would be nice to implement those changes in a separate PR/commit with additional tests

whyoleg · 2025-09-06T11:34:14Z

...ography-serialization/asn1/modules/src/commonMain/kotlin/KeyAlgorithmIdentifierSerializer.kt

@@ -26,8 +26,10 @@ internal object KeyAlgorithmIdentifierSerializer : AlgorithmIdentifierSerializer
        }
        ObjectIdentifier.EC  -> EcKeyAlgorithmIdentifier(decodeParameters(EcParameters.serializer()))
        else                 -> {
-            // TODO: somehow we should ignore parameters here
+            // For algorithms like Ed25519/Ed448/X25519/X448 (RFC 8410), parameters MUST be absent.


without tests it's not clear, why are those needed

ariawisp · 2025-09-06T15:08:43Z

Thanks for the second review @whyoleg - let me see what I can do for breaking this up into more smaller commits/PRs

ariawisp · 2025-09-07T02:49:15Z

Split PRs Overview: EdDSA/XDH Series

Below is a concise list of the new PRs that split the original combined work, with links, scope, and dependencies. All target main and keep test/CI setup unchanged. Recommended merge order is Foundation → Providers → Tests.

Merge Order (high level)

Foundation: ASN.1: RFC 8410 OIDs, ABSENT params, Unknown key preservation, SEQUENCE OF support #108 → Core: Add EdDSA and XDH algorithm interfaces #109 → Providers/Base: Add accumulating sign/verify helpers #110
Providers: JDK: Implement EdDSA and XDH; RAW key wrap/unwrap helper; wire provider #111 (JDK), OpenSSL3: Implement EdDSA and XDH; refactor key agreement; wire provider #112 (OpenSSL3), WebCrypto: Implement EdDSA and XDH; internal algorithms; wire provider #113 (WebCrypto), CryptoKit: Implement EdDSA and XDH; add Swift sources; wire provider #114 (CryptoKit)
Tests: Tests: Add EdDSA/XDH default and compatibility suites; unify capability gating #115

Foundation

ASN.1: RFC 8410 OIDs, ABSENT params, Unknown key preservation, SEQUENCE OF support #108 — ASN.1: Ed25519/Ed448 and X25519/X448 OIDs; accept ABSENT/NULL AlgorithmIdentifier params (RFC 8410)
- Link: ASN.1: RFC 8410 OIDs, ABSENT params, Unknown key preservation, SEQUENCE OF support #108
- Branch: feat/asn1-oids-rfc8410
- What: expose OIDs as ObjectIdentifier extensions; tolerate ABSENT/NULL params; add minimal decode tests; ABI updated.
Core: Add EdDSA and XDH algorithm interfaces #109 — Core: Add EdDSA and XDH algorithm interfaces
- Link: Core: Add EdDSA and XDH algorithm interfaces #109
- Branch: feat/core-ed-xdh
- What: add EdDSA/XDH APIs and core API descriptors (no provider/test changes).
Providers/Base: Add accumulating sign/verify helpers #110 — Providers/Base: Add accumulating sign/verify helpers
- Link: Providers/Base: Add accumulating sign/verify helpers #110
- Branch: feat/provider-base-accum
- What: add AccumulatingSignFunction/AccumulatingVerifyFunction (mirrors cipher helper); add shared unwrapSubjectPublicKeyInfo(Set<ObjectIdentifier>); ABI updated.

Providers

JDK: Implement EdDSA and XDH; RAW key wrap/unwrap helper; wire provider #111 — JDK: Implement EdDSA and XDH; RAW key wrap/unwrap helper; wire provider
- Link: JDK: Implement EdDSA and XDH; RAW key wrap/unwrap helper; wire provider #111
- Branch: feat/jdk-ed-xdh
- What: JDK EdDSA/XDH; uses base SPKI unwrap helper; keeps minimal PKCS#8 unwrap helper; uses ObjectIdentifier.* OIDs; provider wiring.
- Depends on: Core Core: Add EdDSA and XDH algorithm interfaces #109 (uses APIs); references Base Providers/Base: Add accumulating sign/verify helpers #110; uses ASN.1 OIDs from ASN.1: RFC 8410 OIDs, ABSENT params, Unknown key preservation, SEQUENCE OF support #108 for DER/PEM.
OpenSSL3: Implement EdDSA and XDH; refactor key agreement; wire provider #112 — OpenSSL3: Implement EdDSA and XDH; refactor key agreement; wire provider
- Link: OpenSSL3: Implement EdDSA and XDH; refactor key agreement; wire provider #112
- Branch: feat/openssl3-ed-xdh
- What: OpenSSL3 EdDSA/XDH; refactors key agreement; one‑shot uses accumulating helpers; uses ObjectIdentifier.* OIDs; provider wiring.
- Depends on: Core Core: Add EdDSA and XDH algorithm interfaces #109; references ASN.1 ASN.1: RFC 8410 OIDs, ABSENT params, Unknown key preservation, SEQUENCE OF support #108 (DER/PEM OIDs).
WebCrypto: Implement EdDSA and XDH; internal algorithms; wire provider #113 — WebCrypto: Implement EdDSA and XDH; internal algorithms; wire provider
- Link: WebCrypto: Implement EdDSA and XDH; internal algorithms; wire provider #113
- Branch: feat/webcrypto-ed-xdh
- What: WebCrypto EdDSA/XDH; internal algorithms mapping (common/js/wasm); uses ObjectIdentifier.* OIDs; provider wiring.
- Depends on: Core Core: Add EdDSA and XDH algorithm interfaces #109; references ASN.1 ASN.1: RFC 8410 OIDs, ABSENT params, Unknown key preservation, SEQUENCE OF support #108 where DER/PEM OIDs are used.
CryptoKit: Implement EdDSA and XDH; add Swift sources; wire provider #114 — CryptoKit: Implement EdDSA and XDH; add Swift sources; wire provider
- Link: CryptoKit: Implement EdDSA and XDH; add Swift sources; wire provider #114
- Branch: feat/cryptokit-ed-xdh
- What: CryptoKit Ed25519/X25519; decode unwrap‑to‑RAW + decodeRawWithRawRepresentation; encode hoists raw; inner classes renamed to *Key; uses ObjectIdentifier.* OIDs; provider wiring.
- Depends on: Core Core: Add EdDSA and XDH algorithm interfaces #109; references ASN.1 ASN.1: RFC 8410 OIDs, ABSENT params, Unknown key preservation, SEQUENCE OF support #108 (DER/PEM OIDs).

Tests

Tests: Add EdDSA/XDH default and compatibility suites; unify capability gating #115 — Tests: Add EdDSA/XDH default and compatibility suites; unify capability gating
- Link: Tests: Add EdDSA/XDH default and compatibility suites; unify capability gating #115
- Branch: tests/ed-xdh
- What: add default + compatibility tests for EdDSA/XDH; consolidate gating in support.kt; update generator. No runner/CI changes.
- Depends on: Core Core: Add EdDSA and XDH algorithm interfaces #109 to compile on CI.

Notes

All PRs target main with focused scope and no test/CI setup changes.
Providers and tests are blocked by Core (Core: Add EdDSA and XDH algorithm interfaces #109) to compile; ASN.1 (ASN.1: RFC 8410 OIDs, ABSENT params, Unknown key preservation, SEQUENCE OF support #108) provides OIDs used in DER/PEM code paths.
Provider Base (Providers/Base: Add accumulating sign/verify helpers #110) centralizes SPKI unwrap helper and accumulating helpers; providers already updated to use these.

whyoleg · 2025-09-07T14:39:53Z

Thanks for the split!
I will take a look at all of the PRs in detail in the coming days.
I do have a question: do you mind if I commit minor changes in those PRs, if I see that it will be faster/easier, compared to convincing AI to do the correct thing? :)
You will still be mentioned in commits, of course.

ariawisp · 2025-09-07T16:02:44Z

I don't mind at all, please do!

waltkb and others added 9 commits September 3, 2025 16:16

Add Ed (edwards curve), EdDSA (Ed25519/Ed448) and XDH (X25519/X448) i…

7367b5a

…nterfaces

Add JDK implementation for Ed (edwards curve), EdDSA (Ed25519/Ed448) …

713a4a7

…and XDH (X25519/X448) interfaces

Add new interfaces to JdkCryptographyProvider and format list

5c7dd76

Updated .api definitions

2c9c306

Change package name for Ed

83138af

Replace mentions of secp256k1

efb1b42

Add brainpool exclusion to support.kt

aae570f

Fix package names

28ba084

address PR comments and add apple-native approaches

c8488c9

whyoleg self-requested a review September 4, 2025 18:23

whyoleg requested changes Sep 4, 2025

View reviewed changes

ariawisp added 13 commits September 4, 2025 15:11

Cleanup: remove temp JSONL and stray internal comments

059212f

Remove WebCrypto engine detection machinery (Env files)

3d7885a

JDK XDH: add RAW key format support via PKCS8/SPKI wrap/unwrap (X2551…

0d2b4b1

…9/X448)

Remove leftover implementation notes in CryptoKit EdDSA/XDH files

a79fb64

Docs(CryptoKit): clarify that only Ed25519/X25519 are supported

9bb1ac2

ASN.1 modules: add Edwards/Montgomery OIDs and use them across provid…

cf445fb

…ers; Compatibility tests: include JWK for WebCrypto in EdDSA/XDH

OpenSSL EdDSA: reuse digest signature base with nullable hash (one-sh…

6952a3d

…ot path); JDK: unify RAW SPKI/PKCS#8 unwrap via helper; wire OID constants

Tests: gate EdDSA/XDH on Default JDK to >=15 to reflect availability;…

c105f80

… fix curve param decoding for EdDSA/XDH compat tests; adjust ASN.1 AlgorithmIdentifier to allow missing parameters (RFC 8410).

base: add AccumulatingSignFunction/VerifyFunction and use in CryptoKi…

88bc7d3

…t EdDSA\n\n- Extract accumulating signature update logic to provider-base\n- Replace CryptoKit EdDSA local functions with shared base impls

tests: split JDK gating — EdDSA since JDK 15, XDH since JDK 11

47766f6

tests: drop WebCrypto EdDSA/XDH skip rules; docs: add RFC links for E…

bb4b569

…dDSA (RFC 8032) and XDH (RFC 7748)

ariawisp requested a review from whyoleg September 5, 2025 01:47

whyoleg requested changes Sep 6, 2025

View reviewed changes

ariawisp marked this pull request as draft September 6, 2025 15:19

ariawisp closed this Sep 7, 2025

	* EdDSA/XDH: CryptoKit supports only Ed25519 and X25519. DER/PEM and RAW key encodings are available via the provider APIs.
	* EdDSA/XDH: supports only Ed25519 and X25519

		@@ -21,6 +21,7 @@ For supported targets and algorithms, please consult [Supported primitives secti

		* KeyFormat: doesn't support `JWK` key format yet

	* EdDSA/XDH: These algorithms were added later to WebCrypto and might not be available in all engines/browsers yet (see [RFC 8032] and [RFC 7748]). If unsupported, operations will fail at runtime with an error from the underlying engine.
	* EdDSA/XDH were added later to WebCrypto and might not be available in all browsers (https://github.com/w3c/webcrypto/pull/362)


		[RFC 8032]: https://www.rfc-editor.org/rfc/rfc8032
		[RFC 7748]: https://www.rfc-editor.org/rfc/rfc7748

Ed (edwards curve), EdDSA (Ed25519/Ed448) and XDH (X25519/X448) #105

Ed (edwards curve), EdDSA (Ed25519/Ed448) and XDH (X25519/X448) #105

Uh oh!

Conversation

ariawisp commented Sep 4, 2025

Uh oh!

whyoleg left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ariawisp commented Sep 5, 2025

Uh oh!

whyoleg left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ariawisp commented Sep 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ariawisp commented Sep 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Split PRs Overview: EdDSA/XDH Series

Merge Order (high level)

Foundation

Providers

Tests

Notes

Uh oh!

whyoleg commented Sep 7, 2025

Uh oh!

ariawisp commented Sep 7, 2025

Uh oh!

Uh oh!

ariawisp commented Sep 6, 2025 •

edited

Loading

ariawisp commented Sep 7, 2025 •

edited

Loading