feat: adds EdDSA support

driver/registry_base.go

@@ -227,6 +227,7 @@ func (m *RegistryBase) KeyGenerators() map[string]jwk.KeyGenerator {
 			"ES512": &jwk.ECDSA512Generator{},
 			"HS256": &jwk.HS256Generator{},
 			"HS512": &jwk.HS512Generator{},
+			"EdDSA": &jwk.EdDSAGenerator{},
 		}
 	}
 	return m.kg

jwk/generator_eddsa.go

@@ -0,0 +1,41 @@
+package jwk
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/x509"
+
+	"github.com/pborman/uuid"
+	"github.com/pkg/errors"
+	"gopkg.in/square/go-jose.v2"
+)
+
+type EdDSAGenerator struct{}
+
+func (g *EdDSAGenerator) Generate(id, use string) (*jose.JSONWebKeySet, error) {
+	publicKey, privateKey, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		return nil, errors.Errorf("Could not generate key because %s", err)
+	}
+
+	if id == "" {
+		id = uuid.New()
+	}
+
+	return &jose.JSONWebKeySet{
+		Keys: []jose.JSONWebKey{
+			{
+				Key:          privateKey,
+				Use:          use,
+				KeyID:        Ider("private", id),
+				Certificates: []*x509.Certificate{},
+			},
+			{
+				Key:          publicKey,
+				Use:          use,
+				KeyID:        Ider("public", id),
+				Certificates: []*x509.Certificate{},
+			},
+		},
+	}, nil
+}

jwk/generator_test.go

@@ -92,6 +92,28 @@ func TestGenerator(t *testing.T) {
 				assert.Equal(t, "enc", ks.Keys[1].Use)
 			},
 		},
+		{
+			g:   &EdDSAGenerator{},
+			use: "sig",
+			check: func(ks *jose.JSONWebKeySet) {
+				assert.Len(t, ks, 2)
+				assert.NotEmpty(t, ks.Keys[0].Key)
+				assert.NotEmpty(t, ks.Keys[1].Key)
+				assert.Equal(t, "sig", ks.Keys[0].Use)
+				assert.Equal(t, "sig", ks.Keys[1].Use)
+			},
+		},
+		{
+			g:   &EdDSAGenerator{},
+			use: "enc",
+			check: func(ks *jose.JSONWebKeySet) {
+				assert.Len(t, ks, 2)
+				assert.NotEmpty(t, ks.Keys[0].Key)
+				assert.NotEmpty(t, ks.Keys[1].Key)
+				assert.Equal(t, "sig", ks.Keys[0].Use)
+				assert.Equal(t, "sig", ks.Keys[1].Use)
+			},
+		},
 	} {
 		t.Run(fmt.Sprintf("case=%d", k), func(t *testing.T) {
 			keys, err := c.g.Generate("foo", c.use)

jwk/helper.go

@@ -23,13 +23,12 @@ package jwk
 import (
 	"context"
 	"crypto/ecdsa"
+	"crypto/ed25519"
 	"crypto/rsa"
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
 
-	"golang.org/x/crypto/ed25519"
-
 	"github.com/ory/x/errorsx"
 
 	"github.com/ory/hydra/x"
@@ -136,7 +135,7 @@ func ExcludePrivateKeys(set *jose.JSONWebKeySet) *jose.JSONWebKeySet {
 
 	for _, k := range set.Keys {
 		_, ecdsaOk := k.Key.(*ecdsa.PublicKey)
-		_, ed25519OK := k.Key.(*ed25519.PublicKey)
+		_, ed25519OK := k.Key.(ed25519.PublicKey)
 		_, rsaOK := k.Key.(*rsa.PublicKey)
 
 		if ecdsaOk || ed25519OK || rsaOK {
@@ -172,6 +171,12 @@ func PEMBlockForKey(key interface{}) (*pem.Block, error) {
 			return nil, errorsx.WithStack(err)
 		}
 		return &pem.Block{Type: "EC PRIVATE KEY", Bytes: b}, nil
+	case ed25519.PrivateKey:
+		b, err := x509.MarshalPKCS8PrivateKey(k)
+		if err != nil {
+			return nil, errorsx.WithStack(err)
+		}
+		return &pem.Block{Type: "PRIVATE KEY", Bytes: b}, nil
 	default:
 		return nil, errors.New("Invalid key type")
 	}

jwk/helper_test.go

@@ -22,6 +22,7 @@ package jwk
 
 import (
 	"crypto/ecdsa"
+	"crypto/ed25519"
 	"crypto/rsa"
 	"testing"
 
@@ -77,6 +78,7 @@ func TestIder(t *testing.T) {
 func TestHandlerFindPublicKey(t *testing.T) {
 	var testRSGenerator = RS256Generator{}
 	var testECDSAGenerator = ECDSA256Generator{}
+	var testEdDSAGenerator = EdDSAGenerator{}
 
 	t.Run("Test_Helper/Run_FindPublicKey_With_RSA", func(t *testing.T) {
 		RSIDKS, _ := testRSGenerator.Generate("test-id-1", "sig")
@@ -93,4 +95,12 @@ func TestHandlerFindPublicKey(t *testing.T) {
 		assert.Equal(t, keys.KeyID, Ider("public", "test-id-2"))
 		assert.IsType(t, keys.Key, new(ecdsa.PublicKey))
 	})
+
+	t.Run("Test_Helper/Run_FindPublicKey_With_EdDSA", func(t *testing.T) {
+		EdDSAIDKS, _ := testEdDSAGenerator.Generate("test-id-3", "sig")
+		keys, err := FindPublicKey(EdDSAIDKS)
+		require.NoError(t, err)
+		assert.Equal(t, keys.KeyID, Ider("public", "test-id-3"))
+		assert.IsType(t, keys.Key, ed25519.PublicKey{})
+	})
 }