tls: add Ed25519 certificate support#9452
Conversation
| ) | ||
| } | ||
|
|
||
| signedByKeyPair.private.algorithm == "Ed25519" || signedByKeyPair.private.algorithm == "EdDSA" -> { |
There was a problem hiding this comment.
Given differing providers, I'm worried about case sensitivity, can you audit how it's represented in providers, and maybe make it case insensitive, if it's not guaranteed by a spec.
| private fun generateKeyPair(): KeyPair = | ||
| KeyPairGenerator.getInstance(keyAlgorithm).run { | ||
| initialize(keySize, SecureRandom()) | ||
| if (keySize > 0) initialize(keySize, SecureRandom()) |
There was a problem hiding this comment.
Probably worth a comment since this affects other code paths.
|
|
||
| @Test | ||
| fun ed25519() { | ||
| platform.assumeNotAndroid() |
There was a problem hiding this comment.
This check is just in the tests, but if called by an app, we should have a useful error message.
Something like
Ed25519 requires JDK 15+ / a provider that supports it
| ) | ||
| } | ||
|
|
||
| signedByKeyPair.private.algorithm == "Ed25519" || signedByKeyPair.private.algorithm == "EdDSA" -> { |
There was a problem hiding this comment.
signedByKeyPair.private.algorithm == "EdDSA"
Is this check complete? or are there sub algorithms?
|
Failures HeldCertificateTest > ed25519() FAILED HeldCertificateTest > ed25519SignedByEcdsa() FAILED |
|
Thanks for running the tests! Fixed both issues — the NPE was caused by |
2 participants
Fixes #9437 - Ed25519 client certificates not being sent in mTLS setups.
Added Ed25519 support to okhttp-tls: new ed25519() builder method, proper key detection in decode(), and the Ed25519 OID in the DER layer.