psa-systems/bunyip
Watch
9
0
Fork
You've already forked bunyip
 0
Code Issues Pull requests Projects Releases 18 Packages Wiki Activity Actions

fix(oidc): use SHA-512 left-32 at_hash for EdDSA id_tokens #359

Merged
Claude-Run merged 1 commit from fix/BUNYIP-352-at-hash-sha512-eddsa into main 2026-07-11 03:48:48 +02:00
Conversation 0 Commits 1 Files changed 1 +46 -6
Claude-Run commented 2026-07-11 03:31:39 +02:00
Member
Copy link

Bunyip signs ID tokens with EdDSA (Ed25519) but computed the at_hash claim as base64url of the left 16 bytes of SHA-256, which is the RS256/ES256 construction. A conformant EdDSA relying party derives at_hash from the algorithm's internal hash (SHA-512 for Ed25519) and would reject the ID token on both the different digest and the different length. Switch to base64url(left 32 bytes of SHA-512(access_token)) so the OP is forward-compatible with a strict EdDSA RP. Kept identical to menkent's OP (MKT-60).

Extract the computation into an at_hash_eddsa helper and add a unit test asserting the value equals an independently computed SHA-512-left-32, that it is 43 unpadded base64url chars, and that it differs from the former SHA-256-left-16 value.

#BUNYIP-352

Bunyip signs ID tokens with EdDSA (Ed25519) but computed the at_hash claim as base64url of the left 16 bytes of SHA-256, which is the RS256/ES256 construction. A conformant EdDSA relying party derives at_hash from the algorithm's internal hash (SHA-512 for Ed25519) and would reject the ID token on both the different digest and the different length. Switch to base64url(left 32 bytes of SHA-512(access_token)) so the OP is forward-compatible with a strict EdDSA RP. Kept identical to menkent's OP (MKT-60). Extract the computation into an at_hash_eddsa helper and add a unit test asserting the value equals an independently computed SHA-512-left-32, that it is 43 unpadded base64url chars, and that it differs from the former SHA-256-left-16 value. #BUNYIP-352
fix(oidc): use SHA-512 left-32 at_hash for EdDSA id_tokens
All checks were successful
E2E / Playwright against deployment (pull_request) Successful in 8s
Details
Check / fmt + clippy + build + tests (pull_request) Successful in 16m53s
Details
Create release / Create release from merged PR (pull_request) Has been skipped
Details
f8687e2fdd 
Bunyip signs ID tokens with EdDSA (Ed25519) but computed the at_hash claim as base64url of the left 16 bytes of SHA-256, which is the RS256/ES256 construction. A conformant EdDSA relying party derives at_hash from the algorithm's internal hash (SHA-512 for Ed25519) and would reject the ID token on both the different digest and the different length. Switch to base64url(left 32 bytes of SHA-512(access_token)) so the OP is forward-compatible with a strict EdDSA RP. Kept identical to menkent's OP (MKT-60).

Extract the computation into an at_hash_eddsa helper and add a unit test asserting the value equals an independently computed SHA-512-left-32, that it is 43 unpadded base64url chars, and that it differs from the former SHA-256-left-16 value.

#BUNYIP-352
Claude-Run deleted branch fix/BUNYIP-352-at-hash-sha512-eddsa 2026-07-11 03:48:48 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
psa-systems/bunyip!359
No description provided.