search

WebOfTrustInfo / ld-signatures-java

Java implementation of Linked Data Signatures
Apache License 2.0
16 stars 15 forks source link

RsaSignature2018 with RSA_PS256 #12

Open vitorpamplona opened 2 years ago

vitorpamplona commented 2 years ago

Hi all!

I need a version of the RsaSignature2018LdVerifier with PS256 instead of RS256. Should I just send a PR with a copy of this class using a different algorithm name or should the RsaSignature2018LdVerifier itself handle multiple algorithms?

Thanks!

peacekeeper commented 2 years ago

Hello @vitorpamplona thanks for your comment.

Note that RsaSignature2018 has been marked as outdated: https://github.com/w3c-ccg/lds-rsa2018/

And the specification mentions only RS256, not PS256: https://w3c-ccg.github.io/lds-rsa2018/#the-2018-rsa-signature-suite

So even though both your suggested approaches would work, I think your first approach (use a different algorithm name) would be slightly better. If that works for you, feel free to open a PR!

vitorpamplona commented 2 years ago

Note that RsaSignature2018 has been marked as outdated: https://github.com/w3c-ccg/lds-rsa2018/

I know, but we have 1 billion Verifiable QRs (DIVOC) with RsaSignature2018 with PS256 :(

vitorpamplona commented 2 years ago

Since the new implementation is not following the spec, I am not sure if it should be merged into this lib. Maybe I just keep it into the app I am building. Thoughts? I am happy to send a quick PR if it makes sense.

peacekeeper commented 2 years ago

I agree it's probably best to keep in your app, unless you maybe also want to publish a specification of your modified signature suite somewhere.