<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">I haven’t been able to find a clean answer for this, but apologies if this is well-trodden already. </div><div class=""><br class=""></div>The ODIC spec defines at_hash (and c_hash and others) as using "the hash algorithm used is the hash algorithm
used in the <tt class="">alg</tt> Header Parameter
of the ID Token's JOSE Header”. This is clear enough for things like RS256 and the like.<div class=""><div class=""><br class=""></div><div class="">However, the definition of the “EdDSA” JOSE algorithm in RFC8037 (<a href="https://tools.ietf.org/html/rfc8037" class="">https://tools.ietf.org/html/rfc8037</a>) does not define a hash algorithm in the same way. Edwards signatures as defined in RFC8032 (<a href="https://tools.ietf.org/html/rfc8032" class="">https://tools.ietf.org/html/rfc8032</a>) seem to internally use SHA-512, but I’m not positive that’s every time or just in the case where you do the pre-hashing calculation. Regardless, the JOSE spec is silent on the matter. </div></div><div class=""><br class=""></div><div class="">So the question is: which hash algorithm do we use for an “EdDSA” signed token when calculating at_hash and its ilk?</div><div class=""><br class=""></div><div class=""> — Justin</div></body></html>