[Openid-specs-risc] openid/sharedsignals: New Issue opened

[github at oidf.org]

openid/sharedsignals event

Issue opened
Issue Title: CAEP Interop Profile: Event Signature Algorithm
https://github.com/openid/sharedsignals/issues/350

The proposed CAEP Interoperability Profile says: >[2.6. ](https://openid.net/specs/openid-caep-interoperability-profile-1_0.html#section-2.6)[Event Signatures](https://openid.net/specs/openid-caep-interoperability-profile-1_0.html#name-event-signatures) >All events MUST be signed using the RS256 algorithm with a minimum of 2048-bit keys. However, all security-conscious FAPI-based ecosystems regard RS256 as an insecure algorithm and prohibit its use. Would it not be somewhat inappropriate for the CAEP Interoperability Profile to limit the event signing algorithm to RS256 only? At the very least, shouldn't it also allow PS256, ES256, and EdDSA (with Ed25519), which are recommended in the [FAPI 2.0 Security Profile](https://openid.bitbucket.io/fapi/fapi-security-profile-2_0.html)?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openid.net/pipermail/openid-specs-risc/attachments/20260824/bb55ca57/attachment.htm>