Cryptographic algorithms¶

All the participants MUST expose the supported signature and encryption algorithms in their metadata. They are used for all encryption and signature operations required by OIDC core and Federation.

Note

The length of the RSA keys must be equal to or greater than 2048 bits. A length of 4096 bits is recommended.

In the SPID and CIE id the following algorithms MUST be supported:

Algorithm	Operations	References
RS256	Signature	OpenID.Core and RFC7518.
RS512	Signature	RFC7518
RSA-OAEP	Key Encryption	RFC7518.
RSA-OAEP-256	Key Encryption	RFC7516.
A128CBC-HS256	Content Encryption	RFC7516.
A256CBC-HS512	Content Encryption	RFC7516.

In the SPID and CIE id the following algorithms are RECOMMENDED to be supported:

Algorithm	Operations	References
ES256	Signature	OpenID.Core and RFC7518.
ES512	Signature	RFC7518.
PS256	Signature	RFC7518.
PS512	Signature	RFC7518.
ECDH-ES	Key Encryption	RFC7518.
ECDH-ES+A128KW	Key Encryption	RFC7518.
ECDH-ES+A256KW	Key Encryption	RFC7518.

In the SPID and CIE id the following algorithms MUST NOT be supported:

Algorithm	Operations	References
none	Signature	RFC7518.
RSA_1_5	Key Encryption	RFC7516.
HS256	Signature	RFC7518.
HS384	Signature	RFC7518.
HS512	Signature	RFC7518.

Docs Italia beta

Public documents, made digital.

Cryptographic algorithms¶