fix: treat EdDSA and Ed25519 as equivalent for JWK infer

Map OKP crv Ed25519 to RFC 9864 EdDSAEd25519, and accept legacy JWK
alg "EdDSA" (and matching allowlist entries) as the same crypto.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: yaronf

crypto.go

@@ -335,7 +335,7 @@ func NewEd25519Verifier(key ed25519.PublicKey, config *VerifyConfig, fields Fiel
 // Preferred over NewJWSVerifierWithAlg when the key type uniquely determines the alg.
 //
 // Allowed key types:
-//   - jwk.Key with alg, or EC/OKP with unambiguous crv (P-256→ES256, …, Ed25519→EdDSA)
+//   - jwk.Key with alg, or EC/OKP with unambiguous crv (P-256→ES256, …, Ed25519→EdDSAEd25519; legacy JWK alg "EdDSA" also accepted)
 //   - *ecdsa.PublicKey (curve → ES256/384/512)
 //   - *mldsa.PublicKey (Parameters → ML-DSA-44/65/87)
 //

crypto_test.go

@@ -618,6 +618,14 @@ func TestJWSAlgAllowlist(t *testing.T) {
 	require.False(t, a.Contains(jwa.ES384()))
 	var nilAllow *JWSAlgAllowlist
 	require.False(t, nilAllow.Contains(jwa.ES256()))
+
+	edModern, err := NewJWSAlgAllowlist(jwa.EdDSAEd25519())
+	require.NoError(t, err)
+	require.True(t, edModern.Contains(jwa.EdDSAEd25519()))
+	require.True(t, edModern.Contains(jwa.EdDSA()), "legacy EdDSA aliases RFC 9864 Ed25519")
+	edLegacy, err := NewJWSAlgAllowlist(jwa.EdDSA())
+	require.NoError(t, err)
+	require.True(t, edLegacy.Contains(jwa.EdDSAEd25519()))
 }
 
 func TestNewJWSSignerSignAlg(t *testing.T) {

internal-docs/JWS-ALG-POLICY.md

@@ -135,13 +135,13 @@ config.SetFetchVerifier(func(r *http.Request) (string, *httpsign.Verifier) {
 | `key` type | How alg is chosen |
 | ---------- | ----------------- |
 | `jwk.Key` with `alg` | Use JWK `alg` |
-| `jwk.Key` EC/OKP without `alg` | `crv` → ES256/384/512 or EdDSA |
+| `jwk.Key` EC/OKP without `alg` | `crv` → ES256/384/512 or **EdDSAEd25519** (RFC 9864); legacy JWK `alg` `"EdDSA"` agrees with that mapping |
 | `jwk.Key` RSA/`oct`/AKP without `alg` | Error (RSA/HMAC ambiguous; AKP requires `alg` per RFC 9964) |
 | `*ecdsa.PublicKey` | Curve → ES256/384/512 |
 | `*mldsa.PublicKey` | `Parameters()` → ML-DSA-44/65/87 |
 | `*rsa.PublicKey`, `[]byte`, … | Error — `NewJWSVerifierWithAlg(allowed, alg, …)` or a JWK with `alg` |
 
-If JWK has both `alg` and a structural mapping and they **disagree** → error.
+If JWK has both `alg` and a structural mapping and they **disagree** → error. Legacy `"EdDSA"` and RFC 9864 `"Ed25519"` are **not** a disagreement (same Ed25519 crypto). `JWSAlgAllowlist.Contains` treats those two names as equivalent.
 
 After JWK → raw key for ML-DSA: cross-check `Parameters()` vs claimed `alg`.
 

jwsallow.go

@@ -52,12 +52,20 @@ func NewJWSAlgAllowlist(algs ...jwa.SignatureAlgorithm) (*JWSAlgAllowlist, error
 // Contains reports whether alg is permitted. A nil receiver does not contain any alg
 // (callers should treat nil allowlist as “skip policy” before calling Contains).
 // Comparison is by algorithm name string; constructors resolve to registry values first.
+// Legacy "EdDSA" and RFC 9864 "Ed25519" are treated as equivalent.
 func (a *JWSAlgAllowlist) Contains(alg jwa.SignatureAlgorithm) bool {
 	if a == nil {
 		return false
 	}
-	_, ok := a.algs[alg.String()]
-	return ok
+	if _, ok := a.algs[alg.String()]; ok {
+		return true
+	}
+	if !isEd25519JWSAlg(alg) {
+		return false
+	}
+	_, legacy := a.algs[jwa.EdDSA().String()]
+	_, modern := a.algs[jwa.EdDSAEd25519().String()]
+	return legacy || modern
 }
 
 func checkJWSAlgAllowed(allowed *JWSAlgAllowlist, alg jwa.SignatureAlgorithm) error {

jwsinfer.go

@@ -66,11 +66,12 @@ func inferFromJWK(key jwk.Key) (jwa.SignatureAlgorithm, any, error) {
 	var alg jwa.SignatureAlgorithm
 	switch {
 	case hasAlg && hasStruct:
-		if fromAlg.String() != fromStruct.String() {
+		if !jwsSignatureAlgsAgree(fromAlg, fromStruct) {
 			return jwa.EmptySignatureAlgorithm(), nil, fmt.Errorf(
 				"JWK alg %s disagrees with structural mapping %s", fromAlg, fromStruct,
 			)
 		}
+		// Prefer the JWK's stated alg; EdDSA ↔ Ed25519 are treated as agreeing (RFC 9864).
 		alg = fromAlg
 	case hasAlg:
 		alg = fromAlg
@@ -144,12 +145,31 @@ func algFromJWKCurve(crv jwa.EllipticCurveAlgorithm) (jwa.SignatureAlgorithm, er
 	case jwa.P521():
 		return jwa.ES512(), nil
 	case jwa.Ed25519():
-		return jwa.EdDSA(), nil
+		// RFC 9864 name; legacy JWK alg "EdDSA" still agrees via jwsSignatureAlgsAgree.
+		return jwa.EdDSAEd25519(), nil
 	default:
 		return jwa.EmptySignatureAlgorithm(), fmt.Errorf("cannot infer JWS algorithm from crv %s", crv)
 	}
 }
 
+// jwsSignatureAlgsAgree reports whether two registry algs are the same crypto choice.
+// Legacy "EdDSA" and RFC 9864 "Ed25519" both mean Ed25519 signatures in jwx v4.
+func jwsSignatureAlgsAgree(a, b jwa.SignatureAlgorithm) bool {
+	if a.String() == b.String() {
+		return true
+	}
+	return isEd25519JWSAlg(a) && isEd25519JWSAlg(b)
+}
+
+func isEd25519JWSAlg(alg jwa.SignatureAlgorithm) bool {
+	switch alg {
+	case jwa.EdDSA(), jwa.EdDSAEd25519():
+		return true
+	default:
+		return false
+	}
+}
+
 func algFromECDSACurve(curve elliptic.Curve) (jwa.SignatureAlgorithm, error) {
 	if curve == nil {
 		return jwa.EmptySignatureAlgorithm(), fmt.Errorf("ECDSA key has nil curve")

jwsinfer_test.go

@@ -139,12 +139,44 @@ func TestNewJWSVerifierFromJWK(t *testing.T) {
 		require.NotNil(t, v)
 	})
 
+	t.Run("ed25519 with RFC 9864 alg", func(t *testing.T) {
+		edJWK, err := jwk.Import[jwk.Key](edPub)
+		require.NoError(t, err)
+		require.NoError(t, edJWK.Set(jwk.AlgorithmKey, jwa.EdDSAEd25519()))
+		allowed, err := NewJWSAlgAllowlist(jwa.EdDSAEd25519())
+		require.NoError(t, err)
+		v, err := NewJWSVerifier(allowed, edJWK, nil, *NewFields())
+		require.NoError(t, err)
+		require.NotNil(t, v)
+	})
+
+	t.Run("ed25519 crv with modern allowlist", func(t *testing.T) {
+		edJWK, err := jwk.Import[jwk.Key](edPub)
+		require.NoError(t, err)
+		allowed, err := NewJWSAlgAllowlist(jwa.EdDSAEd25519())
+		require.NoError(t, err)
+		v, err := NewJWSVerifier(allowed, edJWK, nil, *NewFields())
+		require.NoError(t, err)
+		require.NotNil(t, v)
+	})
+
+	t.Run("ed25519 legacy alg with modern allowlist", func(t *testing.T) {
+		edJWK, err := jwk.Import[jwk.Key](edPub)
+		require.NoError(t, err)
+		require.NoError(t, edJWK.Set(jwk.AlgorithmKey, jwa.EdDSA()))
+		allowed, err := NewJWSAlgAllowlist(jwa.EdDSAEd25519())
+		require.NoError(t, err)
+		v, err := NewJWSVerifier(allowed, edJWK, nil, *NewFields())
+		require.NoError(t, err)
+		require.NotNil(t, v)
+	})
+
 	t.Run("ed25519 private jwk exports public", func(t *testing.T) {
 		edJWK, err := jwk.Import[jwk.Key](edPriv)
 		require.NoError(t, err)
 		alg, raw, err := inferFromJWK(edJWK)
 		require.NoError(t, err)
-		require.Equal(t, jwa.EdDSA().String(), alg.String())
+		require.Equal(t, jwa.EdDSAEd25519().String(), alg.String())
 		got, ok := raw.(ed25519.PublicKey)
 		require.True(t, ok)
 		require.Equal(t, edPub, got)
@@ -235,7 +267,7 @@ func TestAlgFromCurveHelpers(t *testing.T) {
 			{jwa.P256(), jwa.ES256()},
 			{jwa.P384(), jwa.ES384()},
 			{jwa.P521(), jwa.ES512()},
-			{jwa.Ed25519(), jwa.EdDSA()},
+			{jwa.Ed25519(), jwa.EdDSAEd25519()},
 		}
 		for _, tc := range cases {
 			got, err := algFromJWKCurve(tc.crv)
@@ -246,6 +278,12 @@ func TestAlgFromCurveHelpers(t *testing.T) {
 		require.Error(t, err)
 	})
 
+	t.Run("ed25519 alg aliases agree", func(t *testing.T) {
+		require.True(t, jwsSignatureAlgsAgree(jwa.EdDSA(), jwa.EdDSAEd25519()))
+		require.True(t, jwsSignatureAlgsAgree(jwa.EdDSAEd25519(), jwa.EdDSA()))
+		require.False(t, jwsSignatureAlgsAgree(jwa.EdDSA(), jwa.ES256()))
+	})
+
 	t.Run("ecdsa nil and unsupported", func(t *testing.T) {
 		_, err := algFromECDSACurve(nil)
 		require.Error(t, err)