PS256 vs. RS256

[NationalAustraliaBank]

To enable the July 2019 release, NAB proposes the adoption of RS256 as per OIDC's default signing algorithm. The implementation of PS256 could lead to interoperability issues as its implementation is more complex than RS256.

[davidgtonge]

Is the implementation more complex?
On many platforms it is a simple flag to send to the underlying crypto libraries?

For example to use RSA_PKCS1_PSS_PADDING instead of RSA_PKCS1_PADDING

[NationalAustraliaBank]

@davidgtonge - NAB believes the use of PSS will create additional challenges for the July 2019 pilot, due to limited support of PSS in JWT libraries.
 
Participants may need to leverage 3rd party crypto libraries which could potentially create interoperability issues. For example, PSS support was only added to the core Java in May 2018 and as such requires an upgrade to Java 11 (https://bugs.java.com/bugdatabase/view_bug.do?bug_id=8146293)

However the recent updates to the timelines may reduce the perceived impact, as it will allow for interoperability testing and troubleshooting.

[jogu]

PS256 support on java doesn't require java11; for example https://bitbucket.org/connect2id/nimbus-jose-jwt/wiki/Home supports PS256 on earlier versions.

The library list on https://jwt.io now lists the status of PS256 support, and the results are not too bad.

It's worth noting that using RS256 as a temporary measure and later switching to PS256 may not be a simple transition to manage either. OpenBanking in the UK currently plan to make the transition from RS256 to PS256 next month (i.e. March 2019) and the feeling so far seems to be that there is no significant issue in doing so.

[JamesMBligh]

After looking in to this issue it would appear that the additional impact of aligning on PS256 would not be prohibitive for any near term dates. Also, it is clear we would simply require an upgrade to be managed in the next six months anyway. With the delays in the regime commencement schedule the arguments for excluding PS256 are also diminished.

As a result the standard will retain a requirement for PS256.

-JB-