Hey everyone! I am looking for an existing OpenID Connect provider that uses ES256. For instance, I’ve been browsing through Google’s OpenID Connect docs, but apparently they only support RS256. What I’m looking for is getting a JWT token signed with ES256 that asserts the identity of a user who has an account on the site. One restriction is that I don’t want to build an adapter from an existing signature to a different one. Thanks!
Currently the Auth0 service will issue ID tokens with RS256 or HS256 so I’m afraid we would also not meet that requirement at this time; I’m also not personally aware of one that uses it.
Out of curiosity which the use case/requirement/consideration that explicitly forced you to look at ES256?
1 Like
Thanks for the reply, @jmangelo!
The emerging OpenID Financial API spec forbids RS256 and requires ES256 or PS256. Are there any plans to support either?
To my knowledge there’s no work planned around that in the short term; I would recommend that you leave this as feedback in (Auth0: Secure access for everyone. But not just anyone.) because providing it through that channel ensures that our product team does not miss it.