Is EdDSA supported in the browser?

[nerdo]

I couldn't seem to find a definitive answer from documentation. I ran into this while testing code to import and use a key to sign a JWT, similar to the following:

import { SignJWT, importPKCS8 } from 'jose'

const algorithm = 'EdDSA'
const pemKey = "..."

// throws an error DOMException: Operation is not supported
const privateKey = await importPKCS8(pemKey, algorithm)

I've since switched to a different key type but I'm curious, is this expected behavior?

[panva]

This browser specific support status issue is linked from the project's readme.

EdDSA is not supported in browser runtimes because they have not yet adopted https://wicg.github.io/webcrypto-secure-curves/

Edit 2023: Some browsers now have an implementation of EdDSA behind a flag. The library does have the code to make EdDSA work with WebCryptoAPI the moment these get unflagged in the browser. #263 will be updated the moment browsers support it, the projects automation will pick it up and alert me when finally supported by a stable browser release.

[reuzel]

Is there a way in the library to figure out, given the underlying runtime what algorithms are supported? If not, do you know of a library that does? I would like to populate the supported signing and encryption by analysis of system capabilities rather than through manual configuration...

[panva]

Is there a way in the library to figure out, given the underlying runtime what algorithms are supported?

I maintain the different runtime-specific issues linked from the README. But there is no programmatic way in the library, since runtimes evolve having this mapping in the library would eventually become stale.

If not, do you know of a library that does?

No.

I would like to populate the supported signing and encryption by analysis of system capabilities rather than through manual configuration...

You're free to do so using the mapping in the aforementioned issues but know that they will become stale eventually. WebCryptoAPI does not have a discovery mechanism other than blindly trying to generate keys and getting success/failure.

[reuzel]

Clear. Thanks for the swift response. I will do a manual configuration after all...