Add RS256 support for NSS v5.x compatibility

melvincarvalho · melvincarvalho · commit ed84fee992be · 2026-01-01T02:03:22.000+01:00
NSS v5.x may only support RS256 for external IdP token verification.
This adds RS256 key generation alongside ES256, with RS256 as the
primary signing algorithm for better compatibility with older servers.
diff --git a/src/idp/keys.js b/src/idp/keys.js
@@ -21,16 +21,15 @@ function getJwksPath() {
 }
 
 /**
- * Generate a new EC P-256 key pair for signing
+ * Generate a new EC P-256 key pair for signing (ES256)
  * @returns {Promise<object>} - JWK key pair with private key
  */
-async function generateSigningKey() {
+async function generateES256Key() {
   const { publicKey, privateKey } = await jose.generateKeyPair('ES256', {
     extractable: true,
   });
 
   const privateJwk = await jose.exportJWK(privateKey);
-  const publicJwk = await jose.exportJWK(publicKey);
 
   // Add metadata
   const kid = crypto.randomUUID();
@@ -45,6 +44,44 @@ async function generateSigningKey() {
   };
 }
 
+/**
+ * Generate a new RSA key pair for signing (RS256)
+ * NSS v5.x may only support RS256 for external IdP verification
+ * @returns {Promise<object>} - JWK key pair with private key
+ */
+async function generateRS256Key() {
+  const { publicKey, privateKey } = await jose.generateKeyPair('RS256', {
+    modulusLength: 2048,
+    extractable: true,
+  });
+
+  const privateJwk = await jose.exportJWK(privateKey);
+
+  // Add metadata
+  const kid = crypto.randomUUID();
+  const now = Math.floor(Date.now() / 1000);
+
+  return {
+    ...privateJwk,
+    kid,
+    use: 'sig',
+    alg: 'RS256',
+    iat: now,
+  };
+}
+
+/**
+ * Generate signing keys (both ES256 and RS256 for compatibility)
+ * @returns {Promise<object[]>} - Array of JWK key pairs
+ */
+async function generateSigningKeys() {
+  // Generate RS256 first (primary, for NSS compatibility)
+  const rs256Key = await generateRS256Key();
+  // Also generate ES256 for modern clients
+  const es256Key = await generateES256Key();
+  return [rs256Key, es256Key];
+}
+
 /**
  * Generate cookie signing keys
  * @returns {string[]} - Array of random secret strings
@@ -66,25 +103,36 @@ export async function initializeKeys() {
   try {
     // Try to load existing keys
     const data = await fs.readJson(getJwksPath());
+
+    // Check if we have RS256 key (needed for NSS compatibility)
+    const hasRS256 = data.jwks.keys.some((k) => k.alg === 'RS256');
+    if (!hasRS256) {
+      console.log('Adding RS256 key for NSS compatibility...');
+      const rs256Key = await generateRS256Key();
+      data.jwks.keys.unshift(rs256Key); // RS256 first (primary)
+      await fs.writeJson(getJwksPath(), data, { spaces: 2 });
+      console.log('RS256 key added.');
+    }
+
     return data;
   } catch (err) {
     if (err.code !== 'ENOENT') throw err;
 
-    // Generate new keys
+    // Generate new keys (both RS256 and ES256)
     console.log('Generating new IdP signing keys...');
-    const signingKey = await generateSigningKey();
+    const signingKeys = await generateSigningKeys();
     const cookieKeys = generateCookieKeys();
 
     const data = {
       jwks: {
-        keys: [signingKey],
+        keys: signingKeys,
       },
       cookieKeys,
       createdAt: new Date().toISOString(),
     };
 
     await fs.writeJson(getJwksPath(), data, { spaces: 2 });
-    console.log('IdP signing keys generated and saved.');
+    console.log('IdP signing keys generated and saved (RS256 + ES256).');
 
     return data;
   }
@@ -100,7 +148,8 @@ export async function getPublicJwks() {
   // Return only public key components
   const publicKeys = jwks.keys.map((key) => {
     // For EC keys, remove 'd' (private key component)
-    const { d, ...publicKey } = key;
+    // For RSA keys, remove 'd', 'p', 'q', 'dp', 'dq', 'qi' (private components)
+    const { d, p, q, dp, dq, qi, ...publicKey } = key;
     return publicKey;
   });
 
diff --git a/src/idp/provider.js b/src/idp/provider.js
@@ -314,7 +314,7 @@ export async function createProvider(issuer) {
       grant_types: ['authorization_code', 'refresh_token'],
       response_types: ['code'],
       token_endpoint_auth_method: 'none', // Public clients by default
-      id_token_signed_response_alg: 'ES256', // ES256 is what we support
+      id_token_signed_response_alg: 'RS256', // RS256 for NSS compatibility
     },
 
     // Response modes
