JWT Signing with EdDSA in Java: Complete Implementation Guide

EdDSA (Edwards-curve Digital Signature Algorithm) is a modern, high-performance digital signature scheme that's particularly well-suited for JWT signing. This guide covers comprehensive EdDSA JWT implementation in Java.

Table of Contents

Understanding EdDSA for JWT

Why EdDSA for JWT?

Performance: Faster than RSA and ECDSA
Security: Strong security with smaller keys
Compact: Smaller signature sizes
Deterministic: No need for random number generation during signing

Dependencies and Setup

Maven Configuration

<!-- pom.xml -->
<project>
<modelVersion>4.0.0</modelVersion>
<groupId>com.jwt.eddsa</groupId>
<artifactId>jwt-eddsa-demo</artifactId>
<version>1.0.0</version>
<properties>
<maven.compiler.source>17</maven.compiler.source>
<maven.compiler.target>17</maven.compiler.target>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<jjwt.version>0.12.3</jjwt.version>
<bouncycastle.version>1.75</bouncycastle.version>
</properties>
<dependencies>
<!-- JJWT for JWT handling -->
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-api</artifactId>
<version>${jjwt.version}</version>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-impl</artifactId>
<version>${jjwt.version}</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>io.jsonwebtoken</groupId>
<artifactId>jjwt-jackson</artifactId>
<version>${jjwt.version}</version>
<scope>runtime</scope>
</dependency>
<!-- Bouncy Castle for EdDSA support -->
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk18on</artifactId>
<version>${bouncycastle.version}</version>
</dependency>
<!-- For JSON processing -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.15.2</version>
</dependency>
<!-- Testing -->
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter</artifactId>
<version>5.10.0</version>
<scope>test</scope>
</dependency>
</dependencies>
</project>

Core EdDSA JWT Implementation

Example 1: Key Pair Generation and Management

package com.jwt.eddsa;
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import java.security.*;
import java.security.spec.*;
import java.util.Base64;
public class EdDSAKeyGenerator {
static {
Security.addProvider(new BouncyCastleProvider());
}
// EdDSA curve names
public static final String ED25519 = "Ed25519";
public static final String ED448 = "Ed448";
/**
* Generate EdDSA key pair
*/
public static KeyPair generateKeyPair(String algorithm) throws NoSuchAlgorithmException, 
InvalidAlgorithmParameterException {
KeyPairGenerator keyGen = KeyPairGenerator.getInstance(algorithm, "BC");
if (ED25519.equals(algorithm)) {
keyGen.initialize(255);
} else if (ED448.equals(algorithm)) {
keyGen.initialize(448);
} else {
throw new IllegalArgumentException("Unsupported algorithm: " + algorithm);
}
return keyGen.generateKeyPair();
}
/**
* Encode public key to Base64 string
*/
public static String encodePublicKey(PublicKey publicKey) {
return Base64.getUrlEncoder().withoutPadding().encodeToString(publicKey.getEncoded());
}
/**
* Encode private key to Base64 string
*/
public static String encodePrivateKey(PrivateKey privateKey) {
return Base64.getUrlEncoder().withoutPadding().encodeToString(privateKey.getEncoded());
}
/**
* Decode public key from Base64 string
*/
public static PublicKey decodePublicKey(String base64Key, String algorithm) 
throws GeneralSecurityException {
byte[] keyBytes = Base64.getUrlDecoder().decode(base64Key);
KeyFactory keyFactory = KeyFactory.getInstance(algorithm, "BC");
X509EncodedKeySpec keySpec = new X509EncodedKeySpec(keyBytes);
return keyFactory.generatePublic(keySpec);
}
/**
* Decode private key from Base64 string
*/
public static PrivateKey decodePrivateKey(String base64Key, String algorithm) 
throws GeneralSecurityException {
byte[] keyBytes = Base64.getUrlDecoder().decode(base64Key);
KeyFactory keyFactory = KeyFactory.getInstance(algorithm, "BC");
PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(keyBytes);
return keyFactory.generatePrivate(keySpec);
}
/**
* Generate key pair and return as encoded strings
*/
public static KeyPairStrings generateKeyPairStrings(String algorithm) 
throws GeneralSecurityException {
KeyPair keyPair = generateKeyPair(algorithm);
KeyPairStrings keyStrings = new KeyPairStrings();
keyStrings.setPublicKey(encodePublicKey(keyPair.getPublic()));
keyStrings.setPrivateKey(encodePrivateKey(keyPair.getPrivate()));
keyStrings.setAlgorithm(algorithm);
return keyStrings;
}
/**
* Get key information
*/
public static KeyInfo getKeyInfo(KeyPair keyPair) {
KeyInfo info = new KeyInfo();
info.setAlgorithm(keyPair.getPublic().getAlgorithm());
info.setFormat(keyPair.getPublic().getFormat());
info.setEncodedLength(keyPair.getPublic().getEncoded().length);
if (keyPair.getPublic() instanceof EdECPublicKey) {
EdECPublicKey edKey = (EdECPublicKey) keyPair.getPublic();
info.setParams(edKey.getParams().getName());
}
return info;
}
}
// Data classes for key management
class KeyPairStrings {
private String publicKey;
private String privateKey;
private String algorithm;
// Getters and setters
public String getPublicKey() { return publicKey; }
public void setPublicKey(String publicKey) { this.publicKey = publicKey; }
public String getPrivateKey() { return privateKey; }
public void setPrivateKey(String privateKey) { this.privateKey = privateKey; }
public String getAlgorithm() { return algorithm; }
public void setAlgorithm(String algorithm) { this.algorithm = algorithm; }
}
class KeyInfo {
private String algorithm;
private String format;
private int encodedLength;
private String params;
// Getters and setters
public String getAlgorithm() { return algorithm; }
public void setAlgorithm(String algorithm) { this.algorithm = algorithm; }
public String getFormat() { return format; }
public void setFormat(String format) { this.format = format; }
public int getEncodedLength() { return encodedLength; }
public void setEncodedLength(int encodedLength) { this.encodedLength = encodedLength; }
public String getParams() { return params; }
public void setParams(String params) { this.params = params; }
@Override
public String toString() {
return String.format(
"KeyInfo{algorithm='%s', format='%s', encodedLength=%d, params='%s'}",
algorithm, format, encodedLength, params
);
}
}

Example 2: JWT Service with EdDSA

package com.jwt.eddsa;
import io.jsonwebtoken.*;
import io.jsonwebtoken.security.Keys;
import io.jsonwebtoken.security.SignatureException;
import java.security.KeyPair;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.time.Instant;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
public class EdDSAJwtService {
private final String issuer;
private final long accessTokenExpiration;
private final long refreshTokenExpiration;
public EdDSAJwtService(String issuer, long accessTokenExpiration, long refreshTokenExpiration) {
this.issuer = issuer;
this.accessTokenExpiration = accessTokenExpiration;
this.refreshTokenExpiration = refreshTokenExpiration;
}
/**
* Create access token with EdDSA signing
*/
public String createAccessToken(KeyPair keyPair, String subject, Map<String, Object> claims) {
return createToken(keyPair, subject, claims, accessTokenExpiration);
}
/**
* Create refresh token with EdDSA signing
*/
public String createRefreshToken(KeyPair keyPair, String subject) {
Map<String, Object> claims = new HashMap<>();
claims.put("token_type", "refresh");
return createToken(keyPair, subject, claims, refreshTokenExpiration);
}
/**
* Create JWT token with EdDSA signing
*/
private String createToken(KeyPair keyPair, String subject, Map<String, Object> claims, 
long expirationMs) {
Instant now = Instant.now();
Instant expiration = now.plusMillis(expirationMs);
JwtBuilder builder = Jwts.builder()
.setIssuer(issuer)
.setSubject(subject)
.setIssuedAt(Date.from(now))
.setExpiration(Date.from(expiration))
.signWith(keyPair.getPrivate(), getSignatureAlgorithm(keyPair));
// Add custom claims
if (claims != null) {
claims.forEach(builder::claim);
}
// Add key ID if available
String keyId = getKeyId(keyPair.getPublic());
if (keyId != null) {
builder.setHeaderParam("kid", keyId);
}
return builder.compact();
}
/**
* Parse and validate JWT token
*/
public JwtClaims parseToken(String token, PublicKey publicKey) throws JwtException {
try {
Jws<Claims> jws = Jwts.parserBuilder()
.setSigningKey(publicKey)
.build()
.parseClaimsJws(token);
Claims claims = jws.getBody();
JwtClaims result = new JwtClaims();
result.setSubject(claims.getSubject());
result.setIssuer(claims.getIssuer());
result.setIssuedAt(claims.getIssuedAt().toInstant());
result.setExpiration(claims.getExpiration().toInstant());
result.setClaims(new HashMap<>(claims));
// Remove standard claims from custom claims
result.getClaims().remove("sub");
result.getClaims().remove("iss");
result.getClaims().remove("iat");
result.getClaims().remove("exp");
return result;
} catch (ExpiredJwtException e) {
throw new JwtException("Token expired", e);
} catch (UnsupportedJwtException e) {
throw new JwtException("Unsupported token", e);
} catch (MalformedJwtException e) {
throw new JwtException("Malformed token", e);
} catch (SignatureException e) {
throw new JwtException("Invalid signature", e);
} catch (IllegalArgumentException e) {
throw new JwtException("Invalid token", e);
}
}
/**
* Refresh access token using refresh token
*/
public String refreshAccessToken(String refreshToken, KeyPair keyPair, 
PublicKey verificationKey) throws JwtException {
JwtClaims claims = parseToken(refreshToken, verificationKey);
if (!"refresh".equals(claims.getClaims().get("token_type"))) {
throw new JwtException("Invalid refresh token");
}
// Create new access token with same subject
Map<String, Object> newClaims = new HashMap<>(claims.getClaims());
newClaims.remove("token_type"); // Remove refresh token specific claim
return createAccessToken(keyPair, claims.getSubject(), newClaims);
}
/**
* Validate token without parsing claims (fast validation)
*/
public boolean validateToken(String token, PublicKey publicKey) {
try {
Jwts.parserBuilder()
.setSigningKey(publicKey)
.build()
.parseClaimsJws(token);
return true;
} catch (JwtException e) {
return false;
}
}
/**
* Get signature algorithm based on key type
*/
private SignatureAlgorithm getSignatureAlgorithm(KeyPair keyPair) {
String algorithm = keyPair.getPrivate().getAlgorithm();
switch (algorithm) {
case "Ed25519":
return SignatureAlgorithm.Ed25519;
case "Ed448":
return SignatureAlgorithm.Ed448;
default:
throw new IllegalArgumentException("Unsupported algorithm: " + algorithm);
}
}
/**
* Generate key ID from public key (SHA-256 hash)
*/
private String getKeyId(PublicKey publicKey) {
try {
java.security.MessageDigest md = java.security.MessageDigest.getInstance("SHA-256");
byte[] hash = md.digest(publicKey.getEncoded());
return bytesToHex(hash).substring(0, 16); // Use first 16 chars as key ID
} catch (Exception e) {
return null;
}
}
private String bytesToHex(byte[] bytes) {
StringBuilder result = new StringBuilder();
for (byte b : bytes) {
result.append(String.format("%02x", b));
}
return result.toString();
}
}
// JWT Claims data class
class JwtClaims {
private String subject;
private String issuer;
private Instant issuedAt;
private Instant expiration;
private Map<String, Object> claims;
// Getters and setters
public String getSubject() { return subject; }
public void setSubject(String subject) { this.subject = subject; }
public String getIssuer() { return issuer; }
public void setIssuer(String issuer) { this.issuer = issuer; }
public Instant getIssuedAt() { return issuedAt; }
public void setIssuedAt(Instant issuedAt) { this.issuedAt = issuedAt; }
public Instant getExpiration() { return expiration; }
public void setExpiration(Instant expiration) { this.expiration = expiration; }
public Map<String, Object> getClaims() { return claims; }
public void setClaims(Map<String, Object> claims) { this.claims = claims; }
public boolean isExpired() {
return Instant.now().isAfter(expiration);
}
public long getSecondsUntilExpiration() {
return Instant.now().until(expiration, java.time.temporal.ChronoUnit.SECONDS);
}
}
// Custom JWT exception
class JwtException extends Exception {
public JwtException(String message) {
super(message);
}
public JwtException(String message, Throwable cause) {
super(message, cause);
}
}

Example 3: Advanced JWT Claims and Validation

package com.jwt.eddsa;
import java.time.Instant;
import java.util.*;
public class AdvancedJwtService {
private final EdDSAJwtService jwtService;
public AdvancedJwtService(EdDSAJwtService jwtService) {
this.jwtService = jwtService;
}
/**
* Create token with advanced claims
*/
public String createAdvancedToken(KeyPair keyPair, TokenRequest request) throws JwtException {
Map<String, Object> claims = new HashMap<>();
// Standard claims
claims.put("token_type", request.getTokenType());
claims.put("scope", request.getScopes());
claims.put("aud", request.getAudience());
// Custom claims
claims.put("user_id", request.getUserId());
claims.put("roles", request.getRoles());
claims.put("permissions", request.getPermissions());
// Security claims
claims.put("auth_time", Instant.now().getEpochSecond());
claims.put("jti", UUID.randomUUID().toString()); // Unique token ID
// Device context
if (request.getDeviceContext() != null) {
claims.put("device_id", request.getDeviceContext().getDeviceId());
claims.put("device_trust_level", request.getDeviceContext().getTrustLevel());
}
// Add not before claim if specified
if (request.getNotBefore() != null) {
claims.put("nbf", request.getNotBefore().getEpochSecond());
}
return jwtService.createAccessToken(keyPair, request.getSubject(), claims);
}
/**
* Validate token with comprehensive checks
*/
public TokenValidationResult validateTokenComprehensive(String token, PublicKey publicKey, 
ValidationContext context) {
TokenValidationResult result = new TokenValidationResult();
try {
JwtClaims claims = jwtService.parseToken(token, publicKey);
result.setClaims(claims);
// Check expiration
if (claims.isExpired()) {
result.addError("Token expired");
}
// Check issuer
if (context.getExpectedIssuer() != null && 
!context.getExpectedIssuer().equals(claims.getIssuer())) {
result.addError("Invalid issuer");
}
// Check audience
if (context.getExpectedAudience() != null && 
claims.getClaims().containsKey("aud")) {
Object aud = claims.getClaims().get("aud");
if (aud instanceof String) {
if (!context.getExpectedAudience().equals(aud)) {
result.addError("Invalid audience");
}
} else if (aud instanceof List) {
if (!((List<?>) aud).contains(context.getExpectedAudience())) {
result.addError("Invalid audience");
}
}
}
// Check not before
if (claims.getClaims().containsKey("nbf")) {
Instant nbf = Instant.ofEpochSecond(((Number) claims.getClaims().get("nbf")).longValue());
if (Instant.now().isBefore(nbf)) {
result.addError("Token not yet valid");
}
}
// Check token type
if (context.getExpectedTokenType() != null) {
Object tokenType = claims.getClaims().get("token_type");
if (!context.getExpectedTokenType().equals(tokenType)) {
result.addError("Invalid token type");
}
}
// Check scopes
if (context.getRequiredScopes() != null && !context.getRequiredScopes().isEmpty()) {
Object scopeObj = claims.getClaims().get("scope");
if (scopeObj instanceof String) {
Set<String> tokenScopes = new HashSet<>(Arrays.asList(((String) scopeObj).split(" ")));
if (!tokenScopes.containsAll(context.getRequiredScopes())) {
result.addError("Insufficient scopes");
}
}
}
// Check custom business rules
validateBusinessRules(claims, context, result);
} catch (JwtException e) {
result.addError("Token validation failed: " + e.getMessage());
}
result.setValid(result.getErrors().isEmpty());
return result;
}
/**
* Extract specific claim with type safety
*/
public <T> T getClaim(String token, PublicKey publicKey, String claimName, Class<T> claimType) 
throws JwtException {
JwtClaims claims = jwtService.parseToken(token, publicKey);
Object value = claims.getClaims().get(claimName);
if (value == null) {
return null;
}
if (!claimType.isInstance(value)) {
throw new JwtException("Claim '" + claimName + "' is not of type " + claimType.getSimpleName());
}
return claimType.cast(value);
}
/**
* Get token metadata without validating signature
*/
public TokenMetadata getTokenMetadata(String token) {
try {
// Split JWT into parts
String[] parts = token.split("\\.");
if (parts.length != 3) {
throw new IllegalArgumentException("Invalid JWT format");
}
// Decode header
String headerJson = new String(Base64.getUrlDecoder().decode(parts[0]));
Map<String, Object> header = parseJson(headerJson);
// Decode payload without validation
String payloadJson = new String(Base64.getUrlDecoder().decode(parts[1]));
Map<String, Object> payload = parseJson(payloadJson);
TokenMetadata metadata = new TokenMetadata();
metadata.setAlgorithm((String) header.get("alg"));
metadata.setKeyId((String) header.get("kid"));
metadata.setType((String) header.get("typ"));
if (payload.containsKey("exp")) {
long exp = ((Number) payload.get("exp")).longValue();
metadata.setExpiration(Instant.ofEpochSecond(exp));
}
if (payload.containsKey("sub")) {
metadata.setSubject((String) payload.get("sub"));
}
metadata.setSignatureLength(parts[2].length());
return metadata;
} catch (Exception e) {
throw new JwtException("Failed to parse token metadata", e);
}
}
private void validateBusinessRules(JwtClaims claims, ValidationContext context, 
TokenValidationResult result) {
// Implement custom business logic validation
// Example: Check if user is active
Boolean isActive = (Boolean) claims.getClaims().get("user_active");
if (isActive != null && !isActive) {
result.addError("User account is inactive");
}
// Example: Check device trust level
Object trustLevel = claims.getClaims().get("device_trust_level");
if (trustLevel != null && "low".equals(trustLevel) && context.isHighSecurityRequired()) {
result.addError("Device trust level too low for this operation");
}
// Example: Check token usage count
if (claims.getClaims().containsKey("usage_count")) {
int usageCount = ((Number) claims.getClaims().get("usage_count")).intValue();
if (usageCount > context.getMaxUsageCount()) {
result.addError("Token usage limit exceeded");
}
}
}
@SuppressWarnings("unchecked")
private Map<String, Object> parseJson(String json) {
try {
com.fasterxml.jackson.databind.ObjectMapper mapper = new com.fasterxml.jackson.databind.ObjectMapper();
return mapper.readValue(json, Map.class);
} catch (Exception e) {
throw new RuntimeException("Failed to parse JSON", e);
}
}
}
// Request and result classes
class TokenRequest {
private String subject;
private String userId;
private String tokenType;
private List<String> scopes;
private String audience;
private List<String> roles;
private List<String> permissions;
private DeviceContext deviceContext;
private Instant notBefore;
// Getters and setters
public String getSubject() { return subject; }
public void setSubject(String subject) { this.subject = subject; }
public String getUserId() { return userId; }
public void setUserId(String userId) { this.userId = userId; }
public String getTokenType() { return tokenType; }
public void setTokenType(String tokenType) { this.tokenType = tokenType; }
public List<String> getScopes() { return scopes; }
public void setScopes(List<String> scopes) { this.scopes = scopes; }
public String getAudience() { return audience; }
public void setAudience(String audience) { this.audience = audience; }
public List<String> getRoles() { return roles; }
public void setRoles(List<String> roles) { this.roles = roles; }
public List<String> getPermissions() { return permissions; }
public void setPermissions(List<String> permissions) { this.permissions = permissions; }
public DeviceContext getDeviceContext() { return deviceContext; }
public void setDeviceContext(DeviceContext deviceContext) { this.deviceContext = deviceContext; }
public Instant getNotBefore() { return notBefore; }
public void setNotBefore(Instant notBefore) { this.notBefore = notBefore; }
}
class DeviceContext {
private String deviceId;
private String deviceType;
private String trustLevel;
// Getters and setters
public String getDeviceId() { return deviceId; }
public void setDeviceId(String deviceId) { this.deviceId = deviceId; }
public String getDeviceType() { return deviceType; }
public void setDeviceType(String deviceType) { this.deviceType = deviceType; }
public String getTrustLevel() { return trustLevel; }
public void setTrustLevel(String trustLevel) { this.trustLevel = trustLevel; }
}
class ValidationContext {
private String expectedIssuer;
private String expectedAudience;
private String expectedTokenType;
private Set<String> requiredScopes;
private boolean highSecurityRequired;
private int maxUsageCount = Integer.MAX_VALUE;
// Getters and setters
public String getExpectedIssuer() { return expectedIssuer; }
public void setExpectedIssuer(String expectedIssuer) { this.expectedIssuer = expectedIssuer; }
public String getExpectedAudience() { return expectedAudience; }
public void setExpectedAudience(String expectedAudience) { this.expectedAudience = expectedAudience; }
public String getExpectedTokenType() { return expectedTokenType; }
public void setExpectedTokenType(String expectedTokenType) { this.expectedTokenType = expectedTokenType; }
public Set<String> getRequiredScopes() { return requiredScopes; }
public void setRequiredScopes(Set<String> requiredScopes) { this.requiredScopes = requiredScopes; }
public boolean isHighSecurityRequired() { return highSecurityRequired; }
public void setHighSecurityRequired(boolean highSecurityRequired) { this.highSecurityRequired = highSecurityRequired; }
public int getMaxUsageCount() { return maxUsageCount; }
public void setMaxUsageCount(int maxUsageCount) { this.maxUsageCount = maxUsageCount; }
}
class TokenValidationResult {
private boolean valid;
private JwtClaims claims;
private List<String> errors = new ArrayList<>();
// Getters and setters
public boolean isValid() { return valid; }
public void setValid(boolean valid) { this.valid = valid; }
public JwtClaims getClaims() { return claims; }
public void setClaims(JwtClaims claims) { this.claims = claims; }
public List<String> getErrors() { return errors; }
public void setErrors(List<String> errors) { this.errors = errors; }
public void addError(String error) {
this.errors.add(error);
}
public String getErrorSummary() {
return String.join("; ", errors);
}
}
class TokenMetadata {
private String algorithm;
private String keyId;
private String type;
private String subject;
private Instant expiration;
private int signatureLength;
// Getters and setters
public String getAlgorithm() { return algorithm; }
public void setAlgorithm(String algorithm) { this.algorithm = algorithm; }
public String getKeyId() { return keyId; }
public void setKeyId(String keyId) { this.keyId = keyId; }
public String getType() { return type; }
public void setType(String type) { this.type = type; }
public String getSubject() { return subject; }
public void setSubject(String subject) { this.subject = subject; }
public Instant getExpiration() { return expiration; }
public void setExpiration(Instant expiration) { this.expiration = expiration; }
public int getSignatureLength() { return signatureLength; }
public void setSignatureLength(int signatureLength) { this.signatureLength = signatureLength; }
}

Example 4: Key Rotation and Management

package com.jwt.eddsa;
import java.security.*;
import java.time.Instant;
import java.util.*;
import java.util.concurrent.ConcurrentHashMap;
public class KeyManager {
private final Map<String, KeyEntry> keys = new ConcurrentHashMap<>();
private final String currentKeyId;
public KeyManager() throws GeneralSecurityException {
// Generate initial key pair
KeyPair keyPair = EdDSAKeyGenerator.generateKeyPair(EdDSAKeyGenerator.ED25519);
this.currentKeyId = addKey(keyPair, "Initial key", true);
}
/**
* Add a new key to the manager
*/
public String addKey(KeyPair keyPair, String description, boolean setAsCurrent) 
throws GeneralSecurityException {
String keyId = generateKeyId(keyPair.getPublic());
KeyEntry entry = new KeyEntry();
entry.setKeyPair(keyPair);
entry.setKeyId(keyId);
entry.setDescription(description);
entry.setCreatedAt(Instant.now());
entry.setActive(true);
keys.put(keyId, entry);
if (setAsCurrent) {
this.currentKeyId = keyId;
}
return keyId;
}
/**
* Get current key pair
*/
public KeyPair getCurrentKeyPair() {
KeyEntry entry = keys.get(currentKeyId);
return entry != null ? entry.getKeyPair() : null;
}
/**
* Get public key by key ID
*/
public PublicKey getPublicKey(String keyId) {
KeyEntry entry = keys.get(keyId);
return entry != null ? entry.getKeyPair().getPublic() : null;
}
/**
* Rotate to a new key
*/
public String rotateKey() throws GeneralSecurityException {
// Generate new key pair
KeyPair newKeyPair = EdDSAKeyGenerator.generateKeyPair(EdDSAKeyGenerator.ED25519);
String newKeyId = addKey(newKeyPair, "Rotated key", true);
// Mark old keys as inactive after a grace period
scheduleKeyDeactivation(currentKeyId);
return newKeyId;
}
/**
* Validate token with key rotation support
*/
public JwtClaims validateTokenWithKeyRotation(String token) throws JwtException {
// Extract key ID from token header
String keyId = extractKeyIdFromToken(token);
if (keyId == null) {
throw new JwtException("No key ID in token");
}
// Try to get the public key
PublicKey publicKey = getPublicKey(keyId);
if (publicKey == null) {
throw new JwtException("Unknown key ID: " + keyId);
}
KeyEntry keyEntry = keys.get(keyId);
if (!keyEntry.isActive()) {
throw new JwtException("Key is no longer active: " + keyId);
}
// Parse token with the appropriate key
EdDSAJwtService jwtService = new EdDSAJwtService("issuer", 3600000, 86400000);
return jwtService.parseToken(token, publicKey);
}
/**
* Get all active keys
*/
public List<KeyEntry> getActiveKeys() {
List<KeyEntry> activeKeys = new ArrayList<>();
for (KeyEntry entry : keys.values()) {
if (entry.isActive()) {
activeKeys.add(entry);
}
}
return activeKeys;
}
/**
* Get key statistics
*/
public KeyStatistics getKeyStatistics() {
KeyStatistics stats = new KeyStatistics();
stats.setTotalKeys(keys.size());
int activeCount = 0;
Instant oldestCreation = Instant.now();
for (KeyEntry entry : keys.values()) {
if (entry.isActive()) {
activeCount++;
}
if (entry.getCreatedAt().isBefore(oldestCreation)) {
oldestCreation = entry.getCreatedAt();
}
}
stats.setActiveKeys(activeCount);
stats.setInactiveKeys(keys.size() - activeCount);
stats.setOldestKeyAge(java.time.Duration.between(oldestCreation, Instant.now()));
return stats;
}
private String generateKeyId(PublicKey publicKey) throws GeneralSecurityException {
MessageDigest md = MessageDigest.getInstance("SHA-256");
byte[] hash = md.digest(publicKey.getEncoded());
return bytesToHex(hash).substring(0, 16);
}
private String extractKeyIdFromToken(String token) {
try {
String[] parts = token.split("\\.");
if (parts.length != 3) {
return null;
}
String headerJson = new String(Base64.getUrlDecoder().decode(parts[0]));
Map<String, Object> header = parseJson(headerJson);
return (String) header.get("kid");
} catch (Exception e) {
return null;
}
}
private void scheduleKeyDeactivation(String keyId) {
// Schedule key deactivation after grace period (e.g., 24 hours)
Timer timer = new Timer(true);
timer.schedule(new TimerTask() {
@Override
public void run() {
KeyEntry entry = keys.get(keyId);
if (entry != null) {
entry.setActive(false);
entry.setDeactivatedAt(Instant.now());
}
}
}, 24 * 60 * 60 * 1000); // 24 hours
}
private String bytesToHex(byte[] bytes) {
StringBuilder result = new StringBuilder();
for (byte b : bytes) {
result.append(String.format("%02x", b));
}
return result.toString();
}
@SuppressWarnings("unchecked")
private Map<String, Object> parseJson(String json) {
try {
com.fasterxml.jackson.databind.ObjectMapper mapper = new com.fasterxml.jackson.databind.ObjectMapper();
return mapper.readValue(json, Map.class);
} catch (Exception e) {
throw new RuntimeException("Failed to parse JSON", e);
}
}
}
class KeyEntry {
private KeyPair keyPair;
private String keyId;
private String description;
private Instant createdAt;
private Instant deactivatedAt;
private boolean active;
private int usageCount;
// Getters and setters
public KeyPair getKeyPair() { return keyPair; }
public void setKeyPair(KeyPair keyPair) { this.keyPair = keyPair; }
public String getKeyId() { return keyId; }
public void setKeyId(String keyId) { this.keyId = keyId; }
public String getDescription() { return description; }
public void setDescription(String description) { this.description = description; }
public Instant getCreatedAt() { return createdAt; }
public void setCreatedAt(Instant createdAt) { this.createdAt = createdAt; }
public Instant getDeactivatedAt() { return deactivatedAt; }
public void setDeactivatedAt(Instant deactivatedAt) { this.deactivatedAt = deactivatedAt; }
public boolean isActive() { return active; }
public void setActive(boolean active) { this.active = active; }
public int getUsageCount() { return usageCount; }
public void setUsageCount(int usageCount) { this.usageCount = usageCount; }
public void incrementUsageCount() {
this.usageCount++;
}
}
class KeyStatistics {
private int totalKeys;
private int activeKeys;
private int inactiveKeys;
private java.time.Duration oldestKeyAge;
// Getters and setters
public int getTotalKeys() { return totalKeys; }
public void setTotalKeys(int totalKeys) { this.totalKeys = totalKeys; }
public int getActiveKeys() { return activeKeys; }
public void setActiveKeys(int activeKeys) { this.activeKeys = activeKeys; }
public int getInactiveKeys() { return inactiveKeys; }
public void setInactiveKeys(int inactiveKeys) { this.inactiveKeys = inactiveKeys; }
public java.time.Duration getOldestKeyAge() { return oldestKeyAge; }
public void setOldestKeyAge(java.time.Duration oldestKeyAge) { this.oldestKeyAge = oldestKeyAge; }
@Override
public String toString() {
return String.format(
"KeyStatistics{total=%d, active=%d, inactive=%d, oldestAge=%s}",
totalKeys, activeKeys, inactiveKeys, oldestKeyAge
);
}
}

Example 5: Complete Usage Example

package com.jwt.eddsa;
import java.security.KeyPair;
import java.security.GeneralSecurityException;
import java.util.*;
public class EdDSAJwtDemo {
public static void main(String[] args) {
try {
// Initialize Bouncy Castle
Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
// Demo the complete flow
demoKeyGeneration();
demoJwtCreationAndValidation();
demoAdvancedFeatures();
demoKeyRotation();
} catch (Exception e) {
e.printStackTrace();
}
}
private static void demoKeyGeneration() throws GeneralSecurityException {
System.out.println("=== EdDSA Key Generation Demo ===");
// Generate Ed25519 key pair
KeyPairStrings ed25519Keys = EdDSAKeyGenerator.generateKeyPairStrings(EdDSAKeyGenerator.ED25519);
System.out.println("Ed25519 Public Key: " + ed25519Keys.getPublicKey());
System.out.println("Ed25519 Private Key: " + ed25519Keys.getPrivateKey());
// Generate key pair object
KeyPair keyPair = EdDSAKeyGenerator.generateKeyPair(EdDSAKeyGenerator.ED25519);
KeyInfo keyInfo = EdDSAKeyGenerator.getKeyInfo(keyPair);
System.out.println("Key Info: " + keyInfo);
System.out.println();
}
private static void demoJwtCreationAndValidation() throws Exception {
System.out.println("=== JWT Creation and Validation Demo ===");
// Generate key pair
KeyPair keyPair = EdDSAKeyGenerator.generateKeyPair(EdDSAKeyGenerator.ED25519);
// Create JWT service
EdDSAJwtService jwtService = new EdDSAJwtService("my-app", 3600000, 86400000);
// Create claims
Map<String, Object> claims = new HashMap<>();
claims.put("user_id", "12345");
claims.put("roles", Arrays.asList("USER", "ADMIN"));
claims.put("email", "[email protected]");
// Create access token
String accessToken = jwtService.createAccessToken(keyPair, "user123", claims);
System.out.println("Access Token: " + accessToken);
// Create refresh token
String refreshToken = jwtService.createRefreshToken(keyPair, "user123");
System.out.println("Refresh Token: " + refreshToken);
// Validate token
JwtClaims parsedClaims = jwtService.parseToken(accessToken, keyPair.getPublic());
System.out.println("Parsed Subject: " + parsedClaims.getSubject());
System.out.println("Parsed Claims: " + parsedClaims.getClaims());
// Validate token quickly
boolean isValid = jwtService.validateToken(accessToken, keyPair.getPublic());
System.out.println("Token is valid: " + isValid);
System.out.println();
}
private static void demoAdvancedFeatures() throws Exception {
System.out.println("=== Advanced Features Demo ===");
KeyPair keyPair = EdDSAKeyGenerator.generateKeyPair(EdDSAKeyGenerator.ED25519);
EdDSAJwtService basicJwtService = new EdDSAJwtService("my-app", 3600000, 86400000);
AdvancedJwtService advancedJwtService = new AdvancedJwtService(basicJwtService);
// Create advanced token request
TokenRequest tokenRequest = new TokenRequest();
tokenRequest.setSubject("user123");
tokenRequest.setUserId("12345");
tokenRequest.setTokenType("access");
tokenRequest.setScopes(Arrays.asList("read", "write", "admin"));
tokenRequest.setAudience("my-api");
tokenRequest.setRoles(Arrays.asList("USER", "ADMIN"));
tokenRequest.setPermissions(Arrays.asList("users:read", "users:write"));
DeviceContext deviceContext = new DeviceContext();
deviceContext.setDeviceId("device-001");
deviceContext.setTrustLevel("high");
tokenRequest.setDeviceContext(deviceContext);
// Create advanced token
String advancedToken = advancedJwtService.createAdvancedToken(keyPair, tokenRequest);
System.out.println("Advanced Token: " + advancedToken);
// Get token metadata
TokenMetadata metadata = advancedJwtService.getTokenMetadata(advancedToken);
System.out.println("Token Metadata: " + metadata.getAlgorithm() + ", Expires: " + metadata.getExpiration());
// Comprehensive validation
ValidationContext validationContext = new ValidationContext();
validationContext.setExpectedIssuer("my-app");
validationContext.setExpectedAudience("my-api");
validationContext.setExpectedTokenType("access");
validationContext.setRequiredScopes(new HashSet<>(Arrays.asList("read", "write")));
TokenValidationResult validation = advancedJwtService.validateTokenComprehensive(
advancedToken, keyPair.getPublic(), validationContext
);
System.out.println("Validation Result: " + validation.isValid());
if (!validation.isValid()) {
System.out.println("Validation Errors: " + validation.getErrorSummary());
}
// Extract specific claim
String userId = advancedJwtService.getClaim(advancedToken, keyPair.getPublic(), "user_id", String.class);
System.out.println("Extracted User ID: " + userId);
System.out.println();
}
private static void demoKeyRotation() throws Exception {
System.out.println("=== Key Rotation Demo ===");
// Create key manager
KeyManager keyManager = new KeyManager();
// Get current key
KeyPair currentKey = keyManager.getCurrentKeyPair();
System.out.println("Initial Key ID: " + keyManager.currentKeyId);
// Create token with current key
EdDSAJwtService jwtService = new EdDSAJwtService("my-app", 3600000, 86400000);
String token = jwtService.createAccessToken(currentKey, "user123", null);
System.out.println("Token with initial key: " + token);
// Rotate key
String newKeyId = keyManager.rotateKey();
System.out.println("New Key ID after rotation: " + newKeyId);
// Validate token with key rotation support
JwtClaims claims = keyManager.validateTokenWithKeyRotation(token);
System.out.println("Validated token subject: " + claims.getSubject());
// Get key statistics
KeyStatistics stats = keyManager.getKeyStatistics();
System.out.println("Key Statistics: " + stats);
System.out.println();
}
}

Testing

Example 6: Comprehensive Tests

package com.jwt.eddsa;
import org.junit.jupiter.api.BeforeAll;
import org.junit.jupiter.api.Test;
import java.security.KeyPair;
import java.security.Security;
import java.util.HashMap;
import java.util.Map;
import static org.junit.jupiter.api.Assertions.*;
class EdDSAJwtServiceTest {
@BeforeAll
static void setup() {
Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
}
@Test
void testKeyGeneration() throws Exception {
KeyPair keyPair = EdDSAKeyGenerator.generateKeyPair(EdDSAKeyGenerator.ED25519);
assertNotNull(keyPair);
assertNotNull(keyPair.getPublic());
assertNotNull(keyPair.getPrivate());
assertEquals("Ed25519", keyPair.getPublic().getAlgorithm());
}
@Test
void testJwtCreationAndValidation() throws Exception {
KeyPair keyPair = EdDSAKeyGenerator.generateKeyPair(EdDSAKeyGenerator.ED25519);
EdDSAJwtService jwtService = new EdDSAJwtService("test-issuer", 3600000, 86400000);
Map<String, Object> claims = new HashMap<>();
claims.put("test_claim", "test_value");
String token = jwtService.createAccessToken(keyPair, "test-user", claims);
assertNotNull(token);
JwtClaims parsedClaims = jwtService.parseToken(token, keyPair.getPublic());
assertEquals("test-user", parsedClaims.getSubject());
assertEquals("test_value", parsedClaims.getClaims().get("test_claim"));
}
@Test
void testTokenExpiration() throws Exception {
KeyPair keyPair = EdDSAKeyGenerator.generateKeyPair(EdDSAKeyGenerator.ED25519);
// Create service with very short expiration
EdDSAJwtService jwtService = new EdDSAJwtService("test", 100, 1000);
String token = jwtService.createAccessToken(keyPair, "test-user", null);
// Wait for expiration
Thread.sleep(200);
assertThrows(JwtException.class, () -> {
jwtService.parseToken(token, keyPair.getPublic());
});
}
@Test
void testInvalidSignature() throws Exception {
KeyPair keyPair1 = EdDSAKeyGenerator.generateKeyPair(EdDSAKeyGenerator.ED25519);
KeyPair keyPair2 = EdDSAKeyGenerator.generateKeyPair(EdDSAKeyGenerator.ED25519);
EdDSAJwtService jwtService = new EdDSAJwtService("test", 3600000, 86400000);
String token = jwtService.createAccessToken(keyPair1, "test-user", null);
// Try to validate with wrong public key
assertThrows(JwtException.class, () -> {
jwtService.parseToken(token, keyPair2.getPublic());
});
}
@Test
void testKeyEncodingDecoding() throws Exception {
KeyPair keyPair = EdDSAKeyGenerator.generateKeyPair(EdDSAKeyGenerator.ED25519);
String encodedPublic = EdDSAKeyGenerator.encodePublicKey(keyPair.getPublic());
String encodedPrivate = EdDSAKeyGenerator.encodePrivateKey(keyPair.getPrivate());
assertNotNull(encodedPublic);
assertNotNull(encodedPrivate);
// Decode back
KeyPair decodedKeyPair = new KeyPair(
EdDSAKeyGenerator.decodePublicKey(encodedPublic, "Ed25519"),
EdDSAKeyGenerator.decodePrivateKey(encodedPrivate, "Ed25519")
);
assertEquals(keyPair.getPublic(), decodedKeyPair.getPublic());
assertEquals(keyPair.getPrivate(), decodedKeyPair.getPrivate());
}
}

Best Practices and Security Considerations

Security Best Practices

package com.jwt.eddsa;
import java.security.SecureRandom;
import java.util.Base64;
public class SecurityBestPractices {
/**
* Secure random number generator for key generation
*/
public static SecureRandom createSecureRandom() {
try {
return SecureRandom.getInstanceStrong();
} catch (Exception e) {
return new SecureRandom();
}
}
/**
* Validate JWT header for security
*/
public static void validateJwtHeader(Map<String, Object> header) throws JwtException {
// Check algorithm
String alg = (String) header.get("alg");
if (!"Ed25519".equals(alg) && !"Ed448".equals(alg)) {
throw new JwtException("Unsupported algorithm: " + alg);
}
// Check type
String typ = (String) header.get("typ");
if (!"JWT".equals(typ)) {
throw new JwtException("Unsupported token type: " + typ);
}
// Check for critical headers
if (header.containsKey("crit")) {
throw new JwtException("Critical headers not supported");
}
}
/**
* Secure key storage recommendations
*/
public static class KeyStorage {
/**
* Encrypt private key for storage
*/
public static String encryptPrivateKey(byte[] privateKey, String password) {
// In production, use proper encryption like AES-GCM
// This is a simplified example
byte[] encrypted = performEncryption(privateKey, password);
return Base64.getUrlEncoder().withoutPadding().encodeToString(encrypted);
}
/**
* Decrypt private key from storage
*/
public static byte[] decryptPrivateKey(String encryptedKey, String password) {
byte[] encryptedBytes = Base64.getUrlDecoder().decode(encryptedKey);
return performDecryption(encryptedBytes, password);
}
private static byte[] performEncryption(byte[] data, String password) {
// Implement proper encryption in production
return data; // Placeholder
}
private static byte[] performDecryption(byte[] data, String password) {
// Implement proper decryption in production
return data; // Placeholder
}
}
}

Conclusion

This comprehensive EdDSA JWT implementation provides:

Key Features:

EdDSA Key Generation: Support for Ed25519 and Ed448
JWT Creation & Validation: Complete JWT lifecycle management
Advanced Claims: Support for custom claims and validation
Key Rotation: Secure key management and rotation
Security: Comprehensive security best practices

Benefits of EdDSA for JWT:

Performance: Faster signing and verification
Security: Strong security guarantees
Compact: Smaller key and signature sizes
Deterministic: No need for random number generation

Production Considerations:

Key Storage: Use HSMs or secure key management systems
Key Rotation: Implement regular key rotation policies
Audit Logging: Log all token creation and validation events
Monitoring: Monitor token usage patterns and failures
Revocation: Implement token revocation mechanisms when needed

This implementation provides a solid foundation for using EdDSA with JWT in Java applications, offering both security and performance benefits over traditional algorithms like RSA and ECDSA.