From 446a62f334ce3d1031c2946d673da4fa11205108 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Mon, 22 Sep 2025 16:04:05 -0600
Subject: [PATCH 01/29] Working

---
 build.savant                                  |  11 +-
 fusionauth-jwt.iml                            |  16 +--
 fusionauth-jwt.ipr                            |   7 +-
 .../io/fusionauth/der/ObjectIdentifier.java   |  10 +-
 .../io/fusionauth/jwks/JSONWebKeyBuilder.java |  28 +++--
 .../io/fusionauth/jwt/domain/Algorithm.java   |   8 +-
 .../io/fusionauth/jwt/domain/KeyType.java     |  32 +++--
 .../io/fusionauth/jwt/ed/EdDSASigner.java     | 113 +++++++++++++++++
 .../io/fusionauth/jwt/ed/EdDSAVerifier.java   | 114 ++++++++++++++++++
 .../java/io/fusionauth/pem/PEMDecoder.java    |  97 +++++++++++++--
 .../jwks/JSONWebKeyBuilderTest.java           |  22 +++-
 .../io/fusionauth/jwt/ed/EdSignerTest.java    | 112 +++++++++++++++++
 .../io/fusionauth/jwt/ed/EdVerifierTest.java  | 112 +++++++++++++++++
 .../resources/ed_dsa_ed25519_private_key.pem  |   3 +
 .../ed_dsa_ed25519_private_key_pub.pem        |   5 +
 .../resources/ed_dsa_ed25519_public_key.pem   |   3 +
 src/test/resources/ed_dsa_private_key.pem     |   3 +
 src/test/resources/ed_dsa_public_key.pem      |   3 +
 .../jwk/ed_dsa_ed25519_private_key.json       |   9 ++
 .../jwk/ed_dsa_ed25519_public_key.json        |   8 ++
 .../resources/jwk/ed_dsa_private_key.json     |   7 ++
 src/test/resources/jwk/ed_dsa_public_key.json |   7 ++
 22 files changed, 677 insertions(+), 53 deletions(-)
 create mode 100644 src/main/java/io/fusionauth/jwt/ed/EdDSASigner.java
 create mode 100644 src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java
 create mode 100644 src/test/java/io/fusionauth/jwt/ed/EdSignerTest.java
 create mode 100644 src/test/java/io/fusionauth/jwt/ed/EdVerifierTest.java
 create mode 100644 src/test/resources/ed_dsa_ed25519_private_key.pem
 create mode 100644 src/test/resources/ed_dsa_ed25519_private_key_pub.pem
 create mode 100644 src/test/resources/ed_dsa_ed25519_public_key.pem
 create mode 100644 src/test/resources/ed_dsa_private_key.pem
 create mode 100644 src/test/resources/ed_dsa_public_key.pem
 create mode 100644 src/test/resources/jwk/ed_dsa_ed25519_private_key.json
 create mode 100644 src/test/resources/jwk/ed_dsa_ed25519_public_key.json
 create mode 100644 src/test/resources/jwk/ed_dsa_private_key.json
 create mode 100644 src/test/resources/jwk/ed_dsa_public_key.json

diff --git a/build.savant b/build.savant
index 84aacf79..ef3eb88a 100644
--- a/build.savant
+++ b/build.savant
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2024, FusionAuth, All Rights Reserved
+ * Copyright (c) 2016-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -47,7 +47,7 @@ project(group: "io.fusionauth", name: "fusionauth-jwt", version: "5.3.3", licens
     }
     group(name: "test-compile", export: false) {
       dependency(id: "org.bouncycastle:bc-fips:1.0.2.5")
-      dependency(id: "org.testng:testng:7.5.1")
+      dependency(id: "org.testng:testng:7.9.0")
     }
   }
 
@@ -62,17 +62,14 @@ project(group: "io.fusionauth", name: "fusionauth-jwt", version: "5.3.3", licens
 dependency = loadPlugin(id: "org.savantbuild.plugin:dependency:2.0.0-RC.6")
 java = loadPlugin(id: "org.savantbuild.plugin:java:2.0.0-RC.6")
 javaTestNG = loadPlugin(id: "org.savantbuild.plugin:java-testng:2.0.0-RC.6")
-groovy = loadPlugin(id: "org.savantbuild.plugin:groovy:2.0.0-RC.6")
 idea = loadPlugin(id: "org.savantbuild.plugin:idea:2.0.0-RC.7")
 release = loadPlugin(id: "org.savantbuild.plugin:release-git:2.0.0-RC.6")
 
 /*
  * Plugin Settings
  */
-java.settings.javaVersion = "1.8"
-groovy.settings.javaVersion = "1.8"
-groovy.settings.groovyVersion = "2.2"
-javaTestNG.settings.javaVersion = "1.8"
+java.settings.javaVersion = "17"
+javaTestNG.settings.javaVersion = "17"
 
 /*
  * Targets
diff --git a/fusionauth-jwt.iml b/fusionauth-jwt.iml
index 2b7866ec..11b47819 100644
--- a/fusionauth-jwt.iml
+++ b/fusionauth-jwt.iml
@@ -60,44 +60,44 @@
     <orderEntry type="module-library" scope="TEST">
       <library>
         <CLASSES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/org/testng/testng/7.5.1/testng-7.5.1.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/org/testng/testng/7.9.0/testng-7.9.0.jar!/" />
         </CLASSES>
         <JAVADOC />
         <SOURCES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/org/testng/testng/7.5.1/testng-7.5.1-src.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/org/testng/testng/7.9.0/testng-7.9.0-src.jar!/" />
         </SOURCES>
       </library>
     </orderEntry>
     <orderEntry type="module-library" scope="TEST">
       <library>
         <CLASSES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/com/google/code/findbugs/jsr305/3.0.1/jsr305-3.0.1.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/org/slf4j/slf4j-api/1.7.36/slf4j-api-1.7.36.jar!/" />
         </CLASSES>
         <JAVADOC />
         <SOURCES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/com/google/code/findbugs/jsr305/3.0.1/jsr305-3.0.1-src.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/org/slf4j/slf4j-api/1.7.36/slf4j-api-1.7.36-src.jar!/" />
         </SOURCES>
       </library>
     </orderEntry>
     <orderEntry type="module-library" scope="TEST">
       <library>
         <CLASSES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/com/beust/jcommander/1.78.0/jcommander-1.78.0.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/com/beust/jcommander/1.82.0/jcommander-1.82.0.jar!/" />
         </CLASSES>
         <JAVADOC />
         <SOURCES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/com/beust/jcommander/1.78.0/jcommander-1.78.0-src.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/com/beust/jcommander/1.82.0/jcommander-1.82.0-src.jar!/" />
         </SOURCES>
       </library>
     </orderEntry>
     <orderEntry type="module-library" scope="TEST">
       <library>
         <CLASSES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/org/webjars/jquery/3.5.1/jquery-3.5.1.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/org/webjars/jquery/3.7.1/jquery-3.7.1.jar!/" />
         </CLASSES>
         <JAVADOC />
         <SOURCES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/org/webjars/jquery/3.5.1/jquery-3.5.1-src.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/org/webjars/jquery/3.7.1/jquery-3.7.1-src.jar!/" />
         </SOURCES>
       </library>
     </orderEntry>
diff --git a/fusionauth-jwt.ipr b/fusionauth-jwt.ipr
index b074a356..a064abc7 100644
--- a/fusionauth-jwt.ipr
+++ b/fusionauth-jwt.ipr
@@ -631,6 +631,11 @@
     <option name="USE_PER_PROJECT_SETTINGS" value="true" />
   </component>
   <component name="ProjectDictionaryState">
+    <dictionary name="project">
+      <words>
+        <w>eddsa</w>
+      </words>
+    </dictionary>
     <dictionary name="degroff">
       <words>
         <w>aand</w>
@@ -656,7 +661,7 @@
       <module fileurl="file://$PROJECT_DIR$/fusionauth-jwt.iml" filepath="$PROJECT_DIR$/fusionauth-jwt.iml" />
     </modules>
   </component>
-  <component name="ProjectRootManager" version="2" languageLevel="JDK_1_8" project-jdk-name="14" project-jdk-type="JavaSDK">
+  <component name="ProjectRootManager" version="2" languageLevel="JDK_17" project-jdk-name="Java 17" project-jdk-type="JavaSDK">
     <output url="file://$PROJECT_DIR$/out" />
   </component>
   <component name="PropertiesComponent">
diff --git a/src/main/java/io/fusionauth/der/ObjectIdentifier.java b/src/main/java/io/fusionauth/der/ObjectIdentifier.java
index 1e1317c5..89da760d 100644
--- a/src/main/java/io/fusionauth/der/ObjectIdentifier.java
+++ b/src/main/java/io/fusionauth/der/ObjectIdentifier.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,6 +31,11 @@ public class ObjectIdentifier implements Buildable<ObjectIdentifier> {
    */
   public static final String ECDSA_P256 = "1.2.840.10045.3.1.7";
 
+  /**
+   * Edwards-curve Digital Signature Algorithm (EdDSA) Ed25519
+   */
+  public static final String EdDSA = "1.3.101.112";
+
   /**
    * Elliptic curve / 384 bit / secp384r1 / prime384v1
    * NIST/SECG curve over a 384 bit prime field
@@ -99,8 +104,7 @@ public String decode() throws DerDecodingException {
   @Override
   public boolean equals(Object o) {
     if (this == o) return true;
-    if (!(o instanceof ObjectIdentifier)) return false;
-    ObjectIdentifier that = (ObjectIdentifier) o;
+    if (!(o instanceof ObjectIdentifier that)) return false;
     return Arrays.equals(value, that.value) &&
         Objects.equals(decoded, that.decoded);
   }
diff --git a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
index 3a3e86ec..9ac42a13 100644
--- a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
+++ b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2020, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -36,6 +36,7 @@
 import java.security.interfaces.ECKey;
 import java.security.interfaces.ECPrivateKey;
 import java.security.interfaces.ECPublicKey;
+import java.security.interfaces.EdECPrivateKey;
 import java.security.interfaces.RSAPrivateCrtKey;
 import java.security.interfaces.RSAPrivateKey;
 import java.security.interfaces.RSAPublicKey;
@@ -46,6 +47,7 @@
 import static io.fusionauth.der.ObjectIdentifier.ECDSA_P256;
 import static io.fusionauth.der.ObjectIdentifier.ECDSA_P384;
 import static io.fusionauth.der.ObjectIdentifier.ECDSA_P521;
+import static io.fusionauth.der.ObjectIdentifier.EdDSA;
 import static io.fusionauth.jwks.JWKUtils.base64EncodeUint;
 
 /**
@@ -85,15 +87,13 @@ public JSONWebKey build(PrivateKey privateKey) {
 
     key.kty = getKeyType(privateKey);
     key.use = "sig";
-    if (privateKey instanceof RSAPrivateKey) {
-      RSAPrivateKey rsaPrivateKey = (RSAPrivateKey) privateKey;
+    if (privateKey instanceof RSAPrivateKey rsaPrivateKey) {
       key.n = base64EncodeUint(rsaPrivateKey.getModulus());
       key.d = base64EncodeUint(rsaPrivateKey.getPrivateExponent());
     }
 
     // If this is a CRT (Chinese Remainder Theorem) private key, collect additional information
-    if (privateKey instanceof RSAPrivateCrtKey) {
-      RSAPrivateCrtKey rsaPrivateKey = (RSAPrivateCrtKey) privateKey;
+    if (privateKey instanceof RSAPrivateCrtKey rsaPrivateKey) {
       key.e = base64EncodeUint(rsaPrivateKey.getPublicExponent());
       key.p = base64EncodeUint(rsaPrivateKey.getPrimeP());
       key.q = base64EncodeUint(rsaPrivateKey.getPrimeQ());
@@ -108,8 +108,7 @@ public JSONWebKey build(PrivateKey privateKey) {
       key.dq = base64EncodeUint(dq);
     }
 
-    if (privateKey instanceof ECPrivateKey) {
-      ECPrivateKey ecPrivateKey = (ECPrivateKey) privateKey;
+    if (privateKey instanceof ECPrivateKey ecPrivateKey) {
       key.crv = getCurveOID(privateKey);
       if (key.crv != null) {
         switch (key.crv) {
@@ -129,6 +128,14 @@ public JSONWebKey build(PrivateKey privateKey) {
       key.d = base64EncodeUint(ecPrivateKey.getS(), byteLength);
       key.x = base64EncodeUint(ecPrivateKey.getParams().getGenerator().getAffineX(), byteLength);
       key.y = base64EncodeUint(ecPrivateKey.getParams().getGenerator().getAffineY(), byteLength);
+    } else if (privateKey instanceof EdECPrivateKey edPrivateKey) {
+      key.crv = getCurveOID(privateKey);
+      key.alg = Algorithm.EdDSA;
+
+//      int byteLength = getCoordinateLength(edPrivateKey);
+//      key.d = base64EncodeUint(edPrivateKey.getS(), byteLength);
+//      key.x = base64EncodeUint(edPrivateKey.getParams().getGenerator().getAffineX(), byteLength);
+//      key.y = base64EncodeUint(edPrivateKey.getParams().getGenerator().getAffineY(), byteLength);
     }
 
     return key;
@@ -146,8 +153,7 @@ public JSONWebKey build(PublicKey publicKey) {
 
     key.kty = getKeyType(publicKey);
     key.use = "sig";
-    if (publicKey instanceof RSAPublicKey) {
-      RSAPublicKey rsaPublicKey = (RSAPublicKey) publicKey;
+    if (publicKey instanceof RSAPublicKey rsaPublicKey) {
       key.e = base64EncodeUint(rsaPublicKey.getPublicExponent());
       key.n = base64EncodeUint(rsaPublicKey.getModulus());
     }
@@ -205,6 +211,8 @@ private KeyType getKeyType(Key key) {
       return KeyType.RSA;
     } else if (key.getAlgorithm().equals("EC")) {
       return KeyType.EC;
+    } else if (key.getAlgorithm().equals("EdDSA")) {
+      return KeyType.ED;
     }
 
     return null;
@@ -237,6 +245,8 @@ String getCurveOID(Key key) {
         return "P-384";
       case ECDSA_P521:
         return "P-521";
+      case EdDSA:
+        return "Ed25519";
       default:
         return null;
     }
diff --git a/src/main/java/io/fusionauth/jwt/domain/Algorithm.java b/src/main/java/io/fusionauth/jwt/domain/Algorithm.java
index e9ab088c..f86d85f1 100644
--- a/src/main/java/io/fusionauth/jwt/domain/Algorithm.java
+++ b/src/main/java/io/fusionauth/jwt/domain/Algorithm.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2016-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,6 +22,12 @@
  * @author Daniel DeGroff
  */
 public enum Algorithm {
+  /**
+   * EdDSA
+   * OID: 1.3.101.112
+   */
+  EdDSA("EdDSA"),
+
   /**
    * ECDSA using P-256 and SHA-256
    * OID: 1.2.840.10045.3.1.7
diff --git a/src/main/java/io/fusionauth/jwt/domain/KeyType.java b/src/main/java/io/fusionauth/jwt/domain/KeyType.java
index 3b39546b..1a60fa6c 100644
--- a/src/main/java/io/fusionauth/jwt/domain/KeyType.java
+++ b/src/main/java/io/fusionauth/jwt/domain/KeyType.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2016-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,6 +19,7 @@
 import java.util.Objects;
 
 import static io.fusionauth.der.ObjectIdentifier.EC_ENCRYPTION;
+import static io.fusionauth.der.ObjectIdentifier.EdDSA;
 import static io.fusionauth.der.ObjectIdentifier.RSA_ENCRYPTION;
 
 /**
@@ -34,19 +35,28 @@
  * @author Daniel DeGroff
  */
 public enum KeyType {
-  RSA,
-  EC;
+  RSA("RSA"),
+  EC("EC"),
+  ED("EdDSA");
+
+  private final String algorithm;
+
+  KeyType(String algorithm) {
+    this.algorithm = algorithm;
+  }
 
   public static KeyType getKeyTypeFromOid(String oid) {
     Objects.requireNonNull(oid);
 
-    switch (oid) {
-      case EC_ENCRYPTION:
-        return EC;
-      case RSA_ENCRYPTION:
-        return RSA;
-      default:
-        return null;
-    }
+    return switch (oid) {
+      case EC_ENCRYPTION -> EC;
+      case EdDSA -> ED;
+      case RSA_ENCRYPTION -> RSA;
+      default -> null;
+    };
+  }
+
+  public String getAlgorithm() {
+    return algorithm;
   }
 }
diff --git a/src/main/java/io/fusionauth/jwt/ed/EdDSASigner.java b/src/main/java/io/fusionauth/jwt/ed/EdDSASigner.java
new file mode 100644
index 00000000..f82caa21
--- /dev/null
+++ b/src/main/java/io/fusionauth/jwt/ed/EdDSASigner.java
@@ -0,0 +1,113 @@
+/*
+ * Copyright (c) 2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+package io.fusionauth.jwt.ed;
+
+import io.fusionauth.jwt.InvalidKeyTypeException;
+import io.fusionauth.jwt.JWTSigningException;
+import io.fusionauth.jwt.MissingPrivateKeyException;
+import io.fusionauth.jwt.Signer;
+import io.fusionauth.jwt.domain.Algorithm;
+import io.fusionauth.pem.domain.PEM;
+import io.fusionauth.security.CryptoProvider;
+import io.fusionauth.security.DefaultCryptoProvider;
+
+import java.nio.charset.StandardCharsets;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.Signature;
+import java.security.SignatureException;
+import java.security.interfaces.EdECPrivateKey;
+import java.util.Objects;
+
+/**
+ * @author Daniel DeGroff
+ */
+public class EdDSASigner implements Signer {
+  private final Algorithm algorithm;
+
+  private final CryptoProvider cryptoProvider;
+
+  private final String kid;
+
+  private final EdECPrivateKey privateKey;
+
+  private EdDSASigner(Algorithm algorithm, PrivateKey privateKey, String kid, CryptoProvider cryptoProvider) {
+    Objects.requireNonNull(algorithm);
+    Objects.requireNonNull(cryptoProvider);
+    Objects.requireNonNull(privateKey);
+
+    this.algorithm = algorithm;
+    this.cryptoProvider = cryptoProvider;
+    this.kid = kid;
+
+    if (!(privateKey instanceof EdECPrivateKey)) {
+      throw new InvalidKeyTypeException("Expecting a private key of type [EdECPrivateKey], but found [" + privateKey.getClass().getSimpleName() + "].");
+    }
+
+    this.privateKey = (EdECPrivateKey) privateKey;
+  }
+
+  private EdDSASigner(Algorithm algorithm, String privateKey, String kid, CryptoProvider cryptoProvider) {
+    Objects.requireNonNull(algorithm);
+    Objects.requireNonNull(cryptoProvider);
+    Objects.requireNonNull(privateKey);
+
+    this.algorithm = algorithm;
+    this.cryptoProvider = cryptoProvider;
+    this.kid = kid;
+    PEM pem = PEM.decode(privateKey);
+    if (pem.privateKey == null) {
+      throw new MissingPrivateKeyException("The provided PEM encoded string did not contain a private key.");
+    }
+
+    if (!(pem.privateKey instanceof EdECPrivateKey)) {
+      throw new InvalidKeyTypeException("Expecting a private key of type [EdECPrivateKey], but found [" + pem.privateKey.getClass().getSimpleName() + "].");
+    }
+
+    this.privateKey = pem.getPrivateKey();
+  }
+
+  public static EdDSASigner newSigner(String privateKey) {
+    return new EdDSASigner(Algorithm.EdDSA, privateKey, null, new DefaultCryptoProvider());
+  }
+
+  @Override
+  public Algorithm getAlgorithm() {
+    return Algorithm.EdDSA;
+  }
+
+  @Override
+  public String getKid() {
+    return kid;
+  }
+
+  @Override
+  public byte[] sign(String message) {
+    Objects.requireNonNull(message);
+
+    try {
+      Signature signature = cryptoProvider.getSignatureInstance(algorithm.getName());
+      signature.initSign(privateKey);
+      signature.update((message).getBytes(StandardCharsets.UTF_8));
+
+      return signature.sign();
+    } catch (InvalidKeyException | NoSuchAlgorithmException | SignatureException e) {
+      throw new JWTSigningException("An unexpected exception occurred when attempting to sign the JWT", e);
+    }
+  }
+}
diff --git a/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java b/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java
new file mode 100644
index 00000000..adc733d7
--- /dev/null
+++ b/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java
@@ -0,0 +1,114 @@
+/*
+ * Copyright (c) 2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+package io.fusionauth.jwt.ed;
+
+import io.fusionauth.jwt.InvalidJWTSignatureException;
+import io.fusionauth.jwt.InvalidKeyTypeException;
+import io.fusionauth.jwt.JWTVerifierException;
+import io.fusionauth.jwt.MissingPublicKeyException;
+import io.fusionauth.jwt.Verifier;
+import io.fusionauth.jwt.domain.Algorithm;
+import io.fusionauth.pem.domain.PEM;
+import io.fusionauth.security.CryptoProvider;
+import io.fusionauth.security.DefaultCryptoProvider;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.InvalidKeyException;
+import java.security.NoSuchAlgorithmException;
+import java.security.PublicKey;
+import java.security.Signature;
+import java.security.SignatureException;
+import java.security.interfaces.EdECPublicKey;
+import java.util.Objects;
+
+/**
+ * @author Daniel DeGroff
+ */
+public class EdDSAVerifier implements Verifier {
+  private final CryptoProvider cryptoProvider;
+
+  private final EdECPublicKey publicKey;
+
+  private EdDSAVerifier(PublicKey publicKey, CryptoProvider cryptoProvider) {
+    Objects.requireNonNull(publicKey);
+    Objects.requireNonNull(cryptoProvider);
+
+    this.cryptoProvider = cryptoProvider;
+    if (!(publicKey instanceof EdECPublicKey)) {
+      throw new InvalidKeyTypeException("Expecting a public key of type [EdECPublicKey], but found [" + publicKey.getClass().getSimpleName() + "].");
+    }
+
+    this.publicKey = (EdECPublicKey) publicKey;
+  }
+
+  private EdDSAVerifier(String publicKey, CryptoProvider cryptoProvider) {
+    Objects.requireNonNull(publicKey);
+    Objects.requireNonNull(cryptoProvider);
+
+    this.cryptoProvider = cryptoProvider;
+    PEM pem = PEM.decode(publicKey);
+    if (pem.publicKey == null) {
+      throw new MissingPublicKeyException("The provided PEM encoded string did not contain a public key.");
+    }
+
+    if (!(pem.publicKey instanceof EdECPublicKey)) {
+      throw new InvalidKeyTypeException("Expecting a private key of type [EdECPublicKey], but found [" + pem.privateKey.getClass().getSimpleName() + "].");
+    }
+
+    this.publicKey = pem.getPublicKey();
+  }
+
+  public static EdDSAVerifier newVerifier(Path path) {
+    return newVerifier(path, new DefaultCryptoProvider());
+  }
+
+  public static EdDSAVerifier newVerifier(Path path, CryptoProvider cryptoProvider) {
+    Objects.requireNonNull(path);
+
+    try {
+      return new EdDSAVerifier(new String(Files.readAllBytes(path)), cryptoProvider);
+    } catch (IOException e) {
+      throw new JWTVerifierException("Unable to read the file from path [" + path.toAbsolutePath() + "]", e);
+    }
+  }
+
+  @Override
+  public boolean canVerify(Algorithm algorithm) {
+    return algorithm.equals(Algorithm.EdDSA);
+  }
+
+  @Override
+  public void verify(Algorithm algorithm, byte[] message, byte[] signature) {
+    Objects.requireNonNull(algorithm);
+    Objects.requireNonNull(message);
+    Objects.requireNonNull(signature);
+
+    try {
+      Signature verifier = cryptoProvider.getSignatureInstance(algorithm.getName());
+      verifier.initVerify(publicKey);
+      verifier.update(message);
+
+      if (!(verifier.verify(signature))) {
+        throw new InvalidJWTSignatureException();
+      }
+    } catch (InvalidKeyException | NoSuchAlgorithmException | SignatureException | SecurityException e) {
+      throw new JWTVerifierException("An unexpected exception occurred when attempting to verify the JWT", e);
+    }
+  }
+}
diff --git a/src/main/java/io/fusionauth/pem/PEMDecoder.java b/src/main/java/io/fusionauth/pem/PEMDecoder.java
index fd523341..d236dc5b 100644
--- a/src/main/java/io/fusionauth/pem/PEMDecoder.java
+++ b/src/main/java/io/fusionauth/pem/PEMDecoder.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,6 +21,7 @@
 import io.fusionauth.der.DerValue;
 import io.fusionauth.der.ObjectIdentifier;
 import io.fusionauth.der.Tag;
+import io.fusionauth.jwt.domain.Algorithm;
 import io.fusionauth.jwt.domain.KeyType;
 import io.fusionauth.pem.domain.PEM;
 
@@ -38,6 +39,7 @@
 import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
 import java.security.interfaces.ECPrivateKey;
+import java.security.interfaces.EdECPrivateKey;
 import java.security.interfaces.RSAPrivateCrtKey;
 import java.security.spec.InvalidKeySpecException;
 import java.security.spec.PKCS8EncodedKeySpec;
@@ -79,7 +81,7 @@ public PEM decode(Path path) {
     try {
       return decode(Files.readAllBytes(path));
     } catch (IOException e) {
-      throw new PEMDecoderException("Unable to read the file from path [" + path.toAbsolutePath().toString() + "]", e);
+      throw new PEMDecoderException("Unable to read the file from path [" + path.toAbsolutePath() + "]", e);
     }
   }
 
@@ -122,11 +124,59 @@ public PEM decode(String encodedKey) {
       } else {
         throw new PEMDecoderException(new InvalidParameterException("Unexpected PEM Format"));
       }
-    } catch (CertificateException | InvalidKeyException | InvalidKeySpecException | IOException | NoSuchAlgorithmException e) {
+    } catch (CertificateException | InvalidKeyException | InvalidKeySpecException | IOException |
+             NoSuchAlgorithmException e) {
       throw new PEMDecoderException(e);
     }
   }
 
+//  private PEM decode_ed_key(byte[] bytes) {
+  //
+  // Inpput: MC4CAQAwBQYDK2VwBCIEIIJtJBnTuKbIy5YjoNiH95ky3DcA3kRB0I2i7DkVM6Cf
+  //   -> https://lapo.it/asn1js/#MC4CAQAwBQYDK2VwBCIEIIJtJBnTuKbIy5YjoNiH95ky3DcA3kRB0I2i7DkVM6Cf
+
+  // Example w/out public key
+  //
+  // SEQUENCE (3 elem)
+  //   INTEGER 0
+  //   SEQUENCE (1 elem)
+  //     OBJECT IDENTIFIER 1.3.101.112 curveEd25519 (EdDSA 25519 signature algorithm)
+  //   OCTET STRING (34 byte) 0420826D2419D3B8A6C8CB9623A0D887F79932DC3700DE4441D08DA2EC391533A09F
+  //     OCTET STRING (32 byte) 826D2419D3B8A6C8CB9623A0D887F79932DC3700DE4441D08DA2EC391533A09F
+  //
+
+  // https://www.rfc-editor.org/rfc/rfc8410
+  // https://www.rfc-editor.org/rfc/rfc8410#section-10.3
+
+  // Example w/ public ke
+  //
+  // SEQUENCE (5 elem)
+  //   INTEGER 1
+  //   SEQUENCE (1 elem)
+  //     OBJECT IDENTIFIER 1.3.101.112 curveEd25519 (EdDSA 25519 signature algorithm)
+  //   OCTET STRING (34 byte) 0420D4EE72DBF913584AD5B6D8F1F769F8AD3AFE7C28CBF1D4FBE097A88F44755842
+  //     OCTET STRING (32 byte) D4EE72DBF913584AD5B6D8F1F769F8AD3AFE7C28CBF1D4FBE097A88F44755842
+  //   [0] (1 elem)
+  //     SEQUENCE (2 elem)
+  //       OBJECT IDENTIFIER 1.2.840.113549.1.9.9.20
+  //       SET (1 elem)
+  //         UTF8String Curdle Chairs
+  //   [1] (33 byte) 0019BF44096984CDFE8541BAC167DC3B96C85086AA30B6B6CB0C5C38AD703166E1
+
+  // Grab the public key
+//    DerValue[] sequence = new DerInputStream(bytes).getSequence();
+//    if (sequence.length == 5) {
+//      byte[] bytes = sequence[4].toByteArray();
+//      byte[] encodedPublicKey = getEncodedPublicKeyFromPrivate(bytes, privateKey.getEncoded());
+//      PublicKey publicKey = KeyFactory.getInstance(EdDSA.KeyType.algorithm)
+//          .generatePublic(new X509EncodedKeySpec(encodedPublicKey));
+//      return new PEM(privateKey, publicKey);
+//    } else {
+//      // The private key did not contain the public key
+//      return new PEM(privateKey);
+//    }
+//  }
+
   private PEM decode_EC_privateKey(String encodedKey) throws IOException, NoSuchAlgorithmException, InvalidKeySpecException {
     byte[] bytes = getKeyBytes(encodedKey, EC_PRIVATE_KEY_PREFIX, EC_PRIVATE_KEY_SUFFIX);
     DerValue[] sequence = new DerInputStream(bytes).getSequence();
@@ -271,18 +321,19 @@ private PEM decode_PKCS_8(String encodedKey) throws NoSuchAlgorithmException, IO
     //   parameters      ANY DEFINED BY algorithm OPTIONAL
     // }
 
-    if (sequence.length != 3 || !sequence[0].tag.is(Tag.Integer) || !sequence[1].tag.is(Tag.Sequence) || !sequence[2].tag.is(Tag.OctetString)) {
+    // EC and RSA will be length 3, EdDSA will be 5
+    if ((sequence.length != 3 && sequence.length != 5) || !sequence[0].tag.is(Tag.Integer) || !sequence[1].tag.is(Tag.Sequence) || !sequence[2].tag.is(Tag.OctetString)) {
       // Expect the following format : [ Integer | Sequence | OctetString ]
-      throw new InvalidKeyException("Could not decode the private key. Expecting values in the DER encoded sequence in the following format [ Integer | Sequence | OctetString ]");
+      throw new InvalidKeyException("Could not decode the private key. Expecting values in the DER encoded sequence in the following format [ Integer | Sequence | OctetString ] or [ Integer | Sequence | OctetString | Attributes ]");
     }
 
     ObjectIdentifier algorithmOID = new DerInputStream(sequence[1].toByteArray()).getOID();
     KeyType type = KeyType.getKeyTypeFromOid(algorithmOID.decode());
     if (type == null) {
-      throw new InvalidKeyException("Could not decode the private key. Expected an EC or RSA key type but found OID [" + algorithmOID.decode() + "] and was unable to match that to a supported algorithm.");
+      throw new InvalidKeyException("Could not decode the private key. Expected an EC, ED or RSA key type but found OID [" + algorithmOID.decode() + "] and was unable to match that to a supported algorithm.");
     }
 
-    PrivateKey privateKey = KeyFactory.getInstance(type.name()).generatePrivate(new PKCS8EncodedKeySpec(bytes));
+    PrivateKey privateKey = KeyFactory.getInstance(type.getAlgorithm()).generatePrivate(new PKCS8EncodedKeySpec(bytes));
 
     // Attempt to extract the public key if available
     if (privateKey instanceof ECPrivateKey) {
@@ -300,6 +351,19 @@ private PEM decode_PKCS_8(String encodedKey) throws NoSuchAlgorithmException, IO
       BigInteger publicExponent = ((RSAPrivateCrtKey) privateKey).getPublicExponent();
       PublicKey publicKey = KeyFactory.getInstance("RSA").generatePublic(new RSAPublicKeySpec(modulus, publicExponent));
       return new PEM(privateKey, publicKey);
+    } else if (privateKey instanceof EdECPrivateKey) {
+//      DerValue[] privateKeySequence = new DerInputStream(sequence[2]).getSequence();
+      if (sequence.length == 5) {
+        byte[] bitString = sequence[4].toByteArray();
+        byte[] encodedPublicKey = getEncodedPublicKeyFromPrivate(bitString, privateKey.getEncoded());
+        PublicKey publicKey = KeyFactory.getInstance(Algorithm.EdDSA.getName())
+            .generatePublic(new X509EncodedKeySpec(encodedPublicKey));
+        return new PEM(privateKey, publicKey);
+      } else {
+        // The private key did not contain the public key
+        return new PEM(privateKey);
+      }
+
     }
 
     return new PEM(privateKey);
@@ -334,7 +398,7 @@ private PEM decode_X_509(String encodedKey) throws IOException, NoSuchAlgorithmE
       throw new InvalidKeyException("Could not decode the X.509 public key. Expected at 2 values in the DER encoded sequence but found [" + sequence.length + "]");
     }
 
-    return new PEM(KeyFactory.getInstance(type.name()).generatePublic(new X509EncodedKeySpec(bytes)));
+    return new PEM(KeyFactory.getInstance(type.getAlgorithm()).generatePublic(new X509EncodedKeySpec(bytes)));
   }
 
   private byte[] getKeyBytes(String key, String keyPrefix, String keySuffix) {
@@ -345,20 +409,29 @@ private byte[] getKeyBytes(String key, String keyPrefix, String keySuffix) {
     return Base64.getDecoder().decode(base64);
   }
 
-  private PublicKey getPublicKeyFromPrivateEC(DerValue bitString, ECPrivateKey privateKey) throws InvalidKeySpecException, IOException, NoSuchAlgorithmException {
+  private byte[] getEncodedPublicKeyFromPrivate(byte[] bitString, byte[] encodedKey) throws IOException {
     // Build an X.509 DER encoded byte array from the provided bitString
     //
     // SubjectPublicKeyInfo ::= SEQUENCE {
     //   algorithm         AlgorithmIdentifier,
     //   subjectPublicKey  BIT STRING
     // }
-    DerValue[] sequence = new DerInputStream(privateKey.getEncoded()).getSequence();
-    byte[] encodedPublicKey = new DerOutputStream()
+    DerValue[] sequence = new DerInputStream(encodedKey).getSequence();
+    return new DerOutputStream()
         .writeValue(new DerValue(Tag.Sequence, new DerOutputStream()
             .writeValue(new DerValue(Tag.Sequence, sequence[1].toByteArray()))
-            .writeValue(new DerValue(Tag.BitString, bitString.toByteArray()))))
+            .writeValue(new DerValue(Tag.BitString, bitString))))
         .toByteArray();
+  }
 
+  private PublicKey getPublicKeyFromPrivateEC(DerValue bitString, ECPrivateKey privateKey) throws InvalidKeySpecException, IOException, NoSuchAlgorithmException {
+    // Build an X.509 DER encoded byte array from the provided bitString
+    //
+    // SubjectPublicKeyInfo ::= SEQUENCE {
+    //   algorithm         AlgorithmIdentifier,
+    //   subjectPublicKey  BIT STRING
+    // }
+    byte[] encodedPublicKey = getEncodedPublicKeyFromPrivate(bitString.toByteArray(), privateKey.getEncoded());
     return KeyFactory.getInstance("EC").generatePublic(new X509EncodedKeySpec(encodedPublicKey));
   }
 }
diff --git a/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java b/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
index 83c35834..4e262b18 100644
--- a/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
+++ b/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,6 +31,8 @@
 import java.security.cert.Certificate;
 import java.security.interfaces.ECPrivateKey;
 import java.security.interfaces.ECPublicKey;
+import java.security.interfaces.EdECPrivateKey;
+import java.security.interfaces.EdECPublicKey;
 import java.security.interfaces.RSAPrivateKey;
 import java.security.interfaces.RSAPublicKey;
 import java.util.Arrays;
@@ -164,4 +166,22 @@ public void rsa_public() throws Exception {
     Certificate cert2 = PEM.decode(Paths.get("src/test/resources/rsa_certificate_gd_bundle_g2.pem")).certificate;
     assertJSONEquals(JSONWebKey.build(cert2), "src/test/resources/jwk/rsa_certificate_gd_bundle_g2.json");
   }
+
+  @Test
+  public void eddsa_private() throws Exception {
+    // EdDSA 256 Private key - PKCS#8 encapsulated already
+    EdECPrivateKey key = PEM.decode(Paths.get("src/test/resources/ed_dsa_ed25519_private_key.pem")).getPrivateKey();
+    assertJSONEquals(JSONWebKey.build(key), "src/test/resources/jwk/ed_dsa_ed25519_private_key.json");
+  }
+
+  @Test
+  public void eddsa_public() throws Exception {
+    // ed25519
+    EdECPublicKey publicKey = PEM.decode(Paths.get("src/test/resources/ed_dsa_ed25519_public_key.pem")).getPublicKey();
+    assertJSONEquals(JSONWebKey.build(publicKey), "src/test/resources/jwk/ed_dsa_ed25519_public_key.json");
+
+    // EC 256 Certificate
+    Certificate certificate = PEM.decode(Paths.get("src/test/resources/ec_certificate_p_256.pem")).getCertificate();
+    assertJSONEquals(JSONWebKey.build(certificate), "src/test/resources/jwk/ec_certificate_p_256.json");
+  }
 }
diff --git a/src/test/java/io/fusionauth/jwt/ed/EdSignerTest.java b/src/test/java/io/fusionauth/jwt/ed/EdSignerTest.java
new file mode 100644
index 00000000..94951424
--- /dev/null
+++ b/src/test/java/io/fusionauth/jwt/ed/EdSignerTest.java
@@ -0,0 +1,112 @@
+/*
+ * Copyright (c) 2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+package io.fusionauth.jwt.ed;
+
+import io.fusionauth.jwt.BaseJWTTest;
+import io.fusionauth.jwt.Signer;
+import io.fusionauth.jwt.Verifier;
+import io.fusionauth.jwt.domain.Algorithm;
+import io.fusionauth.jwt.domain.JWT;
+import io.fusionauth.pem.domain.PEM;
+import org.testng.annotations.Test;
+
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.Arrays;
+import java.util.List;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertNull;
+import static org.testng.Assert.assertTrue;
+
+/**
+ * @author Daniel DeGroff
+ */
+public class EdSignerTest extends BaseJWTTest {
+  @Test
+  public void canVerify() {
+    Verifier verifier = EdDSAVerifier.newVerifier(getPath("ed_dsa_public_key.pem"));
+    assertTrue(verifier.canVerify(Algorithm.EdDSA));
+  }
+
+  @Test
+  public void decodePrivateKey() throws Exception {
+    List<String> privateKeys = Arrays.asList(
+        "ed_dsa_ed25519_private_key.pem",
+        "ed_dsa_private_key.pem");
+
+    // These keys do not contain a public key
+    for (String f : privateKeys) {
+      String message = "For file [" + f + "]";
+      String encodedPEM = new String(Files.readAllBytes(Paths.get("src/test/resources/" + f)));
+      assertTrue(encodedPEM.contains(PEM.PKCS_8_PRIVATE_KEY_PREFIX), message);
+
+      PEM pem = PEM.decode(encodedPEM);
+      assertNotNull(pem.privateKey, message);
+      assertEquals(pem.privateKey.getFormat(), "PKCS#8", message);
+      assertNull(pem.publicKey, message);
+    }
+
+    // Private keys that contain a public key
+    for (String f : List.of("ed_dsa_ed25519_private_key_pub.pem")) {
+      String message = "For file [" + f + "]";
+      String encodedPEM = new String(Files.readAllBytes(Paths.get("src/test/resources/" + f)));
+      assertTrue(encodedPEM.contains(PEM.PKCS_8_PRIVATE_KEY_PREFIX), message);
+
+      PEM pem = PEM.decode(encodedPEM);
+      assertNotNull(pem.privateKey, message);
+      assertEquals(pem.privateKey.getFormat(), "PKCS#8", message);
+      assertNotNull(pem.publicKey, message);
+      assertEquals(pem.publicKey.getFormat(), "X.509", message);
+    }
+  }
+
+  @Test
+  public void decodePublicKey() throws Exception {
+    List<String> publicKeys = Arrays.asList(
+        "ed_dsa_ed25519_public_key.pem",
+        "ed_dsa_public_key.pem");
+
+    for (String f : publicKeys) {
+      String message = "For file [" + f + "]";
+      String encodedPEM = new String(Files.readAllBytes(Paths.get("src/test/resources/" + f)));
+      assertTrue(encodedPEM.contains(PEM.X509_PUBLIC_KEY_PREFIX), message);
+      assertTrue(encodedPEM.contains(PEM.X509_PUBLIC_KEY_SUFFIX), message);
+
+      PEM pem = PEM.decode(encodedPEM);
+      assertNotNull(pem.publicKey, message);
+      assertEquals(pem.publicKey.getFormat(), "X.509", message);
+    }
+  }
+
+  @Test
+  public void signAndVerify() throws Exception {
+    JWT jwt = new JWT().setSubject("1234567890");
+
+    // Sign the JWT
+    Signer signer = EdDSASigner.newSigner(new String(Files.readAllBytes(Paths.get("src/test/resources/ed_dsa_private_key.pem"))));
+    String encodedJWT = JWT.getEncoder().encode(jwt, signer);
+
+    // Verify the JWT
+    Verifier verifier = EdDSAVerifier.newVerifier(Paths.get("src/test/resources/ed_dsa_public_key.pem"));
+    JWT actual = JWT.getDecoder().decode(encodedJWT, verifier);
+
+    assertEquals(actual.subject, jwt.subject);
+    assertEquals(actual.header.algorithm.name(), "EdDSA");
+  }
+}
diff --git a/src/test/java/io/fusionauth/jwt/ed/EdVerifierTest.java b/src/test/java/io/fusionauth/jwt/ed/EdVerifierTest.java
new file mode 100644
index 00000000..f30665d2
--- /dev/null
+++ b/src/test/java/io/fusionauth/jwt/ed/EdVerifierTest.java
@@ -0,0 +1,112 @@
+/*
+ * Copyright (c) 2025, FusionAuth, All Rights Reserved
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
+ * either express or implied. See the License for the specific
+ * language governing permissions and limitations under the License.
+ */
+
+package io.fusionauth.jwt.ed;
+
+import io.fusionauth.jwt.BaseJWTTest;
+import io.fusionauth.jwt.Signer;
+import io.fusionauth.jwt.Verifier;
+import io.fusionauth.jwt.domain.Algorithm;
+import io.fusionauth.jwt.domain.JWT;
+import io.fusionauth.pem.domain.PEM;
+import org.testng.annotations.Test;
+
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.Arrays;
+import java.util.List;
+
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertNull;
+import static org.testng.Assert.assertTrue;
+
+/**
+ * @author Daniel DeGroff
+ */
+public class EdVerifierTest extends BaseJWTTest {
+  @Test
+  public void canVerify() {
+    Verifier verifier = EdDSAVerifier.newVerifier(getPath("ed_dsa_public_key.pem"));
+    assertTrue(verifier.canVerify(Algorithm.EdDSA));
+  }
+
+  @Test
+  public void decodePrivateKey() throws Exception {
+    List<String> privateKeys = Arrays.asList(
+        "ed_dsa_ed25519_private_key.pem",
+        "ed_dsa_private_key.pem");
+
+    // These keys do not contain a public key
+    for (String f : privateKeys) {
+      String message = "For file [" + f + "]";
+      String encodedPEM = new String(Files.readAllBytes(Paths.get("src/test/resources/" + f)));
+      assertTrue(encodedPEM.contains(PEM.PKCS_8_PRIVATE_KEY_PREFIX), message);
+
+      PEM pem = PEM.decode(encodedPEM);
+      assertNotNull(pem.privateKey, message);
+      assertEquals(pem.privateKey.getFormat(), "PKCS#8", message);
+      assertNull(pem.publicKey, message);
+    }
+
+    // Private keys that contain a public key
+    for (String f : List.of("ed_dsa_ed25519_private_key_pub.pem")) {
+      String message = "For file [" + f + "]";
+      String encodedPEM = new String(Files.readAllBytes(Paths.get("src/test/resources/" + f)));
+      assertTrue(encodedPEM.contains(PEM.PKCS_8_PRIVATE_KEY_PREFIX), message);
+
+      PEM pem = PEM.decode(encodedPEM);
+      assertNotNull(pem.privateKey, message);
+      assertEquals(pem.privateKey.getFormat(), "PKCS#8", message);
+      assertNotNull(pem.publicKey, message);
+      assertEquals(pem.publicKey.getFormat(), "X.509", message);
+    }
+  }
+
+  @Test
+  public void decodePublicKey() throws Exception {
+    List<String> publicKeys = Arrays.asList(
+        "ed_dsa_ed25519_public_key.pem",
+        "ed_dsa_public_key.pem");
+
+    for (String f : publicKeys) {
+      String message = "For file [" + f + "]";
+      String encodedPEM = new String(Files.readAllBytes(Paths.get("src/test/resources/" + f)));
+      assertTrue(encodedPEM.contains(PEM.X509_PUBLIC_KEY_PREFIX), message);
+      assertTrue(encodedPEM.contains(PEM.X509_PUBLIC_KEY_SUFFIX), message);
+
+      PEM pem = PEM.decode(encodedPEM);
+      assertNotNull(pem.publicKey, message);
+      assertEquals(pem.publicKey.getFormat(), "X.509", message);
+    }
+  }
+
+  @Test
+  public void signAndVerify() throws Exception {
+    JWT jwt = new JWT().setSubject("1234567890");
+
+    // Sign the JWT
+    Signer signer = EdDSASigner.newSigner(new String(Files.readAllBytes(Paths.get("src/test/resources/ed_dsa_private_key.pem"))));
+    String encodedJWT = JWT.getEncoder().encode(jwt, signer);
+
+    // Verify the JWT
+    Verifier verifier = EdDSAVerifier.newVerifier(Paths.get("src/test/resources/ed_dsa_public_key.pem"));
+    JWT actual = JWT.getDecoder().decode(encodedJWT, verifier);
+
+    assertEquals(actual.subject, jwt.subject);
+    assertEquals(actual.header.algorithm.name(), "EdDSA");
+  }
+}
diff --git a/src/test/resources/ed_dsa_ed25519_private_key.pem b/src/test/resources/ed_dsa_ed25519_private_key.pem
new file mode 100644
index 00000000..17356b58
--- /dev/null
+++ b/src/test/resources/ed_dsa_ed25519_private_key.pem
@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+MC4CAQAwBQYDK2VwBCIEIKuumyVdS3AhFAreOGHLYtT4O21YUYBibakGNzq2kcwi
+-----END PRIVATE KEY-----
\ No newline at end of file
diff --git a/src/test/resources/ed_dsa_ed25519_private_key_pub.pem b/src/test/resources/ed_dsa_ed25519_private_key_pub.pem
new file mode 100644
index 00000000..7179f294
--- /dev/null
+++ b/src/test/resources/ed_dsa_ed25519_private_key_pub.pem
@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MHICAQEwBQYDK2VwBCIEINTuctv5E1hK1bbY8fdp+K06/nwoy/HU++CXqI9EdVhC
+oB8wHQYKKoZIhvcNAQkJFDEPDA1DdXJkbGUgQ2hhaXJzgSEAGb9ECWmEzf6FQbrB
+Z9w7lshQhqowtrbLDFw4rXAxZuE=
+-----END PRIVATE KEY-----
\ No newline at end of file
diff --git a/src/test/resources/ed_dsa_ed25519_public_key.pem b/src/test/resources/ed_dsa_ed25519_public_key.pem
new file mode 100644
index 00000000..5769a943
--- /dev/null
+++ b/src/test/resources/ed_dsa_ed25519_public_key.pem
@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAun73P2PfgPZTvbRvlHjVkjhqUhAQOVC1wRa+vmX+dIc=
+-----END PUBLIC KEY-----
\ No newline at end of file
diff --git a/src/test/resources/ed_dsa_private_key.pem b/src/test/resources/ed_dsa_private_key.pem
new file mode 100644
index 00000000..c5c49669
--- /dev/null
+++ b/src/test/resources/ed_dsa_private_key.pem
@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+MC4CAQAwBQYDK2VwBCIEIIJtJBnTuKbIy5YjoNiH95ky3DcA3kRB0I2i7DkVM6Cf
+-----END PRIVATE KEY-----
\ No newline at end of file
diff --git a/src/test/resources/ed_dsa_public_key.pem b/src/test/resources/ed_dsa_public_key.pem
new file mode 100644
index 00000000..eb48cdc4
--- /dev/null
+++ b/src/test/resources/ed_dsa_public_key.pem
@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEA7fySb/9h7hVH8j1paD5IoLfXj4prjfNLwOPUYKvsTOc=
+-----END PUBLIC KEY-----
\ No newline at end of file
diff --git a/src/test/resources/jwk/ed_dsa_ed25519_private_key.json b/src/test/resources/jwk/ed_dsa_ed25519_private_key.json
new file mode 100644
index 00000000..6f02f9c0
--- /dev/null
+++ b/src/test/resources/jwk/ed_dsa_ed25519_private_key.json
@@ -0,0 +1,9 @@
+{
+  "kty": "OKP",
+  "alg": "EdDSA",
+  "kid": "9d9e739a-1c66-4f51-ae58-62ffab702d4e",
+  "crv": "Ed25519",
+  "x": "un73P2PfgPZTvbRvlHjVkjhqUhAQOVC1wRa-vmX-dIc",
+  "d": "q66bJV1LcCEUCt44Ycti1Pg7bVhRgGJtqQY3OraRzCI",
+  "use": "sig"
+}
diff --git a/src/test/resources/jwk/ed_dsa_ed25519_public_key.json b/src/test/resources/jwk/ed_dsa_ed25519_public_key.json
new file mode 100644
index 00000000..96eff50c
--- /dev/null
+++ b/src/test/resources/jwk/ed_dsa_ed25519_public_key.json
@@ -0,0 +1,8 @@
+{
+  "kty": "OKP",
+  "alg": "EdDSA",
+  "kid": "9d9e739a-1c66-4f51-ae58-62ffab702d4e",
+  "crv": "Ed25519",
+  "x": "un73P2PfgPZTvbRvlHjVkjhqUhAQOVC1wRa-vmX-dIc",
+  "use": "sig"
+}
diff --git a/src/test/resources/jwk/ed_dsa_private_key.json b/src/test/resources/jwk/ed_dsa_private_key.json
new file mode 100644
index 00000000..519550eb
--- /dev/null
+++ b/src/test/resources/jwk/ed_dsa_private_key.json
@@ -0,0 +1,7 @@
+{
+  "alg": "EdDSA",
+  "crv": "Ed25519",
+  "kty": "OKP",
+  "use": "sig",
+  "d": ""
+}
\ No newline at end of file
diff --git a/src/test/resources/jwk/ed_dsa_public_key.json b/src/test/resources/jwk/ed_dsa_public_key.json
new file mode 100644
index 00000000..c84acd17
--- /dev/null
+++ b/src/test/resources/jwk/ed_dsa_public_key.json
@@ -0,0 +1,7 @@
+{
+  "alg": "EdDSA",
+  "crv": "Ed25519",
+  "kty": "OKP",
+  "use": "sig",
+  "x": "Z0zsq2DU48BL841rio_Xt6BIPmhpPfJHFe5h_2-S_O0"
+}
\ No newline at end of file

From 545f61195b3847caec2df85aa5881cecce83681d Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Thu, 30 Oct 2025 12:16:31 -0600
Subject: [PATCH 02/29] working

---
 build.savant | 1 -
 1 file changed, 1 deletion(-)

diff --git a/build.savant b/build.savant
index ed78c209..26ee904c 100644
--- a/build.savant
+++ b/build.savant
@@ -63,7 +63,6 @@ dependency = loadPlugin(id: "org.savantbuild.plugin:dependency:2.0.0")
 file = loadPlugin(id: "org.savantbuild.plugin:file:2.0.0")
 java = loadPlugin(id: "org.savantbuild.plugin:java:2.0.0")
 javaTestNG = loadPlugin(id: "org.savantbuild.plugin:java-testng:2.1.0")
-groovy = loadPlugin(id: "org.savantbuild.plugin:groovy:2.0.0")
 idea = loadPlugin(id: "org.savantbuild.plugin:idea:2.0.0")
 pom = loadPlugin(id: "org.savantbuild.plugin:pom:2.0.0")
 release = loadPlugin(id: "org.savantbuild.plugin:release-git:2.0.0")

From a6bef18d99d98827cf351a0cf6b0b887d8ec8fc1 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Mon, 17 Nov 2025 13:43:06 -0700
Subject: [PATCH 03/29] Working

---
 fusionauth-jwt.iml                            |  4 +-
 fusionauth-jwt.ipr                            |  1 +
 pom.xml                                       |  4 +-
 src/main/java/io/fusionauth/der/DerValue.java |  5 +-
 .../io/fusionauth/der/ObjectIdentifier.java   |  7 +-
 .../io/fusionauth/jwks/JSONWebKeyBuilder.java | 79 +++++++++++++++----
 .../io/fusionauth/jwt/domain/Algorithm.java   | 21 +++--
 .../io/fusionauth/jwt/domain/KeyType.java     |  7 +-
 .../io/fusionauth/jwt/ed/EdDSASigner.java     | 16 +---
 .../io/fusionauth/jwt/ed/EdDSAVerifier.java   | 20 +----
 .../jwks/JSONWebKeyBuilderTest.java           | 20 +++--
 .../resources/ed_dsa_ed448_private_key.pem    |  4 +
 .../resources/ed_dsa_ed448_public_key.pem     |  4 +
 .../jwk/ed_dsa_ed25519_private_key.json       |  1 -
 .../jwk/ed_dsa_ed25519_public_key.json        |  1 -
 .../jwk/ed_dsa_ed448_private_key.json         |  8 ++
 .../jwk/ed_dsa_ed448_public_key.json          |  7 ++
 17 files changed, 131 insertions(+), 78 deletions(-)
 create mode 100644 src/test/resources/ed_dsa_ed448_private_key.pem
 create mode 100644 src/test/resources/ed_dsa_ed448_public_key.pem
 create mode 100644 src/test/resources/jwk/ed_dsa_ed448_private_key.json
 create mode 100644 src/test/resources/jwk/ed_dsa_ed448_public_key.json

diff --git a/fusionauth-jwt.iml b/fusionauth-jwt.iml
index 55235708..f4cc4061 100644
--- a/fusionauth-jwt.iml
+++ b/fusionauth-jwt.iml
@@ -49,11 +49,11 @@
     <orderEntry type="module-library" scope="TEST">
       <library>
         <CLASSES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/org/bouncycastle/bc-fips/1.0.2+P6/bc-fips-1.0.2+P6.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/org/bouncycastle/bc-fips/2.1.2/bc-fips-2.1.2.jar!/" />
         </CLASSES>
         <JAVADOC />
         <SOURCES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/org/bouncycastle/bc-fips/1.0.2+P6/bc-fips-1.0.2+P6-src.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/org/bouncycastle/bc-fips/2.1.2/bc-fips-2.1.2-src.jar!/" />
         </SOURCES>
       </library>
     </orderEntry>
diff --git a/fusionauth-jwt.ipr b/fusionauth-jwt.ipr
index 1726ad06..0be912ff 100644
--- a/fusionauth-jwt.ipr
+++ b/fusionauth-jwt.ipr
@@ -30,6 +30,7 @@
   <component name="InspectionProjectProfileManager">
     <profile version="1.0">
       <option name="myName" value="Project Default" />
+      <inspection_tool class="ClassCanBeRecord" enabled="false" level="WEAK WARNING" enabled_by_default="false" />
       <inspection_tool class="DuplicatedCode" enabled="true" level="WARNING" enabled_by_default="true" />
       <inspection_tool class="Duplicates" enabled="true" level="WARNING" enabled_by_default="true">
         <option name="minCloneLength" value="35" />
diff --git a/pom.xml b/pom.xml
index 719983c1..0b39cb5a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -3,7 +3,7 @@
 
     <groupId>io.fusionauth</groupId>
     <artifactId>fusionauth-jwt</artifactId>
-    <version>5.3.3</version>
+    <version>6.0.0</version>
     <packaging>jar</packaging>
 
     <name>FusionAuth JWT</name>
@@ -87,7 +87,7 @@
     <dependency>
       <groupId>org.bouncycastle</groupId>
       <artifactId>bc-fips</artifactId>
-      <version>1.0.2.6</version>
+      <version>2.1.2</version>
       <type>jar</type>
       <scope>test</scope>
       <optional>false</optional>
diff --git a/src/main/java/io/fusionauth/der/DerValue.java b/src/main/java/io/fusionauth/der/DerValue.java
index ba022fdf..cb876557 100644
--- a/src/main/java/io/fusionauth/der/DerValue.java
+++ b/src/main/java/io/fusionauth/der/DerValue.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -52,8 +52,7 @@ public DerValue(int tag, DerOutputStream os) {
   @Override
   public boolean equals(Object o) {
     if (this == o) return true;
-    if (!(o instanceof DerValue)) return false;
-    DerValue derValue = (DerValue) o;
+    if (!(o instanceof DerValue derValue)) return false;
     return tag == derValue.tag &&
         Arrays.equals(value.toByteArray(), derValue.value.toByteArray());
   }
diff --git a/src/main/java/io/fusionauth/der/ObjectIdentifier.java b/src/main/java/io/fusionauth/der/ObjectIdentifier.java
index 89da760d..34bd607a 100644
--- a/src/main/java/io/fusionauth/der/ObjectIdentifier.java
+++ b/src/main/java/io/fusionauth/der/ObjectIdentifier.java
@@ -34,7 +34,12 @@ public class ObjectIdentifier implements Buildable<ObjectIdentifier> {
   /**
    * Edwards-curve Digital Signature Algorithm (EdDSA) Ed25519
    */
-  public static final String EdDSA = "1.3.101.112";
+  public static final String EdDSA_25519 = "1.3.101.112";
+
+  /**
+   * Edwards-curve Digital Signature Algorithm (EdDSA) Ed448
+   */
+  public static final String EdDSA_448 = "1.3.101.113";
 
   /**
    * Elliptic curve / 384 bit / secp384r1 / prime384v1
diff --git a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
index 04e6ad83..7ce4f73e 100644
--- a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
+++ b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
@@ -16,6 +16,7 @@
 
 package io.fusionauth.jwks;
 
+import io.fusionauth.der.DerDecodingException;
 import io.fusionauth.der.DerInputStream;
 import io.fusionauth.der.DerValue;
 import io.fusionauth.jwks.domain.JSONWebKey;
@@ -27,9 +28,13 @@
 
 import java.io.IOException;
 import java.math.BigInteger;
+import java.security.InvalidAlgorithmParameterException;
 import java.security.Key;
+import java.security.KeyPairGenerator;
+import java.security.NoSuchAlgorithmException;
 import java.security.PrivateKey;
 import java.security.PublicKey;
+import java.security.SecureRandom;
 import java.security.cert.Certificate;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.X509Certificate;
@@ -37,9 +42,12 @@
 import java.security.interfaces.ECPrivateKey;
 import java.security.interfaces.ECPublicKey;
 import java.security.interfaces.EdECPrivateKey;
+import java.security.interfaces.EdECPublicKey;
 import java.security.interfaces.RSAPrivateCrtKey;
 import java.security.interfaces.RSAPrivateKey;
 import java.security.interfaces.RSAPublicKey;
+import java.security.spec.NamedParameterSpec;
+import java.util.Arrays;
 import java.util.Base64;
 import java.util.Collections;
 import java.util.Objects;
@@ -47,7 +55,8 @@
 import static io.fusionauth.der.ObjectIdentifier.ECDSA_P256;
 import static io.fusionauth.der.ObjectIdentifier.ECDSA_P384;
 import static io.fusionauth.der.ObjectIdentifier.ECDSA_P521;
-import static io.fusionauth.der.ObjectIdentifier.EdDSA;
+import static io.fusionauth.der.ObjectIdentifier.EdDSA_25519;
+import static io.fusionauth.der.ObjectIdentifier.EdDSA_448;
 import static io.fusionauth.jwks.JWKUtils.base64EncodeUint;
 
 /**
@@ -129,13 +138,12 @@ public JSONWebKey build(PrivateKey privateKey) {
       key.x = base64EncodeUint(ecPrivateKey.getParams().getGenerator().getAffineX(), byteLength);
       key.y = base64EncodeUint(ecPrivateKey.getParams().getGenerator().getAffineY(), byteLength);
     } else if (privateKey instanceof EdECPrivateKey edPrivateKey) {
-      key.crv = getCurveOID(privateKey);
+      key.crv = getCurveOID(edPrivateKey);
       key.alg = Algorithm.EdDSA;
 
-//      int byteLength = getCoordinateLength(edPrivateKey);
-//      key.d = base64EncodeUint(edPrivateKey.getS(), byteLength);
-//      key.x = base64EncodeUint(edPrivateKey.getParams().getGenerator().getAffineX(), byteLength);
-//      key.y = base64EncodeUint(edPrivateKey.getParams().getGenerator().getAffineY(), byteLength);
+      var privateKeyBytes = edPrivateKey.getBytes().orElseThrow(() -> new JSONWebKeyBuilderException("Unable to obtain the private key bytes."));
+      key.d = Base64.getUrlEncoder().withoutPadding().encodeToString(privateKeyBytes);
+      key.x = Base64.getUrlEncoder().withoutPadding().encodeToString(generateEdDSAPublicKeyFromPrivate(privateKeyBytes, key.crv));
     }
 
     return key;
@@ -172,6 +180,10 @@ public JSONWebKey build(PublicKey publicKey) {
       int byteLength = getCoordinateLength(ecPublicKey);
       key.x = base64EncodeUint(ecPublicKey.getW().getAffineX(), byteLength);
       key.y = base64EncodeUint(ecPublicKey.getW().getAffineY(), byteLength);
+    } else if (key.kty == KeyType.OKP) {
+      key.alg = Algorithm.EdDSA;
+      key.crv = getCurveOID(publicKey);
+      key.x = base64EncodeUint(extractX(publicKey.getEncoded()));
     }
 
     return key;
@@ -197,7 +209,7 @@ public JSONWebKey build(Certificate certificate) {
         key.x5t = JWTUtils.generateJWS_x5t(encodedCertificate);
         key.x5t_256 = JWTUtils.generateJWS_x5t("SHA-256", encodedCertificate);
       } catch (CertificateEncodingException e) {
-        throw new JSONWebKeyBuilderException("Failed to decode X.509 certificate", e);
+        throw new JSONWebKeyBuilderException("Failed to decode X.509 certificate.", e);
       }
     }
     return key;
@@ -208,25 +220,32 @@ private int getCoordinateLength(ECKey key) {
   }
 
   private KeyType getKeyType(Key key) {
-    if (key.getAlgorithm().equals("RSA")) {
-      return KeyType.RSA;
-    } else if (key.getAlgorithm().equals("EC")) {
-      return KeyType.EC;
-    } else if (key.getAlgorithm().equals("EdDSA")) {
-      return KeyType.ED;
-    }
+    return switch (key.getAlgorithm()) {
+      case "RSA" -> KeyType.RSA;
+      case "EC" -> KeyType.EC;
+      // JCE returns EdDSA, and BC returns Ed25519 or Ed448 respectively
+      case "EdDSA", "Ed25519", "Ed448" -> KeyType.OKP;
+      default -> null;
+    };
 
-    return null;
   }
 
   private String readCurveObjectIdentifier(Key key) {
     try {
       DerValue[] sequence = new DerInputStream(key.getEncoded()).getSequence();
       if (key instanceof PrivateKey) {
+        if (key instanceof EdECPrivateKey) {
+          return sequence[1].getOID().decode();
+        }
+
         // Read the first value in the sequence, it is the algorithm OID, the second will be the curve
         sequence[1].getOID();
         return sequence[1].getOID().decode();
       } else {
+        if (key instanceof EdECPublicKey) {
+          return sequence[0].getOID().decode();
+        }
+
         // Read the first value in the sequence, it is the algorithm OID, the second will be the curve
         sequence[0].getOID();
         return sequence[0].getOID().decode();
@@ -236,14 +255,40 @@ private String readCurveObjectIdentifier(Key key) {
     }
   }
 
-  String getCurveOID(Key key) {
+  private BigInteger extractX(byte[] bytes) {
+    var is = new DerInputStream(bytes);
+    try {
+      var sequence = is.getSequence();
+      return sequence[1].getBigInteger();
+    } catch (DerDecodingException e) {
+      throw new JSONWebKeyBuilderException("Unable to read x coordinate from the public key.", e);
+    }
+  }
+
+  private byte[] generateEdDSAPublicKeyFromPrivate(byte[] privateKey, String curve) {
+    try {
+      KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(curve);
+      keyPairGenerator.initialize(new NamedParameterSpec(curve), new SecureRandom() {
+        public void nextBytes(byte[] bytes) {
+          System.arraycopy(privateKey, 0, bytes, 0, privateKey.length);
+        }
+      });
+      byte[] spki = keyPairGenerator.generateKeyPair().getPublic().getEncoded();
+      return Arrays.copyOfRange(spki, spki.length - privateKey.length, spki.length);
+    } catch (InvalidAlgorithmParameterException | NoSuchAlgorithmException e) {
+      throw new JSONWebKeyBuilderException("Unable to build the public key for the EdDSA private key using curve [" + curve + "]", e);
+    }
+  }
+
+  private String getCurveOID(Key key) {
     // Match up the Curve Object Identifier to a string value
     String oid = readCurveObjectIdentifier(key);
     return switch (oid) {
       case ECDSA_P256 -> "P-256";
       case ECDSA_P384 -> "P-384";
       case ECDSA_P521 -> "P-521";
-      case EdDSA -> "Ed25519";
+      case EdDSA_25519 -> "Ed25519";
+      case EdDSA_448 -> "Ed448";
       default -> null;
     };
   }
diff --git a/src/main/java/io/fusionauth/jwt/domain/Algorithm.java b/src/main/java/io/fusionauth/jwt/domain/Algorithm.java
index 11f650e8..983377da 100644
--- a/src/main/java/io/fusionauth/jwt/domain/Algorithm.java
+++ b/src/main/java/io/fusionauth/jwt/domain/Algorithm.java
@@ -25,8 +25,8 @@
  */
 public enum Algorithm {
   /**
-   * EdDSA
-   * OID: 1.3.101.112
+   * EdDSA (ed25519, ed448)
+   * OID: 1.3.101.112, and 1.3.101.112
    */
   EdDSA("EdDSA"),
 
@@ -125,15 +125,12 @@ public String getName() {
   }
 
   public int getSaltLength() {
-    switch (this) {
-      case PS256:
-        return 32;
-      case PS384:
-        return 48;
-      case PS512:
-        return 64;
-      default:
-        throw new IllegalStateException("An incompatible algorithm was provided, this method is only used for RSASSA-PSS algorithms.");
-    }
+    return switch (this) {
+      case PS256 -> 32;
+      case PS384 -> 48;
+      case PS512 -> 64;
+      default ->
+          throw new IllegalStateException("An incompatible algorithm was provided, this method is only used for RSASSA-PSS algorithms.");
+    };
   }
 }
diff --git a/src/main/java/io/fusionauth/jwt/domain/KeyType.java b/src/main/java/io/fusionauth/jwt/domain/KeyType.java
index 1a60fa6c..36d075e8 100644
--- a/src/main/java/io/fusionauth/jwt/domain/KeyType.java
+++ b/src/main/java/io/fusionauth/jwt/domain/KeyType.java
@@ -19,7 +19,8 @@
 import java.util.Objects;
 
 import static io.fusionauth.der.ObjectIdentifier.EC_ENCRYPTION;
-import static io.fusionauth.der.ObjectIdentifier.EdDSA;
+import static io.fusionauth.der.ObjectIdentifier.EdDSA_25519;
+import static io.fusionauth.der.ObjectIdentifier.EdDSA_448;
 import static io.fusionauth.der.ObjectIdentifier.RSA_ENCRYPTION;
 
 /**
@@ -37,7 +38,7 @@
 public enum KeyType {
   RSA("RSA"),
   EC("EC"),
-  ED("EdDSA");
+  OKP("EdDSA");
 
   private final String algorithm;
 
@@ -50,7 +51,7 @@ public static KeyType getKeyTypeFromOid(String oid) {
 
     return switch (oid) {
       case EC_ENCRYPTION -> EC;
-      case EdDSA -> ED;
+      case EdDSA_448, EdDSA_25519 -> OKP;
       case RSA_ENCRYPTION -> RSA;
       default -> null;
     };
diff --git a/src/main/java/io/fusionauth/jwt/ed/EdDSASigner.java b/src/main/java/io/fusionauth/jwt/ed/EdDSASigner.java
index f82caa21..e37c586f 100644
--- a/src/main/java/io/fusionauth/jwt/ed/EdDSASigner.java
+++ b/src/main/java/io/fusionauth/jwt/ed/EdDSASigner.java
@@ -22,8 +22,6 @@
 import io.fusionauth.jwt.Signer;
 import io.fusionauth.jwt.domain.Algorithm;
 import io.fusionauth.pem.domain.PEM;
-import io.fusionauth.security.CryptoProvider;
-import io.fusionauth.security.DefaultCryptoProvider;
 
 import java.nio.charset.StandardCharsets;
 import java.security.InvalidKeyException;
@@ -40,19 +38,15 @@
 public class EdDSASigner implements Signer {
   private final Algorithm algorithm;
 
-  private final CryptoProvider cryptoProvider;
-
   private final String kid;
 
   private final EdECPrivateKey privateKey;
 
-  private EdDSASigner(Algorithm algorithm, PrivateKey privateKey, String kid, CryptoProvider cryptoProvider) {
+  private EdDSASigner(Algorithm algorithm, PrivateKey privateKey, String kid) {
     Objects.requireNonNull(algorithm);
-    Objects.requireNonNull(cryptoProvider);
     Objects.requireNonNull(privateKey);
 
     this.algorithm = algorithm;
-    this.cryptoProvider = cryptoProvider;
     this.kid = kid;
 
     if (!(privateKey instanceof EdECPrivateKey)) {
@@ -62,13 +56,11 @@ private EdDSASigner(Algorithm algorithm, PrivateKey privateKey, String kid, Cryp
     this.privateKey = (EdECPrivateKey) privateKey;
   }
 
-  private EdDSASigner(Algorithm algorithm, String privateKey, String kid, CryptoProvider cryptoProvider) {
+  private EdDSASigner(Algorithm algorithm, String privateKey, String kid) {
     Objects.requireNonNull(algorithm);
-    Objects.requireNonNull(cryptoProvider);
     Objects.requireNonNull(privateKey);
 
     this.algorithm = algorithm;
-    this.cryptoProvider = cryptoProvider;
     this.kid = kid;
     PEM pem = PEM.decode(privateKey);
     if (pem.privateKey == null) {
@@ -83,7 +75,7 @@ private EdDSASigner(Algorithm algorithm, String privateKey, String kid, CryptoPr
   }
 
   public static EdDSASigner newSigner(String privateKey) {
-    return new EdDSASigner(Algorithm.EdDSA, privateKey, null, new DefaultCryptoProvider());
+    return new EdDSASigner(Algorithm.EdDSA, privateKey, null);
   }
 
   @Override
@@ -101,7 +93,7 @@ public byte[] sign(String message) {
     Objects.requireNonNull(message);
 
     try {
-      Signature signature = cryptoProvider.getSignatureInstance(algorithm.getName());
+      Signature signature = Signature.getInstance(algorithm.getName());
       signature.initSign(privateKey);
       signature.update((message).getBytes(StandardCharsets.UTF_8));
 
diff --git a/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java b/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java
index adc733d7..71bf85ab 100644
--- a/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java
+++ b/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java
@@ -23,8 +23,6 @@
 import io.fusionauth.jwt.Verifier;
 import io.fusionauth.jwt.domain.Algorithm;
 import io.fusionauth.pem.domain.PEM;
-import io.fusionauth.security.CryptoProvider;
-import io.fusionauth.security.DefaultCryptoProvider;
 
 import java.io.IOException;
 import java.nio.file.Files;
@@ -41,15 +39,11 @@
  * @author Daniel DeGroff
  */
 public class EdDSAVerifier implements Verifier {
-  private final CryptoProvider cryptoProvider;
-
   private final EdECPublicKey publicKey;
 
-  private EdDSAVerifier(PublicKey publicKey, CryptoProvider cryptoProvider) {
+  private EdDSAVerifier(PublicKey publicKey) {
     Objects.requireNonNull(publicKey);
-    Objects.requireNonNull(cryptoProvider);
 
-    this.cryptoProvider = cryptoProvider;
     if (!(publicKey instanceof EdECPublicKey)) {
       throw new InvalidKeyTypeException("Expecting a public key of type [EdECPublicKey], but found [" + publicKey.getClass().getSimpleName() + "].");
     }
@@ -57,11 +51,9 @@ private EdDSAVerifier(PublicKey publicKey, CryptoProvider cryptoProvider) {
     this.publicKey = (EdECPublicKey) publicKey;
   }
 
-  private EdDSAVerifier(String publicKey, CryptoProvider cryptoProvider) {
+  private EdDSAVerifier(String publicKey) {
     Objects.requireNonNull(publicKey);
-    Objects.requireNonNull(cryptoProvider);
 
-    this.cryptoProvider = cryptoProvider;
     PEM pem = PEM.decode(publicKey);
     if (pem.publicKey == null) {
       throw new MissingPublicKeyException("The provided PEM encoded string did not contain a public key.");
@@ -75,14 +67,10 @@ private EdDSAVerifier(String publicKey, CryptoProvider cryptoProvider) {
   }
 
   public static EdDSAVerifier newVerifier(Path path) {
-    return newVerifier(path, new DefaultCryptoProvider());
-  }
-
-  public static EdDSAVerifier newVerifier(Path path, CryptoProvider cryptoProvider) {
     Objects.requireNonNull(path);
 
     try {
-      return new EdDSAVerifier(new String(Files.readAllBytes(path)), cryptoProvider);
+      return new EdDSAVerifier(new String(Files.readAllBytes(path)));
     } catch (IOException e) {
       throw new JWTVerifierException("Unable to read the file from path [" + path.toAbsolutePath() + "]", e);
     }
@@ -100,7 +88,7 @@ public void verify(Algorithm algorithm, byte[] message, byte[] signature) {
     Objects.requireNonNull(signature);
 
     try {
-      Signature verifier = cryptoProvider.getSignatureInstance(algorithm.getName());
+      Signature verifier = Signature.getInstance(algorithm.getName());
       verifier.initVerify(publicKey);
       verifier.update(message);
 
diff --git a/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java b/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
index 4e262b18..8e254957 100644
--- a/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
+++ b/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
@@ -169,19 +169,23 @@ public void rsa_public() throws Exception {
 
   @Test
   public void eddsa_private() throws Exception {
-    // EdDSA 256 Private key - PKCS#8 encapsulated already
-    EdECPrivateKey key = PEM.decode(Paths.get("src/test/resources/ed_dsa_ed25519_private_key.pem")).getPrivateKey();
-    assertJSONEquals(JSONWebKey.build(key), "src/test/resources/jwk/ed_dsa_ed25519_private_key.json");
+    // ed25519
+    EdECPrivateKey key25519 = PEM.decode(Paths.get("src/test/resources/ed_dsa_ed25519_private_key.pem")).getPrivateKey();
+    assertJSONEquals(JSONWebKey.build(key25519), "src/test/resources/jwk/ed_dsa_ed25519_private_key.json");
+
+    // ed448
+    EdECPrivateKey key448 = PEM.decode(Paths.get("src/test/resources/ed_dsa_ed448_private_key.pem")).getPrivateKey();
+    assertJSONEquals(JSONWebKey.build(key448), "src/test/resources/jwk/ed_dsa_ed448_private_key.json");
   }
 
   @Test
   public void eddsa_public() throws Exception {
     // ed25519
-    EdECPublicKey publicKey = PEM.decode(Paths.get("src/test/resources/ed_dsa_ed25519_public_key.pem")).getPublicKey();
-    assertJSONEquals(JSONWebKey.build(publicKey), "src/test/resources/jwk/ed_dsa_ed25519_public_key.json");
+    EdECPublicKey key25519 = PEM.decode(Paths.get("src/test/resources/ed_dsa_ed25519_public_key.pem")).getPublicKey();
+    assertJSONEquals(JSONWebKey.build(key25519), "src/test/resources/jwk/ed_dsa_ed25519_public_key.json");
 
-    // EC 256 Certificate
-    Certificate certificate = PEM.decode(Paths.get("src/test/resources/ec_certificate_p_256.pem")).getCertificate();
-    assertJSONEquals(JSONWebKey.build(certificate), "src/test/resources/jwk/ec_certificate_p_256.json");
+    // ed448
+    EdECPublicKey key448 = PEM.decode(Paths.get("src/test/resources/ed_dsa_ed448_public_key.pem")).getPublicKey();
+    assertJSONEquals(JSONWebKey.build(key448), "src/test/resources/jwk/ed_dsa_ed448_public_key.json");
   }
 }
diff --git a/src/test/resources/ed_dsa_ed448_private_key.pem b/src/test/resources/ed_dsa_ed448_private_key.pem
new file mode 100644
index 00000000..0ea1d105
--- /dev/null
+++ b/src/test/resources/ed_dsa_ed448_private_key.pem
@@ -0,0 +1,4 @@
+-----BEGIN PRIVATE KEY-----
+MEcCAQAwBQYDK2VxBDsEOdZsoRQRXAqB+koKbi+CGMHnY0sgofzfee7rgir3VLFf
+Zxqw7sJKX4RAi6Uec20saAyUgl2VRBJyJA==
+-----END PRIVATE KEY-----
diff --git a/src/test/resources/ed_dsa_ed448_public_key.pem b/src/test/resources/ed_dsa_ed448_public_key.pem
new file mode 100644
index 00000000..cf1721ca
--- /dev/null
+++ b/src/test/resources/ed_dsa_ed448_public_key.pem
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MEMwBQYDK2VxAzoAgWl4sYkZhkljqw4C0GDCjDgU44Q3+Sxnd9XXZKcP+kcIoEMm
+coSFW7aMWJXcWKa5BB6/eyuTE1IA
+-----END PUBLIC KEY-----
diff --git a/src/test/resources/jwk/ed_dsa_ed25519_private_key.json b/src/test/resources/jwk/ed_dsa_ed25519_private_key.json
index 6f02f9c0..126073f3 100644
--- a/src/test/resources/jwk/ed_dsa_ed25519_private_key.json
+++ b/src/test/resources/jwk/ed_dsa_ed25519_private_key.json
@@ -1,7 +1,6 @@
 {
   "kty": "OKP",
   "alg": "EdDSA",
-  "kid": "9d9e739a-1c66-4f51-ae58-62ffab702d4e",
   "crv": "Ed25519",
   "x": "un73P2PfgPZTvbRvlHjVkjhqUhAQOVC1wRa-vmX-dIc",
   "d": "q66bJV1LcCEUCt44Ycti1Pg7bVhRgGJtqQY3OraRzCI",
diff --git a/src/test/resources/jwk/ed_dsa_ed25519_public_key.json b/src/test/resources/jwk/ed_dsa_ed25519_public_key.json
index 96eff50c..029912da 100644
--- a/src/test/resources/jwk/ed_dsa_ed25519_public_key.json
+++ b/src/test/resources/jwk/ed_dsa_ed25519_public_key.json
@@ -1,7 +1,6 @@
 {
   "kty": "OKP",
   "alg": "EdDSA",
-  "kid": "9d9e739a-1c66-4f51-ae58-62ffab702d4e",
   "crv": "Ed25519",
   "x": "un73P2PfgPZTvbRvlHjVkjhqUhAQOVC1wRa-vmX-dIc",
   "use": "sig"
diff --git a/src/test/resources/jwk/ed_dsa_ed448_private_key.json b/src/test/resources/jwk/ed_dsa_ed448_private_key.json
new file mode 100644
index 00000000..eff55f80
--- /dev/null
+++ b/src/test/resources/jwk/ed_dsa_ed448_private_key.json
@@ -0,0 +1,8 @@
+{
+  "alg": "EdDSA",
+  "crv": "Ed448",
+  "d": "1myhFBFcCoH6SgpuL4IYwedjSyCh_N957uuCKvdUsV9nGrDuwkpfhECLpR5zbSxoDJSCXZVEEnIk",
+  "kty": "OKP",
+  "use": "sig",
+  "x": "gWl4sYkZhkljqw4C0GDCjDgU44Q3-Sxnd9XXZKcP-kcIoEMmcoSFW7aMWJXcWKa5BB6_eyuTE1IA"
+}
diff --git a/src/test/resources/jwk/ed_dsa_ed448_public_key.json b/src/test/resources/jwk/ed_dsa_ed448_public_key.json
new file mode 100644
index 00000000..778c8054
--- /dev/null
+++ b/src/test/resources/jwk/ed_dsa_ed448_public_key.json
@@ -0,0 +1,7 @@
+{
+  "kty": "OKP",
+  "alg": "EdDSA",
+  "crv": "Ed448",
+  "x": "gWl4sYkZhkljqw4C0GDCjDgU44Q3-Sxnd9XXZKcP-kcIoEMmcoSFW7aMWJXcWKa5BB6_eyuTE1IA",
+  "use": "sig"
+}

From d7291a8aa4386d1438238531af89011e9667ea84 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Mon, 17 Nov 2025 13:46:18 -0700
Subject: [PATCH 04/29] Working

---
 build.savant       |  6 ++++++
 fusionauth-jwt.iml | 23 +++++++++++++++++------
 pom.xml            |  8 ++++++++
 3 files changed, 31 insertions(+), 6 deletions(-)

diff --git a/build.savant b/build.savant
index 9cd7dcd9..0eba7dfd 100644
--- a/build.savant
+++ b/build.savant
@@ -15,6 +15,7 @@
  */
 
 jacksonVersion = "2.15.4"
+slf4jVersion = "1.7.36"
 
 project(group: "io.fusionauth", name: "fusionauth-jwt", version: "6.0.0", licenses: ["ApacheV2_0"]) {
 
@@ -48,6 +49,11 @@ project(group: "io.fusionauth", name: "fusionauth-jwt", version: "6.0.0", licens
     group(name: "test-compile", export: false) {
       dependency(id: "org.bouncycastle:bc-fips:2.1.2")
       dependency(id: "org.testng:testng:7.9.0")
+      // Gets rid of SLF warnings on test run
+      //   SLF4J: Failed to load class "org.slf4j.impl.StaticLoggerBinder".
+      //   SLF4J: Defaulting to no-operation (NOP) logger implementation
+      //   SLF4J: See http://www.slf4j.org/codes.html#StaticLoggerBinder for further details.
+      dependency(id: "org.slf4j:slf4j-nop:${slf4jVersion}")
     }
   }
 
diff --git a/fusionauth-jwt.iml b/fusionauth-jwt.iml
index f4cc4061..35c3097f 100644
--- a/fusionauth-jwt.iml
+++ b/fusionauth-jwt.iml
@@ -71,33 +71,44 @@
     <orderEntry type="module-library" scope="TEST">
       <library>
         <CLASSES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/org/slf4j/slf4j-api/1.7.36/slf4j-api-1.7.36.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/com/beust/jcommander/1.82.0/jcommander-1.82.0.jar!/" />
         </CLASSES>
         <JAVADOC />
         <SOURCES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/org/slf4j/slf4j-api/1.7.36/slf4j-api-1.7.36-src.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/com/beust/jcommander/1.82.0/jcommander-1.82.0-src.jar!/" />
         </SOURCES>
       </library>
     </orderEntry>
     <orderEntry type="module-library" scope="TEST">
       <library>
         <CLASSES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/com/beust/jcommander/1.82.0/jcommander-1.82.0.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/org/webjars/jquery/3.7.1/jquery-3.7.1.jar!/" />
         </CLASSES>
         <JAVADOC />
         <SOURCES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/com/beust/jcommander/1.82.0/jcommander-1.82.0-src.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/org/webjars/jquery/3.7.1/jquery-3.7.1-src.jar!/" />
         </SOURCES>
       </library>
     </orderEntry>
     <orderEntry type="module-library" scope="TEST">
       <library>
         <CLASSES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/org/webjars/jquery/3.7.1/jquery-3.7.1.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/org/slf4j/slf4j-api/1.7.36/slf4j-api-1.7.36.jar!/" />
         </CLASSES>
         <JAVADOC />
         <SOURCES>
-          <root url="jar://$MODULE_DIR$/.savant/cache/org/webjars/jquery/3.7.1/jquery-3.7.1-src.jar!/" />
+          <root url="jar://$MODULE_DIR$/.savant/cache/org/slf4j/slf4j-api/1.7.36/slf4j-api-1.7.36-src.jar!/" />
+        </SOURCES>
+      </library>
+    </orderEntry>
+    <orderEntry type="module-library" scope="TEST">
+      <library>
+        <CLASSES>
+          <root url="jar://$MODULE_DIR$/.savant/cache/org/slf4j/slf4j-nop/1.7.36/slf4j-nop-1.7.36.jar!/" />
+        </CLASSES>
+        <JAVADOC />
+        <SOURCES>
+          <root url="jar://$MODULE_DIR$/.savant/cache/org/slf4j/slf4j-nop/1.7.36/slf4j-nop-1.7.36-src.jar!/" />
         </SOURCES>
       </library>
     </orderEntry>
diff --git a/pom.xml b/pom.xml
index 0b39cb5a..27393b4a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -100,6 +100,14 @@
       <scope>test</scope>
       <optional>false</optional>
     </dependency>
+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-nop</artifactId>
+      <version>1.7.36</version>
+      <type>jar</type>
+      <scope>test</scope>
+      <optional>false</optional>
+    </dependency>
   </dependencies>
 
     <build>

From eefb7684ad344a96d0398db59b79bff1eca6036d Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Mon, 17 Nov 2025 17:01:38 -0700
Subject: [PATCH 05/29] Working

---
 build.savant                                  |   1 -
 .../io/fusionauth/der/ObjectIdentifier.java   |  26 ++--
 src/main/java/io/fusionauth/der/Tag.java      |  39 ++----
 src/main/java/io/fusionauth/jwt/JWTUtils.java |  74 ++++++++---
 .../java/io/fusionauth/jwt/OpenIDConnect.java |  40 +++---
 .../io/fusionauth/jwt/domain/KeyType.java     |   3 +
 .../io/fusionauth/jwt/ec/ECDSASignature.java  |  23 ++--
 .../java/io/fusionauth/jwt/ec/ECVerifier.java |  15 +--
 .../io/fusionauth/jwt/ed/EdDSASigner.java     |  38 ++++++
 .../io/fusionauth/jwt/ed/EdDSAVerifier.java   |  29 ++++-
 .../io/fusionauth/jwt/hmac/HMACVerifier.java  |  14 +-
 .../io/fusionauth/jwt/rsa/RSAPSSVerifier.java |  14 +-
 .../java/io/fusionauth/pem/PEMDecoder.java    |  11 +-
 .../java/io/fusionauth/security/KeyUtils.java |  14 +-
 src/test/java/io/fusionauth/BaseTest.java     |   8 +-
 src/test/java/io/fusionauth/jwt/JWTTest.java  |   5 +-
 .../java/io/fusionauth/jwt/JWTUtilsTest.java  | 121 +++++++++++++++++-
 .../io/fusionauth/jwt/OpenIdConnectTest.java  |  10 +-
 .../io/fusionauth/jwt/RequiresAlgorithm.java  |  33 -----
 .../jwt/TestNGAnnotationTransformer.java      |  53 --------
 ...VerifierTest.java => EdDSASignerTest.java} |  23 +++-
 ...SignerTest.java => EdDSAVerifierTest.java} |  12 +-
 .../fusionauth/jwt/rsa/RSAPSSSignerTest.java  |   7 +-
 .../jwt/rsa/RSAPSSVerifierTest.java           |  28 ++--
 .../fusionauth/jwt/rsa/RSAVerifierTest.java   |  68 +++++-----
 .../io/fusionauth/pem/PEMDecoderTest.java     |   8 +-
 .../io/fusionauth/security/KeyUtilsTests.java |  20 ++-
 .../resources/rsa_pss_private_key_2048.pem    |  28 ++++
 .../resources/rsa_pss_private_key_3072.pem    |  40 ++++++
 .../resources/rsa_pss_private_key_4096.pem    |  52 ++++++++
 .../resources/rsa_pss_public_key_2048.pem     |   9 ++
 .../resources/rsa_pss_public_key_3072.pem     |  11 ++
 .../resources/rsa_pss_public_key_4096.pem     |  14 ++
 33 files changed, 615 insertions(+), 276 deletions(-)
 delete mode 100644 src/test/java/io/fusionauth/jwt/RequiresAlgorithm.java
 delete mode 100644 src/test/java/io/fusionauth/jwt/TestNGAnnotationTransformer.java
 rename src/test/java/io/fusionauth/jwt/ed/{EdVerifierTest.java => EdDSASignerTest.java} (78%)
 rename src/test/java/io/fusionauth/jwt/ed/{EdSignerTest.java => EdDSAVerifierTest.java} (88%)
 create mode 100644 src/test/resources/rsa_pss_private_key_2048.pem
 create mode 100644 src/test/resources/rsa_pss_private_key_3072.pem
 create mode 100644 src/test/resources/rsa_pss_private_key_4096.pem
 create mode 100644 src/test/resources/rsa_pss_public_key_2048.pem
 create mode 100644 src/test/resources/rsa_pss_public_key_3072.pem
 create mode 100644 src/test/resources/rsa_pss_public_key_4096.pem

diff --git a/build.savant b/build.savant
index 0eba7dfd..96993ef2 100644
--- a/build.savant
+++ b/build.savant
@@ -78,7 +78,6 @@ release = loadPlugin(id: "org.savantbuild.plugin:release-git:2.0.0")
  */
 java.settings.javaVersion = "17"
 javaTestNG.settings.javaVersion = "17"
-javaTestNG.settings.listeners = ["io.fusionauth.jwt.TestNGAnnotationTransformer"]
 
 /*
  * Targets
diff --git a/src/main/java/io/fusionauth/der/ObjectIdentifier.java b/src/main/java/io/fusionauth/der/ObjectIdentifier.java
index 34bd607a..bc16ffb6 100644
--- a/src/main/java/io/fusionauth/der/ObjectIdentifier.java
+++ b/src/main/java/io/fusionauth/der/ObjectIdentifier.java
@@ -24,6 +24,7 @@
 /**
  * @author Daniel DeGroff
  */
+@SuppressWarnings("unused")
 public class ObjectIdentifier implements Buildable<ObjectIdentifier> {
   /**
    * Elliptic curve / 256 bit / secp256r1 / prime256v1
@@ -31,16 +32,6 @@ public class ObjectIdentifier implements Buildable<ObjectIdentifier> {
    */
   public static final String ECDSA_P256 = "1.2.840.10045.3.1.7";
 
-  /**
-   * Edwards-curve Digital Signature Algorithm (EdDSA) Ed25519
-   */
-  public static final String EdDSA_25519 = "1.3.101.112";
-
-  /**
-   * Edwards-curve Digital Signature Algorithm (EdDSA) Ed448
-   */
-  public static final String EdDSA_448 = "1.3.101.113";
-
   /**
    * Elliptic curve / 384 bit / secp384r1 / prime384v1
    * NIST/SECG curve over a 384 bit prime field
@@ -58,6 +49,21 @@ public class ObjectIdentifier implements Buildable<ObjectIdentifier> {
    */
   public static final String EC_ENCRYPTION = "1.2.840.10045.2.1";
 
+  /**
+   * Edwards-curve Digital Signature Algorithm (EdDSA) Ed25519
+   */
+  public static final String EdDSA_25519 = "1.3.101.112";
+
+  /**
+   * RSA Public Key cryptography Signature Scheme with Appendix - Probabilistic Signature Scheme
+   */
+  public static final String RSASSA_PSS_ENCRYPTION = "1.2.840.113549.1.1.10";
+
+  /**
+   * Edwards-curve Digital Signature Algorithm (EdDSA) Ed448
+   */
+  public static final String EdDSA_448 = "1.3.101.113";
+
   /**
    * RSA Public Key cryptography
    */
diff --git a/src/main/java/io/fusionauth/der/Tag.java b/src/main/java/io/fusionauth/der/Tag.java
index 9dbd4e3b..3fa42af6 100644
--- a/src/main/java/io/fusionauth/der/Tag.java
+++ b/src/main/java/io/fusionauth/der/Tag.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2020, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -150,34 +150,23 @@ static String hexString(int value) {
   @Override
   public boolean equals(Object o) {
     if (this == o) return true;
-    if (!(o instanceof Tag)) return false;
-    Tag tag = (Tag) o;
+    if (!(o instanceof Tag tag)) return false;
     return rawByte == tag.rawByte;
   }
 
   public String getName() {
-    switch (rawByte) {
-      case Integer:
-        return "Integer";
-      case BitString:
-        return "Bit String";
-      case Null:
-        return "Null";
-      case ObjectIdentifier:
-        return "Object Identifier";
-      case OctetString:
-        return "Octet String";
-      case PrintableString:
-        return "PrintableString";
-      case Sequence:
-        return "Sequence";
-      case Set:
-        return "Set";
-      case UTCTime:
-        return "UTCTime";
-      default:
-        return "Other";
-    }
+    return switch (rawByte) {
+      case Integer -> "Integer";
+      case BitString -> "Bit String";
+      case Null -> "Null";
+      case ObjectIdentifier -> "Object Identifier";
+      case OctetString -> "Octet String";
+      case PrintableString -> "PrintableString";
+      case Sequence -> "Sequence";
+      case Set -> "Set";
+      case UTCTime -> "UTCTime";
+      default -> "Other";
+    };
   }
 
   @Override
diff --git a/src/main/java/io/fusionauth/jwt/JWTUtils.java b/src/main/java/io/fusionauth/jwt/JWTUtils.java
index e4b07f41..246b7711 100644
--- a/src/main/java/io/fusionauth/jwt/JWTUtils.java
+++ b/src/main/java/io/fusionauth/jwt/JWTUtils.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2016-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,7 +20,6 @@
 import io.fusionauth.jwt.domain.Header;
 import io.fusionauth.jwt.domain.JWT;
 import io.fusionauth.jwt.domain.KeyPair;
-import io.fusionauth.jwt.domain.KeyType;
 import io.fusionauth.jwt.json.Mapper;
 import io.fusionauth.pem.domain.PEM;
 
@@ -47,7 +46,7 @@ public class JWTUtils {
    * or <code>x5t#256</code> thumbprint respectively.
    *
    * @param fingerprint the SHA-1 or SHA-256 fingerprint
-   * @return an x5t hash.
+   * @return a x5t hash.
    */
   public static String convertFingerprintToThumbprint(String fingerprint) {
     byte[] bytes = HexUtils.toBytes(fingerprint);
@@ -110,13 +109,43 @@ public static JWT decodePayload(String encodedJWT) {
   }
 
   /**
-   * Generate a new public / private key pair using a 2048 bit RSA key. This is the minimum key length for use with an
+   * Generate a new public / private key pair using a 2048-bit RSA key. This is the minimum key length for use with an
    * RSA signing scheme for JWT.
    *
    * @return a public and private key PEM in their respective X.509 and PKCS#8 key formats.
    */
   public static KeyPair generate2048_RSAKeyPair() {
-    return generateKeyPair(2048, KeyType.RSA);
+    return generateKeyPair("RSA", 2048);
+  }
+
+  /**
+   * Generate a new public / private key pair using a 2048-bit RSA PSS key. This is the minimum key length for use with an
+   * RSA PSS signing scheme for JWT.
+   *
+   * @return a public and private key PEM in their respective X.509 and PKCS#8 key formats.
+   */
+  public static KeyPair generate2048_RSAPSSKeyPair() {
+    return generateKeyPair("RSASSA-PSS", 2048);
+  }
+
+  /**
+   * Generate a new public / private key pair using a 3072-bit RSA PSS key. This is the minimum key length for use with an
+   * RSA PSS signing scheme for JWT.
+   *
+   * @return a public and private key PEM in their respective X.509 and PKCS#8 key formats.
+   */
+  public static KeyPair generate3072_RSAPSSKeyPair() {
+    return generateKeyPair("RSASSA-PSS", 3072);
+  }
+
+  /**
+   * Generate a new public / private key pair using a 4096-bit RSA PSS key. This is the minimum key length for use with an
+   * RSA PSS signing scheme for JWT.
+   *
+   * @return a public and private key PEM in their respective X.509 and PKCS#8 key formats.
+   */
+  public static KeyPair generate4096_RSAPSSKeyPair() {
+    return generateKeyPair("RSASSA-PSS", 4096);
   }
 
   /**
@@ -125,34 +154,34 @@ public static KeyPair generate2048_RSAKeyPair() {
    * @return a public and private key PEM in their respective X.509 and PKCS#8 key formats.
    */
   public static KeyPair generate256_ECKeyPair() {
-    return generateKeyPair(256, EC);
+    return generateKeyPair("EC", 256);
   }
 
   /**
-   * Generate a new public / private key pair using a 3072 bit RSA key.
+   * Generate a new public / private key pair using a 3072-bit RSA key.
    *
    * @return a public and private key PEM in their respective X.509 and PKCS#8 key formats.
    */
   public static KeyPair generate3072_RSAKeyPair() {
-    return generateKeyPair(3072, KeyType.RSA);
+    return generateKeyPair("RSA", 3072);
   }
 
   /**
-   * Generate a new public / private key pair using a 384 bit EC key. A 384 bit EC key is roughly equivalent to a 7680 bit RSA key.
+   * Generate a new public / private key pair using a 384-bit EC key. A 384 bit EC key is roughly equivalent to a 7680 bit RSA key.
    *
    * @return a public and private key PEM in their respective X.509 and PKCS#8 key formats.
    */
   public static KeyPair generate384_ECKeyPair() {
-    return generateKeyPair(384, EC);
+    return generateKeyPair("EC", 384);
   }
 
   /**
-   * Generate a new public / private key pair using a 4096 bit RSA key.
+   * Generate a new public / private key pair using a 4096-bit RSA key.
    *
    * @return a public and private key PEM in their respective X.509 and PKCS#8 key formats.
    */
   public static KeyPair generate4096_RSAKeyPair() {
-    return generateKeyPair(4096, KeyType.RSA);
+    return generateKeyPair("RSA", 4096);
   }
 
   /**
@@ -161,7 +190,15 @@ public static KeyPair generate4096_RSAKeyPair() {
    * @return a public and private key PEM in their respective X.509 and PKCS#8 key formats.
    */
   public static KeyPair generate521_ECKeyPair() {
-    return generateKeyPair(521, EC);
+    return generateKeyPair("EC", 521);
+  }
+
+  public static KeyPair generate_ed25519_EdDSAKeyPair() {
+    return generateKeyPair("ed25519", null);
+  }
+
+  public static KeyPair generate_ed448_EdDSAKeyPair() {
+    return generateKeyPair("ed448", null);
   }
 
   /**
@@ -305,13 +342,16 @@ private static String digest(String algorithm, byte[] bytes) {
   /**
    * Generate a new Public / Private key pair with a key size of the provided length.
    *
-   * @param keySize the length of the key in bits
+   * @param algorithm the algorithm to use to generate the key pair
+   * @param keySize   the optional key size when applicable
    * @return a public and private key in PEM format.
    */
-  private static KeyPair generateKeyPair(int keySize, KeyType keyType) {
+  private static KeyPair generateKeyPair(String algorithm, Integer keySize) {
     try {
-      KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(keyType.name());
-      keyPairGenerator.initialize(keySize);
+      KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(algorithm);
+      if (keySize != null) {
+        keyPairGenerator.initialize(keySize);
+      }
       java.security.KeyPair keyPair = keyPairGenerator.generateKeyPair();
 
       String privateKey = PEM.encode(keyPair.getPrivate(), keyPair.getPublic());
diff --git a/src/main/java/io/fusionauth/jwt/OpenIDConnect.java b/src/main/java/io/fusionauth/jwt/OpenIDConnect.java
index ce42e744..a7f9b0c4 100644
--- a/src/main/java/io/fusionauth/jwt/OpenIDConnect.java
+++ b/src/main/java/io/fusionauth/jwt/OpenIDConnect.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -60,29 +60,27 @@ private static String generate_hash(String string, Algorithm algorithm) {
 
     int leftMostBits;
     MessageDigest messageDigest;
-    switch (algorithm) {
-      case ES256:
-      case HS256:
-      case RS256:
+    leftMostBits = switch (algorithm) {
+      case ES256, HS256, RS256 -> {
         messageDigest = getDigest("SHA-256");
-        leftMostBits = 128;
-        break;
-      case ES384:
-      case HS384:
-      case RS384:
+        yield 128;
+      }
+      case ES384, HS384, RS384 -> {
         messageDigest = getDigest("SHA-384");
-        leftMostBits = 192;
-        break;
-      case ES512:
-      case HS512:
-      case RS512:
+        yield 192;
+      }
+      case EdDSA, ES512, HS512, RS512 -> {
+        // Note that EdDSA ed25519 uses SHA-512. But EdDSA ed448 uses SHAKE256. No standard has been published
+        // such that the consumer of the at_hash or c_hash would know which curve was being used with the EdDSA algorithm.
+        // - Defaulting to SHA-512, but this means the hash may be unpredictable if you choose to utilize ed448.
+        // - Discussion: https://bitbucket.org/openid/connect/issues/1125/_hash-algorithm-for-eddsa-id-tokens
         messageDigest = getDigest("SHA-512");
-        leftMostBits = 256;
-        break;
-      default:
-        throw new IllegalArgumentException("You specified an unsupported algorithm. The algorithm [" + algorithm + "]"
-            + " is not supported. You must use ES256, ES384, ES512,  HS256, HS384, HS512, RS256, RS384 or RS512.");
-    }
+        yield 256;
+      }
+      default ->
+          throw new IllegalArgumentException("You specified an unsupported algorithm. The algorithm [" + algorithm + "]"
+              + " is not supported. You must use EdDSA, ES256, ES384, ES512,  HS256, HS384, HS512, RS256, RS384 or RS512.");
+    };
 
     byte[] digest = string.getBytes(StandardCharsets.UTF_8);
     digest = messageDigest.digest(digest);
diff --git a/src/main/java/io/fusionauth/jwt/domain/KeyType.java b/src/main/java/io/fusionauth/jwt/domain/KeyType.java
index 36d075e8..96ece35e 100644
--- a/src/main/java/io/fusionauth/jwt/domain/KeyType.java
+++ b/src/main/java/io/fusionauth/jwt/domain/KeyType.java
@@ -21,6 +21,7 @@
 import static io.fusionauth.der.ObjectIdentifier.EC_ENCRYPTION;
 import static io.fusionauth.der.ObjectIdentifier.EdDSA_25519;
 import static io.fusionauth.der.ObjectIdentifier.EdDSA_448;
+import static io.fusionauth.der.ObjectIdentifier.RSASSA_PSS_ENCRYPTION;
 import static io.fusionauth.der.ObjectIdentifier.RSA_ENCRYPTION;
 
 /**
@@ -37,6 +38,7 @@
  */
 public enum KeyType {
   RSA("RSA"),
+  RSASSA_PSS("RSASSA-PSS"),
   EC("EC"),
   OKP("EdDSA");
 
@@ -53,6 +55,7 @@ public static KeyType getKeyTypeFromOid(String oid) {
       case EC_ENCRYPTION -> EC;
       case EdDSA_448, EdDSA_25519 -> OKP;
       case RSA_ENCRYPTION -> RSA;
+      case RSASSA_PSS_ENCRYPTION -> RSASSA_PSS;
       default -> null;
     };
   }
diff --git a/src/main/java/io/fusionauth/jwt/ec/ECDSASignature.java b/src/main/java/io/fusionauth/jwt/ec/ECDSASignature.java
index aa208723..94bd6147 100644
--- a/src/main/java/io/fusionauth/jwt/ec/ECDSASignature.java
+++ b/src/main/java/io/fusionauth/jwt/ec/ECDSASignature.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2024, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -71,20 +71,13 @@ public byte[] derDecode(Algorithm algorithm) throws IOException {
     byte[] s = sequence[1].getPositiveBigInteger().toByteArray();
 
     // The length of the result is fixed and discrete per algorithm.
-    byte[] result;
-    switch (algorithm) {
-      case ES256:
-        result = new byte[64];
-        break;
-      case ES384:
-        result = new byte[96];
-        break;
-      case ES512:
-        result = new byte[132];
-        break;
-      default:
-        throw new IllegalArgumentException("Unable to decode the signature for algorithm [" + algorithm.name() + "]");
-    }
+    byte[] result = switch (algorithm) {
+      case ES256 -> new byte[64];
+      case ES384 -> new byte[96];
+      case ES512 -> new byte[132];
+      default ->
+          throw new IllegalArgumentException("Unable to decode the signature for algorithm [" + algorithm.name() + "]");
+    };
 
     // Because the response is not encoded, the r and s component must take up an equal amount of the resulting array.
     // This allows the consumer of this value to always safely split the value in half based upon an index value since
diff --git a/src/main/java/io/fusionauth/jwt/ec/ECVerifier.java b/src/main/java/io/fusionauth/jwt/ec/ECVerifier.java
index ae9563a4..c58c3cb9 100644
--- a/src/main/java/io/fusionauth/jwt/ec/ECVerifier.java
+++ b/src/main/java/io/fusionauth/jwt/ec/ECVerifier.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2022, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -113,16 +113,11 @@ public static ECVerifier newVerifier(byte[] bytes) {
   }
 
   @Override
-  @SuppressWarnings("Duplicates")
   public boolean canVerify(Algorithm algorithm) {
-    switch (algorithm) {
-      case ES256:
-      case ES384:
-      case ES512:
-        return true;
-      default:
-        return false;
-    }
+    return switch (algorithm) {
+      case ES256, ES384, ES512 -> true;
+      default -> false;
+    };
   }
 
   private void checkFor_CVE_2022_21449(byte[] signature) {
diff --git a/src/main/java/io/fusionauth/jwt/ed/EdDSASigner.java b/src/main/java/io/fusionauth/jwt/ed/EdDSASigner.java
index e37c586f..79770261 100644
--- a/src/main/java/io/fusionauth/jwt/ed/EdDSASigner.java
+++ b/src/main/java/io/fusionauth/jwt/ed/EdDSASigner.java
@@ -74,6 +74,44 @@ private EdDSASigner(Algorithm algorithm, String privateKey, String kid) {
     this.privateKey = pem.getPrivateKey();
   }
 
+  /**
+   * Build a new EdDSA signer.
+   *
+   * @param privateKey The private key.
+   * @param kid        The key identifier. This will be used by the JWTEncoder to write the 'kid' header.
+   * @return a new EdDSA signer.
+   */
+  public static EdDSASigner newSigner(PrivateKey privateKey, String kid) {
+    return new EdDSASigner(Algorithm.EdDSA, privateKey, kid);
+  }
+
+  /**
+   * Build a new EdDSA signer.
+   *
+   * @param privateKey The private key.
+   * @return a new EdDSA signer.
+   */
+  public static EdDSASigner newSigner(PrivateKey privateKey) {
+    return new EdDSASigner(Algorithm.EdDSA, privateKey, null);
+  }
+
+  /**
+   * Build a new EdDSA signer.
+   *
+   * @param privateKey The private key.
+   * @param kid        The key identifier. This will be used by the JWTEncoder to write the 'kid' header.
+   * @return a new EdDSA signer.
+   */
+  public static EdDSASigner newSigner(String privateKey, String kid) {
+    return new EdDSASigner(Algorithm.EdDSA, privateKey, kid);
+  }
+
+  /**
+   * Build a new EdDSA signer.
+   *
+   * @param privateKey The private key.
+   * @return a new EdDSA signer.
+   */
   public static EdDSASigner newSigner(String privateKey) {
     return new EdDSASigner(Algorithm.EdDSA, privateKey, null);
   }
diff --git a/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java b/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java
index 71bf85ab..3e7cd9b7 100644
--- a/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java
+++ b/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java
@@ -66,6 +66,12 @@ private EdDSAVerifier(String publicKey) {
     this.publicKey = pem.getPublicKey();
   }
 
+  /**
+   * Return a new instance of the EdDSA Verifier with the provided public key.
+   *
+   * @param path The path to the public key PEM.
+   * @return a new instance of the EdDSA verifier.
+   */
   public static EdDSAVerifier newVerifier(Path path) {
     Objects.requireNonNull(path);
 
@@ -76,6 +82,27 @@ public static EdDSAVerifier newVerifier(Path path) {
     }
   }
 
+  /**
+   * Return a new instance of the EdDSA Verifier with the provided public key.
+   *
+   * @param bytes The bytes of the public key in PEM format.
+   * @return a new instance of the EdDSA verifier.
+   */
+  public static EdDSAVerifier newVerifier(byte[] bytes) {
+    Objects.requireNonNull(bytes);
+    return new EdDSAVerifier(new String(bytes));
+  }
+
+  /**
+   * Return a new instance of the EdDSA Verifier with the provided public key.
+   *
+   * @param publicKey The public key object.
+   * @return a new instance of the EdDSA verifier.
+   */
+  public static EdDSAVerifier newVerifier(PublicKey publicKey) {
+    return new EdDSAVerifier(publicKey);
+  }
+
   @Override
   public boolean canVerify(Algorithm algorithm) {
     return algorithm.equals(Algorithm.EdDSA);
@@ -95,7 +122,7 @@ public void verify(Algorithm algorithm, byte[] message, byte[] signature) {
       if (!(verifier.verify(signature))) {
         throw new InvalidJWTSignatureException();
       }
-    } catch (InvalidKeyException | NoSuchAlgorithmException | SignatureException | SecurityException e) {
+    } catch (InvalidKeyException | NoSuchAlgorithmException | SignatureException e) {
       throw new JWTVerifierException("An unexpected exception occurred when attempting to verify the JWT", e);
     }
   }
diff --git a/src/main/java/io/fusionauth/jwt/hmac/HMACVerifier.java b/src/main/java/io/fusionauth/jwt/hmac/HMACVerifier.java
index 64a90248..b1681bca 100644
--- a/src/main/java/io/fusionauth/jwt/hmac/HMACVerifier.java
+++ b/src/main/java/io/fusionauth/jwt/hmac/HMACVerifier.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2020, FusionAuth, All Rights Reserved
+ * Copyright (c) 2016-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -91,14 +91,10 @@ public static HMACVerifier newVerifier(byte[] bytes) {
   @Override
   @SuppressWarnings("Duplicates")
   public boolean canVerify(Algorithm algorithm) {
-    switch (algorithm) {
-      case HS256:
-      case HS384:
-      case HS512:
-        return true;
-      default:
-        return false;
-    }
+    return switch (algorithm) {
+      case HS256, HS384, HS512 -> true;
+      default -> false;
+    };
   }
 
   @Override
diff --git a/src/main/java/io/fusionauth/jwt/rsa/RSAPSSVerifier.java b/src/main/java/io/fusionauth/jwt/rsa/RSAPSSVerifier.java
index ae427e1a..affa6d5f 100644
--- a/src/main/java/io/fusionauth/jwt/rsa/RSAPSSVerifier.java
+++ b/src/main/java/io/fusionauth/jwt/rsa/RSAPSSVerifier.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, FusionAuth, All Rights Reserved
+ * Copyright (c) 2020-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -122,14 +122,10 @@ public static RSAPSSVerifier newVerifier(byte[] bytes) {
   @Override
   @SuppressWarnings("Duplicates")
   public boolean canVerify(Algorithm algorithm) {
-    switch (algorithm) {
-      case PS256:
-      case PS384:
-      case PS512:
-        return true;
-      default:
-        return false;
-    }
+    return switch (algorithm) {
+      case PS256, PS384, PS512 -> true;
+      default -> false;
+    };
   }
 
   public void verify(Algorithm algorithm, byte[] message, byte[] signature) {
diff --git a/src/main/java/io/fusionauth/pem/PEMDecoder.java b/src/main/java/io/fusionauth/pem/PEMDecoder.java
index d236dc5b..51479ff3 100644
--- a/src/main/java/io/fusionauth/pem/PEMDecoder.java
+++ b/src/main/java/io/fusionauth/pem/PEMDecoder.java
@@ -321,8 +321,8 @@ private PEM decode_PKCS_8(String encodedKey) throws NoSuchAlgorithmException, IO
     //   parameters      ANY DEFINED BY algorithm OPTIONAL
     // }
 
-    // EC and RSA will be length 3, EdDSA will be 5
-    if ((sequence.length != 3 && sequence.length != 5) || !sequence[0].tag.is(Tag.Integer) || !sequence[1].tag.is(Tag.Sequence) || !sequence[2].tag.is(Tag.OctetString)) {
+    // EC and RSA will be length 3, EdDSA will be 4 or 5
+    if (sequence.length < 3 || !sequence[0].tag.is(Tag.Integer) || !sequence[1].tag.is(Tag.Sequence) || !sequence[2].tag.is(Tag.OctetString)) {
       // Expect the following format : [ Integer | Sequence | OctetString ]
       throw new InvalidKeyException("Could not decode the private key. Expecting values in the DER encoded sequence in the following format [ Integer | Sequence | OctetString ] or [ Integer | Sequence | OctetString | Attributes ]");
     }
@@ -352,9 +352,9 @@ private PEM decode_PKCS_8(String encodedKey) throws NoSuchAlgorithmException, IO
       PublicKey publicKey = KeyFactory.getInstance("RSA").generatePublic(new RSAPublicKeySpec(modulus, publicExponent));
       return new PEM(privateKey, publicKey);
     } else if (privateKey instanceof EdECPrivateKey) {
-//      DerValue[] privateKeySequence = new DerInputStream(sequence[2]).getSequence();
-      if (sequence.length == 5) {
-        byte[] bitString = sequence[4].toByteArray();
+      if (sequence.length >= 4) {
+        int index = sequence.length - 1;
+        byte[] bitString = sequence[index].toByteArray();
         byte[] encodedPublicKey = getEncodedPublicKeyFromPrivate(bitString, privateKey.getEncoded());
         PublicKey publicKey = KeyFactory.getInstance(Algorithm.EdDSA.getName())
             .generatePublic(new X509EncodedKeySpec(encodedPublicKey));
@@ -363,7 +363,6 @@ private PEM decode_PKCS_8(String encodedKey) throws NoSuchAlgorithmException, IO
         // The private key did not contain the public key
         return new PEM(privateKey);
       }
-
     }
 
     return new PEM(privateKey);
diff --git a/src/main/java/io/fusionauth/security/KeyUtils.java b/src/main/java/io/fusionauth/security/KeyUtils.java
index 200d432e..82dadc8e 100644
--- a/src/main/java/io/fusionauth/security/KeyUtils.java
+++ b/src/main/java/io/fusionauth/security/KeyUtils.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, FusionAuth, All Rights Reserved
+ * Copyright (c) 2020-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,9 @@
 import java.security.interfaces.ECKey;
 import java.security.interfaces.ECPrivateKey;
 import java.security.interfaces.ECPublicKey;
+import java.security.interfaces.EdECKey;
+import java.security.interfaces.EdECPrivateKey;
+import java.security.interfaces.EdECPublicKey;
 import java.security.interfaces.RSAKey;
 
 /**
@@ -57,6 +60,15 @@ public static int getKeyLength(Key key) {
       return ((bytes / 8) * 8) * 8;
     } else if (key instanceof RSAKey rsaKey) {
       return rsaKey.getModulus().bitLength();
+    } else if (key instanceof EdECKey edECKey) {
+      // Assuming Ed25519 or Ed448
+      if (key instanceof EdECPrivateKey) {
+        return edECKey.getParams().getName().equals("Ed25519")
+            ? 32 : 57;
+      } else if (key instanceof EdECPublicKey) {
+        return edECKey.getParams().getName().equals("Ed25519")
+            ? 32 : 57;
+      }
     }
 
     throw new IllegalArgumentException();
diff --git a/src/test/java/io/fusionauth/BaseTest.java b/src/test/java/io/fusionauth/BaseTest.java
index 4e8db46a..9a877ea5 100644
--- a/src/test/java/io/fusionauth/BaseTest.java
+++ b/src/test/java/io/fusionauth/BaseTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, FusionAuth, All Rights Reserved
+ * Copyright (c) 2020-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -36,7 +36,7 @@ public abstract class BaseTest {
 
   public List<HttpServer> httpServers = new ArrayList<>();
 
-  public boolean testFips;
+  public boolean fipsEnabled;
 
   @AfterMethod
   public void afterMethod(ITestResult result) {
@@ -50,8 +50,8 @@ public void afterMethod(ITestResult result) {
 
   @BeforeSuite
   public void beforeSuite() {
-    testFips = Boolean.getBoolean("test.fips");
-    if (testFips) {
+    fipsEnabled = Boolean.getBoolean("test.fips");
+    if (fipsEnabled) {
       System.out.println("Testing in FIPS mode");
       System.setProperty("org.bouncycastle.fips.approved_only", "true");
       Security.insertProviderAt(new BouncyCastleFipsProvider(), 1);
diff --git a/src/test/java/io/fusionauth/jwt/JWTTest.java b/src/test/java/io/fusionauth/jwt/JWTTest.java
index affceb23..77ca352a 100644
--- a/src/test/java/io/fusionauth/jwt/JWTTest.java
+++ b/src/test/java/io/fusionauth/jwt/JWTTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2024, FusionAuth, All Rights Reserved
+ * Copyright (c) 2016-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -439,7 +439,6 @@ public void test_RS256() {
   }
 
   @Test
-  @RequiresAlgorithm("RSASSA-PSS")
   public void test_PS256() throws IOException {
     JWT jwt = new JWT().setSubject("1234567890");
 
@@ -455,7 +454,6 @@ public void test_PS256() throws IOException {
   }
 
   @Test
-  @RequiresAlgorithm("RSASSA-PSS")
   public void test_PS384() throws IOException {
     JWT jwt = new JWT().setSubject("1234567890");
 
@@ -471,7 +469,6 @@ public void test_PS384() throws IOException {
   }
 
   @Test
-  @RequiresAlgorithm("RSASSA-PSS")
   public void test_PS512() throws IOException {
     JWT jwt = new JWT().setSubject("1234567890");
 
diff --git a/src/test/java/io/fusionauth/jwt/JWTUtilsTest.java b/src/test/java/io/fusionauth/jwt/JWTUtilsTest.java
index 74bdd0d5..4ae572d8 100644
--- a/src/test/java/io/fusionauth/jwt/JWTUtilsTest.java
+++ b/src/test/java/io/fusionauth/jwt/JWTUtilsTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2020, FusionAuth, All Rights Reserved
+ * Copyright (c) 2016-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -29,6 +29,8 @@
 import java.nio.charset.StandardCharsets;
 import java.security.interfaces.ECPrivateKey;
 import java.security.interfaces.ECPublicKey;
+import java.security.interfaces.EdECPrivateKey;
+import java.security.interfaces.EdECPublicKey;
 import java.security.interfaces.RSAPrivateKey;
 import java.security.interfaces.RSAPublicKey;
 import java.util.Base64;
@@ -61,7 +63,7 @@ public void decodePayload() {
 
   @Test
   public void generateECKey() {
-    // 256 bit key
+    // 256-bit key
     KeyPair keyPair256 = JWTUtils.generate256_ECKeyPair();
     ECPrivateKey privateKey256 = PEM.decode(keyPair256.privateKey).getPrivateKey();
     ECPublicKey publicKey256 = PEM.decode(keyPair256.publicKey).getPublicKey();
@@ -87,7 +89,7 @@ public void generateECKey() {
     assertEquals(actualPrivateKey256, keyPair256.privateKey);
     assertEquals(actualPublicKey256, keyPair256.publicKey);
 
-    // 384 bit key
+    // 384-bit key
     KeyPair keyPair384 = JWTUtils.generate384_ECKeyPair();
     ECPrivateKey privateKey384 = PEM.decode(keyPair384.privateKey).getPrivateKey();
     ECPublicKey publicKey384 = PEM.decode(keyPair384.publicKey).getPublicKey();
@@ -113,7 +115,7 @@ public void generateECKey() {
     assertEquals(actualPrivateKey384, keyPair384.privateKey);
     assertEquals(actualPublicKey384, keyPair384.publicKey);
 
-    // 521 bit key
+    // 521-bit key
     KeyPair keyPair521 = JWTUtils.generate521_ECKeyPair();
     ECPrivateKey privateKey521 = PEM.decode(keyPair521.privateKey).getPrivateKey();
     ECPublicKey publicKey521 = PEM.decode(keyPair521.publicKey).getPublicKey();
@@ -140,9 +142,114 @@ public void generateECKey() {
     assertEquals(actualPublicKey521, keyPair521.publicKey);
   }
 
+  @Test
+  public void generate_ed25519_EdDSAKeyPair() {
+    KeyPair keyPair = JWTUtils.generate_ed25519_EdDSAKeyPair();
+    EdECPrivateKey privateKey = PEM.decode(keyPair.privateKey).getPrivateKey();
+    EdECPublicKey publicKey = PEM.decode(keyPair.publicKey).getPublicKey();
+
+    assertEquals(privateKey.getAlgorithm(), fipsEnabled ? "Ed25519" : "EdDSA");
+    assertEquals(privateKey.getFormat(), "PKCS#8");
+    assertEquals(privateKey.getParams().getName(), "Ed25519");
+    assertEquals(privateKey.getBytes().orElseThrow().length, 32);
+
+    assertEquals(publicKey.getAlgorithm(), fipsEnabled ? "Ed25519" : "EdDSA");
+    assertEquals(publicKey.getFormat(), "X.509");
+  }
+
+  @Test
+  public void generate_ed448_EdDSAKeyPair() {
+    KeyPair keyPair = JWTUtils.generate_ed448_EdDSAKeyPair();
+    EdECPrivateKey privateKey = PEM.decode(keyPair.privateKey).getPrivateKey();
+    EdECPublicKey publicKey = PEM.decode(keyPair.publicKey).getPublicKey();
+
+    assertEquals(privateKey.getAlgorithm(), fipsEnabled ? "Ed448" : "EdDSA");
+    assertEquals(privateKey.getFormat(), "PKCS#8");
+    assertEquals(privateKey.getParams().getName(), "Ed448");
+    assertEquals(privateKey.getBytes().orElseThrow().length, 57);
+
+    assertEquals(publicKey.getAlgorithm(), fipsEnabled ? "Ed448" : "EdDSA");
+    assertEquals(publicKey.getFormat(), "X.509");
+  }
+
+  @Test
+  public void generateRSAPSS_key() {
+    // 2048-bit key
+    KeyPair keyPair2048 = JWTUtils.generate2048_RSAPSSKeyPair();
+    RSAPrivateKey privateKey2048 = PEM.decode(keyPair2048.privateKey).getPrivateKey();
+    RSAPublicKey publicKey2048 = PEM.decode(keyPair2048.publicKey).getPublicKey();
+
+    assertEquals(privateKey2048.getModulus().bitLength(), 2048);
+    assertEquals(privateKey2048.getAlgorithm(), "RSASSA-PSS");
+    assertEquals(privateKey2048.getFormat(), "PKCS#8");
+
+    assertEquals(publicKey2048.getModulus().bitLength(), 2048);
+    assertEquals(publicKey2048.getAlgorithm(), "RSASSA-PSS");
+    assertEquals(publicKey2048.getFormat(), "X.509");
+
+    assertPrefix(keyPair2048.privateKey, PKCS_8_PRIVATE_KEY_PREFIX);
+    assertSuffix(keyPair2048.privateKey, PKCS_8_PRIVATE_KEY_SUFFIX);
+    assertPrefix(keyPair2048.publicKey, X509_PUBLIC_KEY_PREFIX);
+    assertSuffix(keyPair2048.publicKey, X509_PUBLIC_KEY_SUFFIX);
+
+    // Now go backwards from the key to a PEM and assert they come out the same.
+    String actualPrivateKey2048 = PEM.encode(privateKey2048);
+    String actualPublicKey2048 = PEM.encode(publicKey2048);
+    assertEquals(actualPrivateKey2048, keyPair2048.privateKey);
+    assertEquals(actualPublicKey2048, keyPair2048.publicKey);
+
+    // 3072-bit key
+    KeyPair keyPair3072 = JWTUtils.generate3072_RSAPSSKeyPair();
+    RSAPrivateKey privateKey3072 = PEM.decode(keyPair3072.privateKey).getPrivateKey();
+    RSAPublicKey publicKey3072 = PEM.decode(keyPair3072.publicKey).getPublicKey();
+
+    assertEquals(privateKey3072.getModulus().bitLength(), 3072);
+    assertEquals(privateKey3072.getAlgorithm(), "RSASSA-PSS");
+    assertEquals(privateKey3072.getFormat(), "PKCS#8");
+
+    assertEquals(publicKey3072.getModulus().bitLength(), 3072);
+    assertEquals(publicKey3072.getAlgorithm(), "RSASSA-PSS");
+    assertEquals(publicKey3072.getFormat(), "X.509");
+
+    assertPrefix(keyPair3072.privateKey, PKCS_8_PRIVATE_KEY_PREFIX);
+    assertSuffix(keyPair3072.privateKey, PKCS_8_PRIVATE_KEY_SUFFIX);
+    assertPrefix(keyPair3072.publicKey, X509_PUBLIC_KEY_PREFIX);
+    assertSuffix(keyPair3072.publicKey, X509_PUBLIC_KEY_SUFFIX);
+
+    // Now go backwards from the key to a PEM and assert they come out the same.
+    String actualPrivateKey3072 = PEM.encode(privateKey3072);
+    String actualPublicKey3072 = PEM.encode(publicKey3072);
+    assertEquals(actualPrivateKey3072, keyPair3072.privateKey);
+    assertEquals(actualPublicKey3072, keyPair3072.publicKey);
+
+    // 4096-bit key
+    KeyPair keyPair4096 = JWTUtils.generate4096_RSAPSSKeyPair();
+    RSAPrivateKey privateKey4096 = PEM.decode(keyPair4096.privateKey).getPrivateKey();
+    RSAPublicKey publicKey4096 = PEM.decode(keyPair4096.publicKey).getPublicKey();
+
+    assertEquals(privateKey4096.getModulus().bitLength(), 4096);
+    assertEquals(privateKey4096.getAlgorithm(), "RSASSA-PSS");
+    assertEquals(privateKey4096.getFormat(), "PKCS#8");
+
+    assertEquals(publicKey4096.getModulus().bitLength(), 4096);
+    assertEquals(publicKey4096.getAlgorithm(), "RSASSA-PSS");
+    assertEquals(publicKey4096.getFormat(), "X.509");
+
+    assertPrefix(keyPair4096.privateKey, PKCS_8_PRIVATE_KEY_PREFIX);
+    assertSuffix(keyPair4096.privateKey, PKCS_8_PRIVATE_KEY_SUFFIX);
+    assertPrefix(keyPair4096.publicKey, X509_PUBLIC_KEY_PREFIX);
+    assertSuffix(keyPair4096.publicKey, X509_PUBLIC_KEY_SUFFIX);
+
+    // Now go backwards from the key to a PEM and assert they come out the same.
+    String actualPrivateKey4096 = PEM.encode(privateKey4096);
+    String actualPublicKey4096 = PEM.encode(publicKey4096);
+    assertEquals(actualPrivateKey4096, keyPair4096.privateKey);
+    assertEquals(actualPublicKey4096, keyPair4096.publicKey);
+  }
+
   @Test
   public void generateRSAKey() {
-    // 2048 bit key
+    // 2048-bit key
     KeyPair keyPair2048 = JWTUtils.generate2048_RSAKeyPair();
     RSAPrivateKey privateKey2048 = PEM.decode(keyPair2048.privateKey).getPrivateKey();
     RSAPublicKey publicKey2048 = PEM.decode(keyPair2048.publicKey).getPublicKey();
@@ -166,7 +273,7 @@ public void generateRSAKey() {
     assertEquals(actualPrivateKey2048, keyPair2048.privateKey);
     assertEquals(actualPublicKey2048, keyPair2048.publicKey);
 
-    // 3072 bit key
+    // 3072-bit key
     KeyPair keyPair3072 = JWTUtils.generate3072_RSAKeyPair();
     RSAPrivateKey privateKey3072 = PEM.decode(keyPair3072.privateKey).getPrivateKey();
     RSAPublicKey publicKey3072 = PEM.decode(keyPair3072.publicKey).getPublicKey();
@@ -190,7 +297,7 @@ public void generateRSAKey() {
     assertEquals(actualPrivateKey3072, keyPair3072.privateKey);
     assertEquals(actualPublicKey3072, keyPair3072.publicKey);
 
-    // 4096 bit key
+    // 4096-bit key
     KeyPair keyPair4096 = JWTUtils.generate4096_RSAKeyPair();
     RSAPrivateKey privateKey4096 = PEM.decode(keyPair4096.privateKey).getPrivateKey();
     RSAPublicKey publicKey4096 = PEM.decode(keyPair4096.publicKey).getPublicKey();
diff --git a/src/test/java/io/fusionauth/jwt/OpenIdConnectTest.java b/src/test/java/io/fusionauth/jwt/OpenIdConnectTest.java
index 9c754439..30ef232e 100644
--- a/src/test/java/io/fusionauth/jwt/OpenIdConnectTest.java
+++ b/src/test/java/io/fusionauth/jwt/OpenIdConnectTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2016-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -42,6 +42,10 @@ public void test_at_hash() {
     assertEquals(at_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.RS384), "phZaPQJosyg-qi-OIYyQ3xJB9wsHYEEz");
     assertEquals(at_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.RS512), "8xltSlOGYrWy8W9yNvRlEth1i_bXW-JROWPLvCv5zog");
 
+    // Note that we are not able to differentiate between ed25519 and ed448
+    // - https://bitbucket.org/openid/connect/issues/1125/_hash-algorithm-for-eddsa-id-tokens
+    assertEquals(at_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.EdDSA), "8xltSlOGYrWy8W9yNvRlEth1i_bXW-JROWPLvCv5zog");
+
     // Controls
     assertEquals(at_hash("1940a308-d492-3660-a9f8-46723cc582e9", Algorithm.RS256), "JrZY9MtYVEIIJUx-DDBmww");
     assertEquals(at_hash("jHkWEdUXMU1BwAsC4vtUsZwnNvTIxEl0z9K3vx5KF0Y", Algorithm.RS256), "77QmUPtjPfzWtF2AnpK9RQ");
@@ -61,6 +65,10 @@ public void test_c_hash() {
     assertEquals(c_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.RS384), "phZaPQJosyg-qi-OIYyQ3xJB9wsHYEEz");
     assertEquals(c_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.RS512), "8xltSlOGYrWy8W9yNvRlEth1i_bXW-JROWPLvCv5zog");
 
+    // Note that we are not able to differentiate between ed25519 and ed448
+    // - https://bitbucket.org/openid/connect/issues/1125/_hash-algorithm-for-eddsa-id-tokens
+    assertEquals(c_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.EdDSA), "8xltSlOGYrWy8W9yNvRlEth1i_bXW-JROWPLvCv5zog");
+
     // Controls
     assertEquals(c_hash("16fd899f-5f0c-3114-875e-2547b629cd05", Algorithm.HS256), "S5UOXRNNyYsI6Z0G3xxdpw");
     assertEquals(c_hash("Qcb0Orv1zh30vL1MPRsbm-diHiMwcLyZvn1arpZv-Jxf_11jnpEX3Tgfvk", Algorithm.HS256), "LDktKdoQak3Pk0cnXxCltA");
diff --git a/src/test/java/io/fusionauth/jwt/RequiresAlgorithm.java b/src/test/java/io/fusionauth/jwt/RequiresAlgorithm.java
deleted file mode 100644
index 3a55904c..00000000
--- a/src/test/java/io/fusionauth/jwt/RequiresAlgorithm.java
+++ /dev/null
@@ -1,33 +0,0 @@
-/*
- * Copyright (c) 2020, FusionAuth, All Rights Reserved
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-package io.fusionauth.jwt;
-
-import java.lang.annotation.Retention;
-import java.lang.annotation.Target;
-
-import static java.lang.annotation.ElementType.METHOD;
-
-/**
- * Test marker annotation to indicate the test should be only be run when a particular algorithm is available.
- *
- * @author Daniel DeGroff
- */
-@Retention(java.lang.annotation.RetentionPolicy.RUNTIME)
-@Target({METHOD})
-public @interface RequiresAlgorithm {
-  String value();
-}
\ No newline at end of file
diff --git a/src/test/java/io/fusionauth/jwt/TestNGAnnotationTransformer.java b/src/test/java/io/fusionauth/jwt/TestNGAnnotationTransformer.java
deleted file mode 100644
index 1d5a38bf..00000000
--- a/src/test/java/io/fusionauth/jwt/TestNGAnnotationTransformer.java
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (c) 2020, FusionAuth, All Rights Reserved
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *   http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing,
- * software distributed under the License is distributed on an
- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND,
- * either express or implied. See the License for the specific
- * language governing permissions and limitations under the License.
- */
-
-package io.fusionauth.jwt;
-
-import org.testng.IAnnotationTransformer;
-import org.testng.annotations.ITestAnnotation;
-
-import java.lang.reflect.Constructor;
-import java.lang.reflect.Method;
-import java.security.Signature;
-
-/**
- * Test NG transformer used to disable tests at runtime.
- *
- * @author Daniel DeGroff
- */
-@SuppressWarnings("unused")
-public class TestNGAnnotationTransformer implements IAnnotationTransformer {
-  private static boolean RSAProbabilisticSignatureSchemaAvailable;
-
-  static {
-    try {
-      Signature.getInstance("RSASSA-PSS");
-      RSAProbabilisticSignatureSchemaAvailable = true;
-    } catch (Exception ignore) {
-    }
-  }
-
-  @Override
-  public void transform(ITestAnnotation annotation, Class testClass, Constructor testConstructor, Method testMethod) {
-    RequiresAlgorithm requiresAlgorithm = testMethod.getAnnotation(RequiresAlgorithm.class);
-    if (requiresAlgorithm != null) {
-      // Only run these tests if the RSASSA PSS algorithm is available
-      if (requiresAlgorithm.value().equals("RSASSA-PSS")) {
-        annotation.setEnabled(RSAProbabilisticSignatureSchemaAvailable);
-      }
-    }
-  }
-}
\ No newline at end of file
diff --git a/src/test/java/io/fusionauth/jwt/ed/EdVerifierTest.java b/src/test/java/io/fusionauth/jwt/ed/EdDSASignerTest.java
similarity index 78%
rename from src/test/java/io/fusionauth/jwt/ed/EdVerifierTest.java
rename to src/test/java/io/fusionauth/jwt/ed/EdDSASignerTest.java
index f30665d2..a2f787e8 100644
--- a/src/test/java/io/fusionauth/jwt/ed/EdVerifierTest.java
+++ b/src/test/java/io/fusionauth/jwt/ed/EdDSASignerTest.java
@@ -37,7 +37,7 @@
 /**
  * @author Daniel DeGroff
  */
-public class EdVerifierTest extends BaseJWTTest {
+public class EdDSASignerTest extends BaseJWTTest {
   @Test
   public void canVerify() {
     Verifier verifier = EdDSAVerifier.newVerifier(getPath("ed_dsa_public_key.pem"));
@@ -109,4 +109,25 @@ public void signAndVerify() throws Exception {
     assertEquals(actual.subject, jwt.subject);
     assertEquals(actual.header.algorithm.name(), "EdDSA");
   }
+
+  @Test
+  public void test_private_pem_parsing() {
+    // Key as string
+    assertNotNull(EdDSASigner.newSigner(readFile("ed_dsa_ed25519_private_key.pem")));
+    assertNotNull(EdDSASigner.newSigner(readFile("ed_dsa_ed448_private_key.pem")));
+
+    // Key as object
+    assertNotNull(EdDSASigner.newSigner(PEM.decode(getPath("ed_dsa_ed25519_private_key.pem")).privateKey));
+    assertNotNull(EdDSASigner.newSigner(PEM.decode(getPath("ed_dsa_ed448_private_key.pem")).privateKey));
+
+    // Add kid
+
+    // Key as string
+    assertNotNull(EdDSASigner.newSigner(readFile("ed_dsa_ed25519_private_key.pem"), "abc").getKid(), "abc");
+    assertNotNull(EdDSASigner.newSigner(readFile("ed_dsa_ed448_private_key.pem"), "abc").getKid(), "abc");
+
+    // Key as object
+    assertNotNull(EdDSASigner.newSigner(PEM.decode(getPath("ed_dsa_ed25519_private_key.pem")).privateKey, "abc").getKid(), "abc");
+    assertNotNull(EdDSASigner.newSigner(PEM.decode(getPath("ed_dsa_ed448_private_key.pem")).privateKey, "abc").getKid(), "abc");
+  }
 }
diff --git a/src/test/java/io/fusionauth/jwt/ed/EdSignerTest.java b/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java
similarity index 88%
rename from src/test/java/io/fusionauth/jwt/ed/EdSignerTest.java
rename to src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java
index 94951424..c31fcd8f 100644
--- a/src/test/java/io/fusionauth/jwt/ed/EdSignerTest.java
+++ b/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java
@@ -37,17 +37,26 @@
 /**
  * @author Daniel DeGroff
  */
-public class EdSignerTest extends BaseJWTTest {
+public class EdDSAVerifierTest extends BaseJWTTest {
   @Test
   public void canVerify() {
     Verifier verifier = EdDSAVerifier.newVerifier(getPath("ed_dsa_public_key.pem"));
     assertTrue(verifier.canVerify(Algorithm.EdDSA));
+    PEM pem = PEM.decode(getPath("ed_dsa_public_key.pem"));
+    EdDSAVerifier.newVerifier(pem.publicKey);
+
+    Verifier verifier25519 = EdDSAVerifier.newVerifier(getPath("ed_dsa_ed25519_public_key.pem"));
+    assertTrue(verifier25519.canVerify(Algorithm.EdDSA));
+
+    Verifier verifier448 = EdDSAVerifier.newVerifier(getPath("ed_dsa_ed448_public_key.pem"));
+    assertTrue(verifier448.canVerify(Algorithm.EdDSA));
   }
 
   @Test
   public void decodePrivateKey() throws Exception {
     List<String> privateKeys = Arrays.asList(
         "ed_dsa_ed25519_private_key.pem",
+        "ed_dsa_ed448_private_key.pem",
         "ed_dsa_private_key.pem");
 
     // These keys do not contain a public key
@@ -80,6 +89,7 @@ public void decodePrivateKey() throws Exception {
   public void decodePublicKey() throws Exception {
     List<String> publicKeys = Arrays.asList(
         "ed_dsa_ed25519_public_key.pem",
+        "ed_dsa_ed448_public_key.pem",
         "ed_dsa_public_key.pem");
 
     for (String f : publicKeys) {
diff --git a/src/test/java/io/fusionauth/jwt/rsa/RSAPSSSignerTest.java b/src/test/java/io/fusionauth/jwt/rsa/RSAPSSSignerTest.java
index fc86662e..36b25b77 100644
--- a/src/test/java/io/fusionauth/jwt/rsa/RSAPSSSignerTest.java
+++ b/src/test/java/io/fusionauth/jwt/rsa/RSAPSSSignerTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, FusionAuth, All Rights Reserved
+ * Copyright (c) 2017-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -44,6 +44,11 @@ public void test_private_pem_parsing() {
     assertNotNull(RSAPSSSigner.newSHA512Signer(readFile("rsa_private_key_3072.pem")));
     assertNotNull(RSAPSSSigner.newSHA512Signer(readFile("rsa_private_key_4096.pem")));
 
+    // RSA PSS keys
+    assertNotNull(RSAPSSSigner.newSHA256Signer(readFile("rsa_pss_private_key_2048.pem")));
+    assertNotNull(RSAPSSSigner.newSHA384Signer(readFile("rsa_pss_private_key_3072.pem")));
+    assertNotNull(RSAPSSSigner.newSHA512Signer(readFile("rsa_pss_private_key_4096.pem")));
+
     // With kid
     assertEquals(RSAPSSSigner.newSHA256Signer(readFile("rsa_private_key_2048.pem"), "abc").getKid(), "abc");
     assertEquals(RSAPSSSigner.newSHA256Signer(readFile("rsa_private_key_2048_with_meta.pem"), "abc").getKid(), "abc");
diff --git a/src/test/java/io/fusionauth/jwt/rsa/RSAPSSVerifierTest.java b/src/test/java/io/fusionauth/jwt/rsa/RSAPSSVerifierTest.java
index f4cceba5..1159989e 100644
--- a/src/test/java/io/fusionauth/jwt/rsa/RSAPSSVerifierTest.java
+++ b/src/test/java/io/fusionauth/jwt/rsa/RSAPSSVerifierTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2017-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,7 +18,6 @@
 
 import io.fusionauth.jwt.BaseJWTTest;
 import io.fusionauth.jwt.InvalidKeyLengthException;
-import io.fusionauth.jwt.RequiresAlgorithm;
 import io.fusionauth.jwt.Verifier;
 import io.fusionauth.jwt.domain.Algorithm;
 import io.fusionauth.jwt.domain.JWT;
@@ -44,11 +43,14 @@ public class RSAPSSVerifierTest extends BaseJWTTest {
   @Test
   public void test_public_pem_parsing() {
     Arrays.asList(
-        "rsa_certificate_2048.pem",
-        "rsa_public_key_2048.pem",
-        "rsa_public_key_2048_with_meta.pem",
-        "rsa_public_key_3072.pem",
-        "rsa_public_key_4096.pem")
+            "rsa_certificate_2048.pem",
+            "rsa_public_key_2048.pem",
+            "rsa_public_key_2048_with_meta.pem",
+            "rsa_public_key_3072.pem",
+            "rsa_public_key_4096.pem",
+            "rsa_pss_public_key_2048.pem",
+            "rsa_pss_public_key_3072.pem",
+            "rsa_pss_public_key_4096.pem")
         .forEach(fileName -> {
           // Take a String arg
           assertRSAPSAVerifier(RSAPSSVerifier.newVerifier(getPath(fileName)));
@@ -62,10 +64,13 @@ public void test_public_pem_parsing() {
 
     // Public key parsing also works with private keys since the public key is encoded in the private
     Arrays.asList(
-        "rsa_private_key_2048.pem",
-        "rsa_private_key_2048_with_meta.pem",
-        "rsa_private_key_3072.pem",
-        "rsa_private_key_4096.pem")
+            "rsa_private_key_2048.pem",
+            "rsa_private_key_2048_with_meta.pem",
+            "rsa_private_key_3072.pem",
+            "rsa_private_key_4096.pem",
+            "rsa_pss_private_key_2048.pem",
+            "rsa_pss_private_key_3072.pem",
+            "rsa_pss_private_key_4096.pem")
         .forEach((fileName -> {
           // Take a String arg
           assertRSAPSAVerifier(RSAPSSVerifier.newVerifier(getPath(fileName)));
@@ -90,7 +95,6 @@ public void test_rsa_1024_pem() {
   }
 
   @Test
-  @RequiresAlgorithm("RSASSA-PSS")
   public void control() {
     String encodedJWT = "eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWUsImlhdCI6MTUxNjIzOTAyMn0.hZnl5amPk_I3tb4O-Otci_5XZdVWhPlFyVRvcqSwnDo_srcysDvhhKOD01DigPK1lJvTSTolyUgKGtpLqMfRDXQlekRsF4XhAjYZTmcynf-C-6wO5EI4wYewLNKFGGJzHAknMgotJFjDi_NCVSjHsW3a10nTao1lB82FRS305T226Q0VqNVJVWhE4G0JQvi2TssRtCxYTqzXVt22iDKkXeZJARZ1paXHGV5Kd1CljcZtkNZYIGcwnj65gvuCwohbkIxAnhZMJXCLaVvHqv9l-AAUV7esZvkQR1IpwBAiDQJh4qxPjFGylyXrHMqh5NlT_pWL2ZoULWTg_TJjMO9TuQ";
     String publicKeyPEM = "-----BEGIN PUBLIC KEY-----\n" +
diff --git a/src/test/java/io/fusionauth/jwt/rsa/RSAVerifierTest.java b/src/test/java/io/fusionauth/jwt/rsa/RSAVerifierTest.java
index 62fdfb93..4d5f1a7f 100644
--- a/src/test/java/io/fusionauth/jwt/rsa/RSAVerifierTest.java
+++ b/src/test/java/io/fusionauth/jwt/rsa/RSAVerifierTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017-2022, FusionAuth, All Rights Reserved
+ * Copyright (c) 2017-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -40,39 +40,45 @@ public class RSAVerifierTest extends BaseJWTTest {
   @Test
   public void test_public_pem_parsing() {
     Arrays.asList(
-        "rsa_certificate_2048.pem",
-        "rsa_public_key_2047.pem",
-        "rsa_public_key_2048.pem",
-        "rsa_public_key_2048_with_meta.pem",
-        "rsa_public_key_3072.pem",
-        "rsa_public_key_4096.pem")
-          .forEach(fileName -> {
-            // Take a String arg
-            assertRSAVerifier(RSAVerifier.newVerifier(getPath(fileName)));
-            // Take a Path arg
-            assertRSAVerifier(RSAVerifier.newVerifier(readFile(fileName)));
-            // Take a byte[] arg
-            assertRSAVerifier(RSAVerifier.newVerifier(readFile(fileName).getBytes(StandardCharsets.UTF_8)));
-            // Take a public key arg
-            assertRSAVerifier(RSAVerifier.newVerifier((RSAPublicKey) PEM.decode(readFile(fileName)).getPublicKey()));
-          });
+            "rsa_certificate_2048.pem",
+            "rsa_public_key_2047.pem",
+            "rsa_public_key_2048.pem",
+            "rsa_public_key_2048_with_meta.pem",
+            "rsa_public_key_3072.pem",
+            "rsa_public_key_4096.pem",
+            "rsa_pss_public_key_2048.pem",
+            "rsa_pss_public_key_3072.pem",
+            "rsa_pss_public_key_4096.pem")
+        .forEach(fileName -> {
+          // Take a String arg
+          assertRSAVerifier(RSAVerifier.newVerifier(getPath(fileName)));
+          // Take a Path arg
+          assertRSAVerifier(RSAVerifier.newVerifier(readFile(fileName)));
+          // Take a byte[] arg
+          assertRSAVerifier(RSAVerifier.newVerifier(readFile(fileName).getBytes(StandardCharsets.UTF_8)));
+          // Take a public key arg
+          assertRSAVerifier(RSAVerifier.newVerifier((RSAPublicKey) PEM.decode(readFile(fileName)).getPublicKey()));
+        });
 
     // Public key parsing also works with private keys since the public key is encoded in the private
     Arrays.asList(
-        "rsa_private_key_2048.pem",
-        "rsa_private_key_2048_with_meta.pem",
-        "rsa_private_key_3072.pem",
-        "rsa_private_key_4096.pem")
-          .forEach((fileName -> {
-            // Take a String arg
-            assertRSAVerifier(RSAVerifier.newVerifier(getPath(fileName)));
-            // Take a Path arg
-            assertRSAVerifier(RSAVerifier.newVerifier(readFile(fileName)));
-            // Take a byte[] arg
-            assertRSAVerifier(RSAVerifier.newVerifier(readFile(fileName).getBytes(StandardCharsets.UTF_8)));
-            // Take a public key arg
-            assertRSAVerifier(RSAVerifier.newVerifier((RSAPublicKey) PEM.decode(readFile(fileName)).getPublicKey()));
-          }));
+            "rsa_private_key_2048.pem",
+            "rsa_private_key_2048_with_meta.pem",
+            "rsa_private_key_3072.pem",
+            "rsa_private_key_4096.pem",
+            "rsa_pss_private_key_2048.pem",
+            "rsa_pss_private_key_3072.pem",
+            "rsa_pss_private_key_4096.pem")
+        .forEach((fileName -> {
+          // Take a String arg
+          assertRSAVerifier(RSAVerifier.newVerifier(getPath(fileName)));
+          // Take a Path arg
+          assertRSAVerifier(RSAVerifier.newVerifier(readFile(fileName)));
+          // Take a byte[] arg
+          assertRSAVerifier(RSAVerifier.newVerifier(readFile(fileName).getBytes(StandardCharsets.UTF_8)));
+          // Take a public key arg
+          assertRSAVerifier(RSAVerifier.newVerifier((RSAPublicKey) PEM.decode(readFile(fileName)).getPublicKey()));
+        }));
   }
 
   @Test
diff --git a/src/test/java/io/fusionauth/pem/PEMDecoderTest.java b/src/test/java/io/fusionauth/pem/PEMDecoderTest.java
index 136a09ed..61fc382c 100644
--- a/src/test/java/io/fusionauth/pem/PEMDecoderTest.java
+++ b/src/test/java/io/fusionauth/pem/PEMDecoderTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -70,7 +70,11 @@ public void private_pkcs_8() throws Exception {
         "ec_private_secp384r1_p_384_openssl_pkcs8.pem",
         "ec_private_secp521r1_p_512_openssl_pkcs8.pem",
         "rsa_private_key_2048_pkcs_8_control.pem",
-        "rsa_private_key_3072.pem");
+        "rsa_private_key_3072.pem",
+        "rsa_pss_private_key_2048.pem",
+        "rsa_pss_private_key_3072.pem",
+        "rsa_pss_private_key_4096.pem"
+    );
 
     for (String f : filesIncludingPublicKey) {
       String message = "For file [" + f + "]";
diff --git a/src/test/java/io/fusionauth/security/KeyUtilsTests.java b/src/test/java/io/fusionauth/security/KeyUtilsTests.java
index ed3dd6e5..198f5382 100644
--- a/src/test/java/io/fusionauth/security/KeyUtilsTests.java
+++ b/src/test/java/io/fusionauth/security/KeyUtilsTests.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, FusionAuth, All Rights Reserved
+ * Copyright (c) 2020-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -109,4 +109,22 @@ public void rsa_getKeyLength(String algorithm, int keySize, int privateKeySize,
     assertEquals(KeyUtils.getKeyLength(keyPair.getPrivate()), privateKeySize);
     assertEquals(KeyUtils.getKeyLength(keyPair.getPublic()), publicKeySize);
   }
+
+  @Test
+  public void eddsa_25519_keyLength() throws Exception {
+    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("Ed25519");
+    KeyPair keyPair = keyPairGenerator.generateKeyPair();
+
+    assertEquals(KeyUtils.getKeyLength(keyPair.getPrivate()), 32);
+    assertEquals(KeyUtils.getKeyLength(keyPair.getPublic()), 32);
+  }
+
+  @Test
+  public void eddsa_448_keyLength() throws Exception {
+    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("Ed448");
+    KeyPair keyPair = keyPairGenerator.generateKeyPair();
+
+    assertEquals(KeyUtils.getKeyLength(keyPair.getPrivate()), 57);
+    assertEquals(KeyUtils.getKeyLength(keyPair.getPublic()), 57);
+  }
 }
diff --git a/src/test/resources/rsa_pss_private_key_2048.pem b/src/test/resources/rsa_pss_private_key_2048.pem
new file mode 100644
index 00000000..a0f82096
--- /dev/null
+++ b/src/test/resources/rsa_pss_private_key_2048.pem
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEugIBADALBgkqhkiG9w0BAQoEggSmMIIEogIBAAKCAQEAvlGU+GNj5XVHJ8Hi
+8b0Dhjk3m+1uULwdIrEZMckvuWnderIKDMMpdORGg79nmMd7fPayrvA7ZxOjnEBI
+AzGfovDje9NN3esWAZ6uQpZAUdZO3wPW2qPBTgFtdzTnLEY+z5itxCL1J7KyeQuD
+82Jrda5C+9FLkf40CMlGj/5Z9BSF4OXlsY8LwLlNd+3jQLK3tzCFQwUncmXenprs
+Zmw37fyEqN6mfoXVp22i0LbtHdh7+JbLg7AWaovKkqikh79HKG7ptcAmwpd4uc4z
+bH5yowBepscfqsYKlvwheYBudJumxq+H/+8ZippSt3//fcCK64IqwW0DkbsU61Sl
+zntkvQIDAQABAoIBABCR9dByht4RifJyNRorBMWI8ciHsZUh6797f+APzjHsf7YR
+DkLyMwfUYDdUUObCZ4QHzqLgk6tz0EjoZ9yvU2DSbFv5l8v8jdvyPuXZQxxc9l0A
+bpJ2s3vhL/CzEHWQYCOe/XIYQRQFwPg9Am4MYaLLW1WlcVjyswEY1SXwVVCk2hIe
+yIP6iWiUnM2OQ4rCkLL6VN3j26btYDgUrNfMeLwnE40l7Ja5WDDyOpzRwGPWPcVH
+NpZMQvkql0hsW+Y+mUZPauC4PIbe4dxm9IToXPxYIummqEQawFLRVZgSj4BZTAh4
+l4/OfPrJnF4klah4aFbCAPDSnxBIS/vWQPVa8RkCgYEA+V/zCqvziDSo+lCxk8Wn
+XFYA4yg+91IEFmeJoLgpdpIZhdlrsK1yPnEqYbfgjH9nurl9+zsyT6CaajVoM3jH
+uQEN+Eznf8cLG78KzyAE0HUEi4zf0XwC7BfoMaA9HEnjV9ctij9w+g9s6NfugwsD
+PdJTRv/IAWGeyVnXgX3kRocCgYEAw1/6uSjS/ptRIzrWr84KNvg+zfkAzWNdPoD3
+DZDzJAi3IW+kDezOXiFtLZQcORD/WobtNfglEO57imb1aaxrxwB+lyKJokRYjlz7
+KZ8TtHPsPrJ2yZ37XFb73uqS7kGnsO5nKRLc17rFAXBCn05OW8MG4jGlu0K2nnkS
+U8yxB5sCgYBZN9nFTKWxal22SJ5vpvxsjZx9qM12QJKTzXEw3hJ/iF+3QoVDzZoc
++vHVyip9OavL40dOVex3DpeQPhFMsP6LkvQDjMgaMAUqZRwh5Gu0hNkecEU3Nm35
+N8hr0M9sSocayzJQzsfFvzUQzQhZO9xqBtCiiypsTBe6I/l1K6w7CwKBgDvvkNIG
+tRvIeA6vuTa7paSRaWr0rYtUpUFMfP3bbsuqJMwMHK7s664y4PRvkGztSvjxlYnN
+80kLcDjYNwdRDstA2pTw0npGL0iVO7PcCkZ8nYfqZciaP4dnY+NR4PtYhuIfcORH
+1hoUQOWdE8MdWaqK3Oy9QFN/NtjM2ZN9ov1rAoGAGQpitPntsdYUdVK3tYk+Utl7
+vDJA0HH7rxwAqx6gwxVXLDZf9SEYocJtulNWl8HIzUmoHu0KdMsosq721WbU4Jt3
+5QiOpfa+zRNMcKV/7C/MUMvKTOWg9LzuJ2H2IJYxnglacScv5SYH6ms2LRs52+NU
+m4yAqJzSjUa9Zi+jgos=
+-----END PRIVATE KEY-----
diff --git a/src/test/resources/rsa_pss_private_key_3072.pem b/src/test/resources/rsa_pss_private_key_3072.pem
new file mode 100644
index 00000000..b7ec7261
--- /dev/null
+++ b/src/test/resources/rsa_pss_private_key_3072.pem
@@ -0,0 +1,40 @@
+-----BEGIN PRIVATE KEY-----
+MIIG+gIBADALBgkqhkiG9w0BAQoEggbmMIIG4gIBAAKCAYEA2ry56Qx6+nH2ZETU
+hgl64kGAWl9w0mF2EDZlMZRxuHTMkP0qdDSiNqllnP2Q1PpUS8F7SgwElNIRPrI0
+Ig5sHyY5TiLfYGOzZLlvY984VLzd55i0tmgD9jIgQRnysT9+4D7szXnLQDM+w4VF
+hEc3mz48/Jf+yvRAlbmjHZeCIq/Y2ir8W+vUhSNmnHeLPW1pNJVExR2crTYyWRs2
+L6xm+MZFXORtzoi9npiVum8qbOD3VqE23BTjpzoJhHjIjVn9hHJDvcxS3GSDsyBh
+iviWKOLai6OP1Ox6baXfWSG3moVYW2Ud95DPewIF4kR41B09/YONdtmKT6wX0db0
+xPAuoCeV6fZT4TBzYD9jB5fIrUNG1gGRWewXyvb0abR8TWyfnY1bbD9qs7kyKtzS
+f/866DtUTIvch3lBuPLbOikzAyNHSUsv5oKbVqC8ALN9YnE2LJ4DXMf7u8GtRKr7
+lhaYNeETx5Xioo5+G1AP7Exdv1S8/vAZ3/q3JmE1ztlOMjqfAgMBAAECggGAN2w5
+WOTqJhoJGbfc94dgZQK+wGdNYWkDbrExq8HWnKuvh482GhKaBWqfjgsrjuNMx5Mj
+J4xq/sBJUU766aQo3i2juHoaikRI2J0pra8KCWJ/gWaOZ2dslY124bfu591USwJ2
+osuY5c/2N7lFd3JKEyJOdpwWmZsQ4D8UpvNULHDM696Xab0T8JYbMksR80MNNJ8b
+uSw7HiJM2IoODT9MKf2m5pYUgo/gJ9a2nXH8WHEaCo+3pEUAt8b7UV7/Rd2GaITm
+SGG1tFAaOyOW5SkI0wRQzCmzXENq/pE/RsyGSiQ18iOTdt9/nTVkQbZl/ktzv1JG
+BjvixrCcwwJfK9lOmryeckGClfCeSYjiixEYE18f3oaIqROGUH4gyTaS07dQeUO8
+3TID1YTO4+U9PnYJz0GVlnBYci2Y2NL5/7UQ54dPIc65J4zMfggjPkbItkyOD3dT
+UYMMmXWavfyKmGtsc4HHXCq3sr8tnzGdpx/4SXj/aNg5pNzB0s23Gi90VaUtAoHB
+AO3g3drHXZNnJSJhl1GGWkW1dY29loTNttDzX+rLAp/uTn47EByBKb9DkpDBEHu0
+pieNHQkhwzFniiX7tm1RF2jSquI+ZYeCbtPCW/4UIWlON1PF78I8whAIZzM8od79
+BTA93UG7Mogzy0VfM+ctDf86Ax0bC5NWcNQWm2Ww4swPWoFckQEO4EiKagS+0hEV
+o+TlEXTim0B+l49uuXeFAplBew4SYIRFOWEzC9sfoR6IWyMErQQ/3MTRPNudyrJE
+ZQKBwQDrZpDq93uUHiEC0LgJZNJeKytvL+VhQFxOSuKmwjx4/ZKmW6XNYx7jmnn2
+GyRg3YrpmGh7MX/OxCZDQrWIOvH/9an3ZpSIul7jOCsLF6SDnfASbvM8rZBMKiPd
+s6FitZ9WAU5AnDzs7XcalVnnwdpRq4DOiHmImNRbMWnKgoZtFC1ESNLcgtyE8m8V
+lduARCfh3+P6vqv95CtlzgdKVA8Qj204TGde/8uKDGoi9LTlyH3L3HavXsZQw/Nu
+ueIQSLMCgcB6bslhKEmWa3kmZ/pdAHyH8mxtpo3JDqQwiYLtss1ICXym5blWInid
+M6dFD8lvEjyOkMfIAnOXgwYMpLBxNVKKJhvD1H+nLk/id9+nNy83JwW8/Vx4qZLs
+c5bCPUvHHI1GFiFCCppoldfifayWKI9StMYTfe8IR25NCtGylkc05hYcDMupMsHn
+NC57AMfX+T5gujGw6k0j9cQGE+Qriu8aeCRgyr6YdZSh3YcVogLoVyApNufiDwiO
+2G6tTlqcRC0CgcBJrTBuWkczdLqgRvNS/VtaXeiaRENmzN4XIxkNWH3U4IilyMl8
+Hynr0s2ZWaVpK+3ubuVEqZl2/a18H8TxfoF/u0QXSuPyZ2KLe2j9b8jt6ODa5B79
+PtWLASV4nmBEpNPZ906mqj/nZ+t/Rn99Kg9KwILwIYboWe0dHboex/uK6GXCmYhl
+vA+JDNf3yY+J9csFxy1zrXnnXSK4GmPtv6F3bWyh0kgIU8dAzeHqTuzPfpDg3X/I
+I8GuRaZLYaJ/tkECgcAPrWnHawEYuJ7Qs9KrXYMr0dQNorM55MDAu3ZxcY9ZaNZX
+Sq9VqulGhr0wfrvE5txlpWHV0VwXSRGsKE7KuemimyZ/EkWKuZJREGLdT2HlgR0v
+FRg4wN7/ct6BgmL+GeIieiGQiEoCc/3UGZhpINfTVKYftKCTvlhlmgAthTqJGsOJ
+EVE0uHS6a0ZNhzAHno6625MpwLvg530pfngZFYQt0LsYBrEEH+M62Ni88lginL1L
+KYe+hikMOyJ0VfocTLM=
+-----END PRIVATE KEY-----
diff --git a/src/test/resources/rsa_pss_private_key_4096.pem b/src/test/resources/rsa_pss_private_key_4096.pem
new file mode 100644
index 00000000..e952ee22
--- /dev/null
+++ b/src/test/resources/rsa_pss_private_key_4096.pem
@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJPgIBADALBgkqhkiG9w0BAQoEggkqMIIJJgIBAAKCAgEAtLYeyQskVnd6PABk
+UvulhAbe3oT7VQs4F8RfSxPVjMkZmZqhTEcaOU6UHlslo7IM2hlv5c5awI0PSR9N
+rSeVcDmZkGed466NpsV2xALx3TaorcsAdH0u8+qGhvie86dgVter0XPQRC90c8zO
+oIzaEWXnyNwq9Ec/GNbwQpqYA9lOiHkDL72d/9+TTaEY+QlCep9mBNYuSsEwy/je
+EbsxlzuxFCztOwvYGHNbVVpGh5qbGfrFdu77h2LO3bYLgb+1OMY7OAhnotWfZw8Y
+y9TW1UHrt/j43e7z0xQMI3LXhREpHaR0W2MPrNlrfXfFuiNefSZaGQBJrGG8aLT4
+WhlV0Lx7b/O14v34K81u7kZwQFRzyh7MeoPiCT4u4H0CMrR4iOV5cLp+h7jMOQBW
+uH3rWx/fm08drQZ1JB4iM4m73Cz6qySS/x1TieEMuO+l7virrMubQHkJfhlwe1sH
+dfVzCDrHxhkNui4eDfki93XwgYryrHLwoYoHzdL2C1YZgustWmj8hWold/o0t7YB
+4yaEPILv9qUN6NP5aETZy/BuJVcqmzvAabxJ20f/kIUKxmjoMSZoYdXZkJc/AdbK
+oLfUuY2Osuz4Q+zYKX+PpbxtQUgQKHlFl16tItfIMXrntj6F/LTabqEZPrLJVtNq
+lPwJOUGLEIYBLbsZ2So2gnDpOUsCAwEAAQKCAgA0ylMZ9fhKjiKWLqMgHsVOWVd3
+968YO+vJ/aK84vFqbEDfP23JQ6gkf5EDgSrwtA3PFMk8f9jBETQa71sYr0yXeSwk
+JDDal15oDp1QS2/uaI5EHt5mKT+zH5rnCPAeS5H4LI7T5Bo+IQLK5VSjUCJQHM3m
+PnMJ41pKXlfXjSPFVBD+CyPkKWdjnSOB9QK/lXXnLnN2DD9/tQoVPAFbeqzU+ioT
+s8AllKMvGVvgBjw+VuriXwCaatvtw+6clBauc5t0F2yrRMFJr1AeoiljOiz8JYK/
+vqqs4qY1zlBxdpYBGG9DaoxXOgwVOXqOL5QCeVycAL0nOo9LHU4V5G/8mhQYJH/e
+ISMrYWcE9djvqV3JZtP9E/txd0ZqadzkHResgcI9x+owp6cMtB+Lofm1g0b8zGpD
+rgKOp/a2y6vrUFanWFo/iTUKcYKTNAp+6ZFXdxXaeZWy0BsEMsfCN1qsRrOt10d4
+9syadbK85VSECxlOzD6kCg3mbXnID6qr6G+8vHXmRD5NQcmmlLhXe0gEfnMwIhRh
+hJnMmwcWW8MnHvWimA90ungZ6il19x+evX0H7zyUowUIhoD0nI4DnMZ4f4P5MVHs
+hlYmtToLpqRpMx/y86d2VEeyRBQjg4Nx+ANcAaj+YyHR25WFairw8iJL7fGY6/JS
+pB1+QvuTP4v15Dl20QKCAQEA9bFSlfRlCHjSp/82F32MZ5hGuYiP1FMLLh5Cc2BW
+vrCoWISnXi6KKf1EoYEg46J2t5uOhlpZh1aVbNaBzs45kJhDu95cHaYti9UTyrTi
+QCTrvv65T9OSuT1fYQsh7xWqOkL4SnEKA4VhsgIMl1ok3yJt72S8HpHsUEK6RBAs
+E5deXn5syquycRrWJKxgwSrKNLdnvlVWjxNiCuJbPFb4mKWAUrxln8bv6L7oj8II
+xNUT+h1lZL8Qj9CR7fl4s91deWcvare7quxOIXFkvvI6yzdLLLI1S3GfJpmJB60a
+GjP/fhFQpBBvn4ZRpOg5DtjXzKAeiXk8OMPqj9cmb2IU6QKCAQEAvErqUDFn3IOO
+MXxSdhexH1EazZIKjd0WQv5P1yuox/I3yPtbmE00U2UYNnzPtdLYrMtsUidFLpO5
+D+dhY9Nq6v0CIEpdFZ6rSL7i7wzt2nWXPmDbwKj6csX/LChTawpV32SdenTuSXgG
+XJWlmJ9LrokQK/1jYCUwc2FQae7ZAys+Dgq0pFuIjlErjtqFIX4ajqpUWNtm1yKG
+nApqiaOK9wBGKyCZeBNKkgDjeU4taS3YdiYc+y+cxW8afoZWnadOvke29Zmj563v
+Oox95Au0l3pXL18o2PeDAF6hBdFci82pqpTLR4k+VNhMuAvwY3sW/wRKPyxo1Mz9
+caPDSTjMEwKB/2W7BncQusTHQnJNOhh/46MBakdoRCWmPPrbjKg5O7G5c/sy8hoN
+Kyg3tjMpRHT80Cs2Pc1jm65uK3DlYNpAiZVVdrZTW9Dq/fDoSUmlnAjzQKnUzuY+
+tIH+539HHMXiMpntIOGx7HOIxurt7ki9CodZuitlin8d7LtO5dFI4Pc7tddqgaFp
+dnleo0yME4PoM9GgH1SwASc831uiXiSd3lFWNcwMNgfyV2QHqEPeE8NsdtkZUuJk
+OndR5RqkMVZIUmvyTa/iY9JiBffS++QUaEO8oWPgZjDW2w8gg5yqECTJYwDQKpPE
+OnPTKfseLIH5R2Fy6zIBAO6AMJ9edouoEQKCAQEAi8/40pkM7PGGaPpOZL/M1lsr
+0s8JJTOwLwiVEkmp5uXVRFhYN+vD2dSsOPFObk1kdFIMWagtN5ubA9MkPrKipmA9
+7uoo2j/aIYcUDLsF9nvwVPIo2pLefNDGW+yJnGatQtZ8FIy0zzrfRmob7wsBcFT3
+/CIHY0HaCyKMSkx/OVonlteeMJiC+mINPOLHjgoMADk7rksjvsU1PLKDTzZvnl7G
+u4lWS5HPgkBEqDNDhuDy5TABvwYom3WXL7HiqOetkZ7AnPd7fDFr/IaLiASlEQFX
+saYwN4L59BFP8Xj3BhwtSqt3keO3s9p0hQjgc43Xkn6F/wijwrd/zZzzCfCxnwKC
+AQBHz5cDi+IaVvGutZKz1Fa+NQj91L+B1/Q1BlHnvF4FBPxanSDMbg9ku1D0IJx3
+TjptbVu9mYGlE76SR0uxAS0/jozEAOrrYrNNyGE3kHmmdMWHMmRRNZL9tcv/o1p7
+ySa73Cw+STDL1MFIjlSekAX2dlNdkmsp0ju+SVFurv/gKgU20D3R+VDG4sT4Qzib
+CGW5IF+wZ1GuBgm7eR5CCmtq0RdEDsqyo8kNIFY3k/jmvtpr4udT7IGXnAd7Dc6S
+x/okZ+UqL3nh5hlVqwS1YMbpJsBiEClENLgoCHoVQEBJEhOTG0aamr44Do9JlfLB
+J41j6FuHwFBfzUyaSj1ePotS
+-----END PRIVATE KEY-----
diff --git a/src/test/resources/rsa_pss_public_key_2048.pem b/src/test/resources/rsa_pss_public_key_2048.pem
new file mode 100644
index 00000000..1b5d3213
--- /dev/null
+++ b/src/test/resources/rsa_pss_public_key_2048.pem
@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIDALBgkqhkiG9w0BAQoDggEPADCCAQoCggEBAL5RlPhjY+V1RyfB4vG9A4Y5
+N5vtblC8HSKxGTHJL7lp3XqyCgzDKXTkRoO/Z5jHe3z2sq7wO2cTo5xASAMxn6Lw
+43vTTd3rFgGerkKWQFHWTt8D1tqjwU4BbXc05yxGPs+YrcQi9SeysnkLg/Nia3Wu
+QvvRS5H+NAjJRo/+WfQUheDl5bGPC8C5TXft40Cyt7cwhUMFJ3Jl3p6a7GZsN+38
+hKjepn6F1adtotC27R3Ye/iWy4OwFmqLypKopIe/Ryhu6bXAJsKXeLnOM2x+cqMA
+XqbHH6rGCpb8IXmAbnSbpsavh//vGYqaUrd//33AiuuCKsFtA5G7FOtUpc57ZL0C
+AwEAAQ==
+-----END PUBLIC KEY-----
diff --git a/src/test/resources/rsa_pss_public_key_3072.pem b/src/test/resources/rsa_pss_public_key_3072.pem
new file mode 100644
index 00000000..13eed94d
--- /dev/null
+++ b/src/test/resources/rsa_pss_public_key_3072.pem
@@ -0,0 +1,11 @@
+-----BEGIN PUBLIC KEY-----
+MIIBoDALBgkqhkiG9w0BAQoDggGPADCCAYoCggGBANq8uekMevpx9mRE1IYJeuJB
+gFpfcNJhdhA2ZTGUcbh0zJD9KnQ0ojapZZz9kNT6VEvBe0oMBJTSET6yNCIObB8m
+OU4i32Bjs2S5b2PfOFS83eeYtLZoA/YyIEEZ8rE/fuA+7M15y0AzPsOFRYRHN5s+
+PPyX/sr0QJW5ox2XgiKv2Noq/Fvr1IUjZpx3iz1taTSVRMUdnK02MlkbNi+sZvjG
+RVzkbc6IvZ6YlbpvKmzg91ahNtwU46c6CYR4yI1Z/YRyQ73MUtxkg7MgYYr4liji
+2oujj9Tsem2l31kht5qFWFtlHfeQz3sCBeJEeNQdPf2DjXbZik+sF9HW9MTwLqAn
+len2U+Ewc2A/YweXyK1DRtYBkVnsF8r29Gm0fE1sn52NW2w/arO5Mirc0n//Oug7
+VEyL3Id5Qbjy2zopMwMjR0lLL+aCm1agvACzfWJxNiyeA1zH+7vBrUSq+5YWmDXh
+E8eV4qKOfhtQD+xMXb9UvP7wGd/6tyZhNc7ZTjI6nwIDAQAB
+-----END PUBLIC KEY-----
diff --git a/src/test/resources/rsa_pss_public_key_4096.pem b/src/test/resources/rsa_pss_public_key_4096.pem
new file mode 100644
index 00000000..0c1fc3f2
--- /dev/null
+++ b/src/test/resources/rsa_pss_public_key_4096.pem
@@ -0,0 +1,14 @@
+-----BEGIN PUBLIC KEY-----
+MIICIDALBgkqhkiG9w0BAQoDggIPADCCAgoCggIBALS2HskLJFZ3ejwAZFL7pYQG
+3t6E+1ULOBfEX0sT1YzJGZmaoUxHGjlOlB5bJaOyDNoZb+XOWsCND0kfTa0nlXA5
+mZBnneOujabFdsQC8d02qK3LAHR9LvPqhob4nvOnYFbXq9Fz0EQvdHPMzqCM2hFl
+58jcKvRHPxjW8EKamAPZToh5Ay+9nf/fk02hGPkJQnqfZgTWLkrBMMv43hG7MZc7
+sRQs7TsL2BhzW1VaRoeamxn6xXbu+4dizt22C4G/tTjGOzgIZ6LVn2cPGMvU1tVB
+67f4+N3u89MUDCNy14URKR2kdFtjD6zZa313xbojXn0mWhkASaxhvGi0+FoZVdC8
+e2/zteL9+CvNbu5GcEBUc8oezHqD4gk+LuB9AjK0eIjleXC6foe4zDkAVrh961sf
+35tPHa0GdSQeIjOJu9ws+qskkv8dU4nhDLjvpe74q6zLm0B5CX4ZcHtbB3X1cwg6
+x8YZDbouHg35Ivd18IGK8qxy8KGKB83S9gtWGYLrLVpo/IVqJXf6NLe2AeMmhDyC
+7/alDejT+WhE2cvwbiVXKps7wGm8SdtH/5CFCsZo6DEmaGHV2ZCXPwHWyqC31LmN
+jrLs+EPs2Cl/j6W8bUFIECh5RZderSLXyDF657Y+hfy02m6hGT6yyVbTapT8CTlB
+ixCGAS27GdkqNoJw6TlLAgMBAAE=
+-----END PUBLIC KEY-----

From 98191d3c90c9d535340db2b9373ee92e0a252f6e Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Mon, 17 Nov 2025 17:03:49 -0700
Subject: [PATCH 06/29] Cleanup

---
 src/main/java/io/fusionauth/der/ObjectIdentifier.java | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/main/java/io/fusionauth/der/ObjectIdentifier.java b/src/main/java/io/fusionauth/der/ObjectIdentifier.java
index bc16ffb6..66180c7d 100644
--- a/src/main/java/io/fusionauth/der/ObjectIdentifier.java
+++ b/src/main/java/io/fusionauth/der/ObjectIdentifier.java
@@ -54,11 +54,6 @@ public class ObjectIdentifier implements Buildable<ObjectIdentifier> {
    */
   public static final String EdDSA_25519 = "1.3.101.112";
 
-  /**
-   * RSA Public Key cryptography Signature Scheme with Appendix - Probabilistic Signature Scheme
-   */
-  public static final String RSASSA_PSS_ENCRYPTION = "1.2.840.113549.1.1.10";
-
   /**
    * Edwards-curve Digital Signature Algorithm (EdDSA) Ed448
    */
@@ -69,6 +64,11 @@ public class ObjectIdentifier implements Buildable<ObjectIdentifier> {
    */
   public static final String RSA_ENCRYPTION = "1.2.840.113549.1.1.1";
 
+  /**
+   * RSA Public Key cryptography Signature Scheme with Appendix - Probabilistic Signature Scheme
+   */
+  public static final String RSASSA_PSS_ENCRYPTION = "1.2.840.113549.1.1.10";
+
   /**
    * RSA Encryption / SHA-256 / SHA256withRSA
    */

From 1c588385b5a5e48f870721b92a516b42e45aa2d5 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Mon, 17 Nov 2025 20:51:01 -0700
Subject: [PATCH 07/29] Working

---
 .../io/fusionauth/jwks/JSONWebKeyBuilder.java |  82 +++-----------
 src/main/java/io/fusionauth/jwt/JWTUtils.java |  10 ++
 .../java/io/fusionauth/pem/PEMDecoder.java    | 100 +++++++-----------
 .../java/io/fusionauth/pem/PEMEncoder.java    |  10 +-
 .../java/io/fusionauth/security/KeyUtils.java |  74 +++++++++++++
 .../fusionauth/der/ObjectIdentifierTest.java  |   7 +-
 .../io/fusionauth/jwt/ed/EdDSASignerTest.java |  17 ++-
 .../resources/ed_dsa_ed25519_private_key.pem  |   6 +-
 .../resources/eddsa_ed448_private_key.pem     |   4 +
 .../eddsa_ed448_private_key_pkcs8.pem         |   4 +
 src/test/resources/eddsa_ed448_public_key.pem |   4 +
 11 files changed, 172 insertions(+), 146 deletions(-)
 create mode 100644 src/test/resources/eddsa_ed448_private_key.pem
 create mode 100644 src/test/resources/eddsa_ed448_private_key_pkcs8.pem
 create mode 100644 src/test/resources/eddsa_ed448_public_key.pem

diff --git a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
index 7ce4f73e..a4f5daa1 100644
--- a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
+++ b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
@@ -18,7 +18,6 @@
 
 import io.fusionauth.der.DerDecodingException;
 import io.fusionauth.der.DerInputStream;
-import io.fusionauth.der.DerValue;
 import io.fusionauth.jwks.domain.JSONWebKey;
 import io.fusionauth.jwt.JWTUtils;
 import io.fusionauth.jwt.domain.Algorithm;
@@ -26,15 +25,10 @@
 import io.fusionauth.pem.domain.PEM;
 import io.fusionauth.security.KeyUtils;
 
-import java.io.IOException;
 import java.math.BigInteger;
-import java.security.InvalidAlgorithmParameterException;
 import java.security.Key;
-import java.security.KeyPairGenerator;
-import java.security.NoSuchAlgorithmException;
 import java.security.PrivateKey;
 import java.security.PublicKey;
-import java.security.SecureRandom;
 import java.security.cert.Certificate;
 import java.security.cert.CertificateEncodingException;
 import java.security.cert.X509Certificate;
@@ -42,21 +36,13 @@
 import java.security.interfaces.ECPrivateKey;
 import java.security.interfaces.ECPublicKey;
 import java.security.interfaces.EdECPrivateKey;
-import java.security.interfaces.EdECPublicKey;
 import java.security.interfaces.RSAPrivateCrtKey;
 import java.security.interfaces.RSAPrivateKey;
 import java.security.interfaces.RSAPublicKey;
-import java.security.spec.NamedParameterSpec;
-import java.util.Arrays;
 import java.util.Base64;
 import java.util.Collections;
 import java.util.Objects;
 
-import static io.fusionauth.der.ObjectIdentifier.ECDSA_P256;
-import static io.fusionauth.der.ObjectIdentifier.ECDSA_P384;
-import static io.fusionauth.der.ObjectIdentifier.ECDSA_P521;
-import static io.fusionauth.der.ObjectIdentifier.EdDSA_25519;
-import static io.fusionauth.der.ObjectIdentifier.EdDSA_448;
 import static io.fusionauth.jwks.JWKUtils.base64EncodeUint;
 
 /**
@@ -143,12 +129,25 @@ public JSONWebKey build(PrivateKey privateKey) {
 
       var privateKeyBytes = edPrivateKey.getBytes().orElseThrow(() -> new JSONWebKeyBuilderException("Unable to obtain the private key bytes."));
       key.d = Base64.getUrlEncoder().withoutPadding().encodeToString(privateKeyBytes);
-      key.x = Base64.getUrlEncoder().withoutPadding().encodeToString(generateEdDSAPublicKeyFromPrivate(privateKeyBytes, key.crv));
+      try {
+        byte[] publicKeyBytes = KeyUtils.deriveEdDSAPublicKeyFromPrivate(privateKeyBytes, key.crv);
+        key.x = Base64.getUrlEncoder().withoutPadding().encodeToString(publicKeyBytes);
+      } catch (Exception e) {
+        throw new JSONWebKeyBuilderException("Unable to build the public key for the EdDSA private key using curve [" + key.crv + "]", e);
+      }
     }
 
     return key;
   }
 
+  private String getCurveOID(Key key) {
+    try {
+      return KeyUtils.getCurveOID(key);
+    } catch (Exception e) {
+      throw new JSONWebKeyBuilderException("Unable to read the Object Identifier of the public key.", e);
+    }
+  }
+
   /**
    * Build a JSON Web Key from the provided PublicKey.
    *
@@ -230,31 +229,6 @@ private KeyType getKeyType(Key key) {
 
   }
 
-  private String readCurveObjectIdentifier(Key key) {
-    try {
-      DerValue[] sequence = new DerInputStream(key.getEncoded()).getSequence();
-      if (key instanceof PrivateKey) {
-        if (key instanceof EdECPrivateKey) {
-          return sequence[1].getOID().decode();
-        }
-
-        // Read the first value in the sequence, it is the algorithm OID, the second will be the curve
-        sequence[1].getOID();
-        return sequence[1].getOID().decode();
-      } else {
-        if (key instanceof EdECPublicKey) {
-          return sequence[0].getOID().decode();
-        }
-
-        // Read the first value in the sequence, it is the algorithm OID, the second will be the curve
-        sequence[0].getOID();
-        return sequence[0].getOID().decode();
-      }
-    } catch (IOException e) {
-      throw new JSONWebKeyBuilderException("Unable to read the Object Identifier of the public key.", e);
-    }
-  }
-
   private BigInteger extractX(byte[] bytes) {
     var is = new DerInputStream(bytes);
     try {
@@ -264,32 +238,4 @@ private BigInteger extractX(byte[] bytes) {
       throw new JSONWebKeyBuilderException("Unable to read x coordinate from the public key.", e);
     }
   }
-
-  private byte[] generateEdDSAPublicKeyFromPrivate(byte[] privateKey, String curve) {
-    try {
-      KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(curve);
-      keyPairGenerator.initialize(new NamedParameterSpec(curve), new SecureRandom() {
-        public void nextBytes(byte[] bytes) {
-          System.arraycopy(privateKey, 0, bytes, 0, privateKey.length);
-        }
-      });
-      byte[] spki = keyPairGenerator.generateKeyPair().getPublic().getEncoded();
-      return Arrays.copyOfRange(spki, spki.length - privateKey.length, spki.length);
-    } catch (InvalidAlgorithmParameterException | NoSuchAlgorithmException e) {
-      throw new JSONWebKeyBuilderException("Unable to build the public key for the EdDSA private key using curve [" + curve + "]", e);
-    }
-  }
-
-  private String getCurveOID(Key key) {
-    // Match up the Curve Object Identifier to a string value
-    String oid = readCurveObjectIdentifier(key);
-    return switch (oid) {
-      case ECDSA_P256 -> "P-256";
-      case ECDSA_P384 -> "P-384";
-      case ECDSA_P521 -> "P-521";
-      case EdDSA_25519 -> "Ed25519";
-      case EdDSA_448 -> "Ed448";
-      default -> null;
-    };
-  }
 }
diff --git a/src/main/java/io/fusionauth/jwt/JWTUtils.java b/src/main/java/io/fusionauth/jwt/JWTUtils.java
index 246b7711..283a4040 100644
--- a/src/main/java/io/fusionauth/jwt/JWTUtils.java
+++ b/src/main/java/io/fusionauth/jwt/JWTUtils.java
@@ -193,10 +193,20 @@ public static KeyPair generate521_ECKeyPair() {
     return generateKeyPair("EC", 521);
   }
 
+  /**
+   * Generate a new public / private key pair using the Ed25529 curve.
+   *
+   * @return a public and private key PEM in their respective X.509 and PKCS#8 key formats.
+   */
   public static KeyPair generate_ed25519_EdDSAKeyPair() {
     return generateKeyPair("ed25519", null);
   }
 
+  /**
+   * Generate a new public / private key pair using the Ed448 curve.
+   *
+   * @return a public and private key PEM in their respective X.509 and PKCS#8 key formats.
+   */
   public static KeyPair generate_ed448_EdDSAKeyPair() {
     return generateKeyPair("ed448", null);
   }
diff --git a/src/main/java/io/fusionauth/pem/PEMDecoder.java b/src/main/java/io/fusionauth/pem/PEMDecoder.java
index 51479ff3..7325737b 100644
--- a/src/main/java/io/fusionauth/pem/PEMDecoder.java
+++ b/src/main/java/io/fusionauth/pem/PEMDecoder.java
@@ -21,15 +21,16 @@
 import io.fusionauth.der.DerValue;
 import io.fusionauth.der.ObjectIdentifier;
 import io.fusionauth.der.Tag;
-import io.fusionauth.jwt.domain.Algorithm;
 import io.fusionauth.jwt.domain.KeyType;
 import io.fusionauth.pem.domain.PEM;
+import io.fusionauth.security.KeyUtils;
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.math.BigInteger;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.security.InvalidAlgorithmParameterException;
 import java.security.InvalidKeyException;
 import java.security.InvalidParameterException;
 import java.security.KeyFactory;
@@ -124,59 +125,12 @@ public PEM decode(String encodedKey) {
       } else {
         throw new PEMDecoderException(new InvalidParameterException("Unexpected PEM Format"));
       }
-    } catch (CertificateException | InvalidKeyException | InvalidKeySpecException | IOException |
-             NoSuchAlgorithmException e) {
+    } catch (CertificateException | InvalidAlgorithmParameterException | InvalidKeyException | InvalidKeySpecException |
+             IOException | NoSuchAlgorithmException e) {
       throw new PEMDecoderException(e);
     }
   }
 
-//  private PEM decode_ed_key(byte[] bytes) {
-  //
-  // Inpput: MC4CAQAwBQYDK2VwBCIEIIJtJBnTuKbIy5YjoNiH95ky3DcA3kRB0I2i7DkVM6Cf
-  //   -> https://lapo.it/asn1js/#MC4CAQAwBQYDK2VwBCIEIIJtJBnTuKbIy5YjoNiH95ky3DcA3kRB0I2i7DkVM6Cf
-
-  // Example w/out public key
-  //
-  // SEQUENCE (3 elem)
-  //   INTEGER 0
-  //   SEQUENCE (1 elem)
-  //     OBJECT IDENTIFIER 1.3.101.112 curveEd25519 (EdDSA 25519 signature algorithm)
-  //   OCTET STRING (34 byte) 0420826D2419D3B8A6C8CB9623A0D887F79932DC3700DE4441D08DA2EC391533A09F
-  //     OCTET STRING (32 byte) 826D2419D3B8A6C8CB9623A0D887F79932DC3700DE4441D08DA2EC391533A09F
-  //
-
-  // https://www.rfc-editor.org/rfc/rfc8410
-  // https://www.rfc-editor.org/rfc/rfc8410#section-10.3
-
-  // Example w/ public ke
-  //
-  // SEQUENCE (5 elem)
-  //   INTEGER 1
-  //   SEQUENCE (1 elem)
-  //     OBJECT IDENTIFIER 1.3.101.112 curveEd25519 (EdDSA 25519 signature algorithm)
-  //   OCTET STRING (34 byte) 0420D4EE72DBF913584AD5B6D8F1F769F8AD3AFE7C28CBF1D4FBE097A88F44755842
-  //     OCTET STRING (32 byte) D4EE72DBF913584AD5B6D8F1F769F8AD3AFE7C28CBF1D4FBE097A88F44755842
-  //   [0] (1 elem)
-  //     SEQUENCE (2 elem)
-  //       OBJECT IDENTIFIER 1.2.840.113549.1.9.9.20
-  //       SET (1 elem)
-  //         UTF8String Curdle Chairs
-  //   [1] (33 byte) 0019BF44096984CDFE8541BAC167DC3B96C85086AA30B6B6CB0C5C38AD703166E1
-
-  // Grab the public key
-//    DerValue[] sequence = new DerInputStream(bytes).getSequence();
-//    if (sequence.length == 5) {
-//      byte[] bytes = sequence[4].toByteArray();
-//      byte[] encodedPublicKey = getEncodedPublicKeyFromPrivate(bytes, privateKey.getEncoded());
-//      PublicKey publicKey = KeyFactory.getInstance(EdDSA.KeyType.algorithm)
-//          .generatePublic(new X509EncodedKeySpec(encodedPublicKey));
-//      return new PEM(privateKey, publicKey);
-//    } else {
-//      // The private key did not contain the public key
-//      return new PEM(privateKey);
-//    }
-//  }
-
   private PEM decode_EC_privateKey(String encodedKey) throws IOException, NoSuchAlgorithmException, InvalidKeySpecException {
     byte[] bytes = getKeyBytes(encodedKey, EC_PRIVATE_KEY_PREFIX, EC_PRIVATE_KEY_SUFFIX);
     DerValue[] sequence = new DerInputStream(bytes).getSequence();
@@ -304,7 +258,7 @@ private PEM decode_PKCS_1_Public(String encodedKey) throws IOException, NoSuchAl
     return new PEM(KeyFactory.getInstance("RSA").generatePublic(new RSAPublicKeySpec(modulus, publicExponent)));
   }
 
-  private PEM decode_PKCS_8(String encodedKey) throws NoSuchAlgorithmException, IOException, InvalidKeySpecException, InvalidKeyException {
+  private PEM decode_PKCS_8(String encodedKey) throws NoSuchAlgorithmException, IOException, InvalidKeySpecException, InvalidKeyException, InvalidAlgorithmParameterException {
     byte[] bytes = getKeyBytes(encodedKey, PKCS_8_PRIVATE_KEY_PREFIX, PKCS_8_PRIVATE_KEY_SUFFIX);
     DerValue[] sequence = new DerInputStream(bytes).getSequence();
 
@@ -351,18 +305,34 @@ private PEM decode_PKCS_8(String encodedKey) throws NoSuchAlgorithmException, IO
       BigInteger publicExponent = ((RSAPrivateCrtKey) privateKey).getPublicExponent();
       PublicKey publicKey = KeyFactory.getInstance("RSA").generatePublic(new RSAPublicKeySpec(modulus, publicExponent));
       return new PEM(privateKey, publicKey);
-    } else if (privateKey instanceof EdECPrivateKey) {
+    } else if (privateKey instanceof EdECPrivateKey edECPrivateKey) {
+
+      byte[] algorithmIdentifier = sequence[1].toByteArray();
+      byte[] publicKeyBytes;
+      byte[] derEncodedPublicKey;
       if (sequence.length >= 4) {
         int index = sequence.length - 1;
-        byte[] bitString = sequence[index].toByteArray();
-        byte[] encodedPublicKey = getEncodedPublicKeyFromPrivate(bitString, privateKey.getEncoded());
-        PublicKey publicKey = KeyFactory.getInstance(Algorithm.EdDSA.getName())
-            .generatePublic(new X509EncodedKeySpec(encodedPublicKey));
-        return new PEM(privateKey, publicKey);
+        publicKeyBytes = sequence[index].toByteArray();
+        derEncodedPublicKey = derEncodePublicKey(algorithmIdentifier, publicKeyBytes);
       } else {
-        // The private key did not contain the public key
-        return new PEM(privateKey);
+        // The private key did not contain the public key. The public key can be derived from the privat key.
+        String curve = KeyUtils.getCurveOID(privateKey);
+        publicKeyBytes = KeyUtils.deriveEdDSAPublicKeyFromPrivate(edECPrivateKey.getBytes().orElseThrow(), curve);
+
+        byte[] bitStringKeyBytes = new byte[publicKeyBytes.length + 1];
+        bitStringKeyBytes[0] = 0x0;
+        System.arraycopy(publicKeyBytes, 0, bitStringKeyBytes, 1, publicKeyBytes.length);
+        // [48, 67, 48, 5, 6, 3, 43, 101, 113, 3, 58, 0]
+        derEncodedPublicKey = new DerOutputStream()
+            .writeValue(new DerValue(Tag.Sequence, new DerOutputStream()
+                .writeValue(new DerValue(Tag.Sequence, algorithmIdentifier))
+                .writeValue(new DerValue(Tag.BitString, bitStringKeyBytes))))
+            .toByteArray();
       }
+
+      PublicKey publicKey = KeyFactory.getInstance(edECPrivateKey.getAlgorithm())
+          .generatePublic(new X509EncodedKeySpec(derEncodedPublicKey, edECPrivateKey.getAlgorithm()));
+      return new PEM(privateKey, publicKey);
     }
 
     return new PEM(privateKey);
@@ -409,17 +379,21 @@ private byte[] getKeyBytes(String key, String keyPrefix, String keySuffix) {
   }
 
   private byte[] getEncodedPublicKeyFromPrivate(byte[] bitString, byte[] encodedKey) throws IOException {
-    // Build an X.509 DER encoded byte array from the provided bitString
+    DerValue[] sequence = new DerInputStream(encodedKey).getSequence();
+    return derEncodePublicKey(sequence[1].toByteArray(), bitString);
+  }
+
+  private byte[] derEncodePublicKey(byte[] algorithmIdentifier, byte[] publicKeyBytes) throws IOException {
+    // Build an X.509 DER encoded byte array from the provided byte[]
     //
     // SubjectPublicKeyInfo ::= SEQUENCE {
     //   algorithm         AlgorithmIdentifier,
     //   subjectPublicKey  BIT STRING
     // }
-    DerValue[] sequence = new DerInputStream(encodedKey).getSequence();
     return new DerOutputStream()
         .writeValue(new DerValue(Tag.Sequence, new DerOutputStream()
-            .writeValue(new DerValue(Tag.Sequence, sequence[1].toByteArray()))
-            .writeValue(new DerValue(Tag.BitString, bitString))))
+            .writeValue(new DerValue(Tag.Sequence, algorithmIdentifier))
+            .writeValue(new DerValue(Tag.BitString, publicKeyBytes))))
         .toByteArray();
   }
 
diff --git a/src/main/java/io/fusionauth/pem/PEMEncoder.java b/src/main/java/io/fusionauth/pem/PEMEncoder.java
index 993e4127..f7e67c48 100644
--- a/src/main/java/io/fusionauth/pem/PEMEncoder.java
+++ b/src/main/java/io/fusionauth/pem/PEMEncoder.java
@@ -35,6 +35,7 @@
 import java.util.ArrayList;
 import java.util.Base64;
 import java.util.List;
+import java.util.Objects;
 
 import static io.fusionauth.pem.domain.PEM.X509_CERTIFICATE_PREFIX;
 import static io.fusionauth.pem.domain.PEM.X509_CERTIFICATE_SUFFIX;
@@ -86,7 +87,7 @@ private String chopIt(String s) {
    * If <code>null</code> is passed for one of the two parameters, a PEM will be returned that only includes the non-null
    * value.
    * <p>
-   * Both values may no be null.
+   * Both values may not be null.
    *
    * @param privateKey the private key
    * @param publicKey  the public key
@@ -98,12 +99,7 @@ public String encode(PrivateKey privateKey, PublicKey publicKey) {
     }
 
     Key key;
-    if (privateKey == null) {
-      key = publicKey;
-    } else {
-      key = privateKey;
-    }
-
+    key = Objects.requireNonNullElse(privateKey, publicKey);
     StringBuilder sb = new StringBuilder();
     addOpeningTag(key, sb);
     try {
diff --git a/src/main/java/io/fusionauth/security/KeyUtils.java b/src/main/java/io/fusionauth/security/KeyUtils.java
index 82dadc8e..021c60e5 100644
--- a/src/main/java/io/fusionauth/security/KeyUtils.java
+++ b/src/main/java/io/fusionauth/security/KeyUtils.java
@@ -16,7 +16,16 @@
 
 package io.fusionauth.security;
 
+import io.fusionauth.der.DerInputStream;
+import io.fusionauth.der.DerValue;
+
+import java.io.IOException;
+import java.security.InvalidAlgorithmParameterException;
 import java.security.Key;
+import java.security.KeyPairGenerator;
+import java.security.NoSuchAlgorithmException;
+import java.security.PrivateKey;
+import java.security.SecureRandom;
 import java.security.interfaces.ECKey;
 import java.security.interfaces.ECPrivateKey;
 import java.security.interfaces.ECPublicKey;
@@ -24,12 +33,77 @@
 import java.security.interfaces.EdECPrivateKey;
 import java.security.interfaces.EdECPublicKey;
 import java.security.interfaces.RSAKey;
+import java.security.spec.NamedParameterSpec;
+import java.util.Arrays;
+
+import static io.fusionauth.der.ObjectIdentifier.ECDSA_P256;
+import static io.fusionauth.der.ObjectIdentifier.ECDSA_P384;
+import static io.fusionauth.der.ObjectIdentifier.ECDSA_P521;
+import static io.fusionauth.der.ObjectIdentifier.EdDSA_25519;
+import static io.fusionauth.der.ObjectIdentifier.EdDSA_448;
 
 /**
  * @author Daniel DeGroff
  */
 public class KeyUtils {
 
+  /**
+   *
+   * @param key the key
+   * @return the name of the curve used by the key or null if it cannot be identified.
+   */
+  public static String getCurveOID(Key key) throws IOException {
+    // Match up the Curve Object Identifier to a string value
+    String oid = readCurveObjectIdentifier(key);
+    return switch (oid) {
+      case ECDSA_P256 -> "P-256";
+      case ECDSA_P384 -> "P-384";
+      case ECDSA_P521 -> "P-521";
+      case EdDSA_25519 -> "Ed25519";
+      case EdDSA_448 -> "Ed448";
+      default -> null;
+    };
+  }
+
+  private static String readCurveObjectIdentifier(Key key) throws IOException {
+    DerValue[] sequence = new DerInputStream(key.getEncoded()).getSequence();
+    if (key instanceof PrivateKey) {
+      if (key instanceof EdECPrivateKey) {
+        return sequence[1].getOID().decode();
+      }
+
+      // Read the first value in the sequence, it is the algorithm OID, the second will be the curve
+      sequence[1].getOID();
+      return sequence[1].getOID().decode();
+    } else {
+      if (key instanceof EdECPublicKey) {
+        return sequence[0].getOID().decode();
+      }
+
+      // Read the first value in the sequence, it is the algorithm OID, the second will be the curve
+      sequence[0].getOID();
+      return sequence[0].getOID().decode();
+    }
+  }
+
+  /**
+   * Calculate the public key for the provided EdDSA private key.
+   *
+   * @param privateKey the private EdDSA key
+   * @param curve      the curve used by the private key
+   * @return the public key
+   */
+  public static byte[] deriveEdDSAPublicKeyFromPrivate(byte[] privateKey, String curve) throws NoSuchAlgorithmException, InvalidAlgorithmParameterException {
+    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(curve);
+    keyPairGenerator.initialize(new NamedParameterSpec(curve), new SecureRandom() {
+      public void nextBytes(byte[] bytes) {
+        System.arraycopy(privateKey, 0, bytes, 0, privateKey.length);
+      }
+    });
+    byte[] spki = keyPairGenerator.generateKeyPair().getPublic().getEncoded();
+    return Arrays.copyOfRange(spki, spki.length - privateKey.length, spki.length);
+  }
+
   /**
    * Return the length of the key in bits.
    *
diff --git a/src/test/java/io/fusionauth/der/ObjectIdentifierTest.java b/src/test/java/io/fusionauth/der/ObjectIdentifierTest.java
index 1f177ecb..fb6481a0 100644
--- a/src/test/java/io/fusionauth/der/ObjectIdentifierTest.java
+++ b/src/test/java/io/fusionauth/der/ObjectIdentifierTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -35,6 +35,11 @@ public void decode() throws Exception {
     assertEquals(decode(0x2B, 0x81, 0x04, 0x00, 0x22), "1.3.132.0.34");
     assertEquals(decode(0x2B, 0x81, 0x04, 0x00, 0x23), "1.3.132.0.35");
 
+    // EdDSA Ed25519
+    assertEquals(decode(0x2B, 0x65, 0x70), "1.3.101.112");
+    // EdDSA ed448
+    assertEquals(decode(0x2B, 0x65, 0x71), "1.3.101.113");
+
     // RSA
     assertEquals(decode(0x2A, 0x86, 0x48, 0x86, 0xF7, 0x0D, 0x01, 0x01, 0x01), "1.2.840.113549.1.1.1");
 
diff --git a/src/test/java/io/fusionauth/jwt/ed/EdDSASignerTest.java b/src/test/java/io/fusionauth/jwt/ed/EdDSASignerTest.java
index a2f787e8..e9b94f94 100644
--- a/src/test/java/io/fusionauth/jwt/ed/EdDSASignerTest.java
+++ b/src/test/java/io/fusionauth/jwt/ed/EdDSASignerTest.java
@@ -31,7 +31,6 @@
 
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertNull;
 import static org.testng.Assert.assertTrue;
 
 /**
@@ -46,11 +45,14 @@ public void canVerify() {
 
   @Test
   public void decodePrivateKey() throws Exception {
-    List<String> privateKeys = Arrays.asList(
+    List<String> privateKeys = List.of(
+        "ed_dsa_ed448_private_key.pem",
+        "eddsa_ed448_private_key.pem",
         "ed_dsa_ed25519_private_key.pem",
-        "ed_dsa_private_key.pem");
+        "ed_dsa_private_key.pem"
+    );
 
-    // These keys do not contain a public key
+    // These keys do not contain a public key. However, the public key can be produced from the private key for EdDSA.
     for (String f : privateKeys) {
       String message = "For file [" + f + "]";
       String encodedPEM = new String(Files.readAllBytes(Paths.get("src/test/resources/" + f)));
@@ -59,7 +61,10 @@ public void decodePrivateKey() throws Exception {
       PEM pem = PEM.decode(encodedPEM);
       assertNotNull(pem.privateKey, message);
       assertEquals(pem.privateKey.getFormat(), "PKCS#8", message);
-      assertNull(pem.publicKey, message);
+      assertNotNull(pem.publicKey, message);
+      assertEquals(pem.publicKey.getFormat(), "X.509", message);
+      String expectedAlgorithm = fipsEnabled ? (f.contains("ed448") ? "Ed448" : "Ed25519") : "EdDSA";
+      assertEquals(pem.publicKey.getAlgorithm(), expectedAlgorithm, message);
     }
 
     // Private keys that contain a public key
@@ -73,6 +78,8 @@ public void decodePrivateKey() throws Exception {
       assertEquals(pem.privateKey.getFormat(), "PKCS#8", message);
       assertNotNull(pem.publicKey, message);
       assertEquals(pem.publicKey.getFormat(), "X.509", message);
+      String expectedAlgorithm = fipsEnabled ? "Ed25519" : "EdDSA";
+      assertEquals(pem.publicKey.getAlgorithm(), expectedAlgorithm, message);
     }
   }
 
diff --git a/src/test/resources/ed_dsa_ed25519_private_key.pem b/src/test/resources/ed_dsa_ed25519_private_key.pem
index 17356b58..84961082 100644
--- a/src/test/resources/ed_dsa_ed25519_private_key.pem
+++ b/src/test/resources/ed_dsa_ed25519_private_key.pem
@@ -1,3 +1,5 @@
 -----BEGIN PRIVATE KEY-----
-MC4CAQAwBQYDK2VwBCIEIKuumyVdS3AhFAreOGHLYtT4O21YUYBibakGNzq2kcwi
------END PRIVATE KEY-----
\ No newline at end of file
+MHICAQEwBQYDK2VwBCIEINTuctv5E1hK1bbY8fdp+K06/nwoy/HU++CXqI9EdVhC
+oB8wHQYKKoZIhvcNAQkJFDEPDA1DdXJkbGUgQ2hhaXJzgSEAGb9ECWmEzf6FQbrB
+Z9w7lshQhqowtrbLDFw4rXAxZuE=
+-----END PRIVATE KEY-----
diff --git a/src/test/resources/eddsa_ed448_private_key.pem b/src/test/resources/eddsa_ed448_private_key.pem
new file mode 100644
index 00000000..d4188c91
--- /dev/null
+++ b/src/test/resources/eddsa_ed448_private_key.pem
@@ -0,0 +1,4 @@
+-----BEGIN PRIVATE KEY-----
+MEcCAQAwBQYDK2VxBDsEOfPaKOwyUy3zj6GNVbd15TM/dDqip4H1JI7sfEMT3UmM
+NzDIkqAEdojZa3KxNUgguoZDqmdwtfCYlQ==
+-----END PRIVATE KEY-----
diff --git a/src/test/resources/eddsa_ed448_private_key_pkcs8.pem b/src/test/resources/eddsa_ed448_private_key_pkcs8.pem
new file mode 100644
index 00000000..bbec7fe9
--- /dev/null
+++ b/src/test/resources/eddsa_ed448_private_key_pkcs8.pem
@@ -0,0 +1,4 @@
+-----BEGIN PRIVATE KEY-----
+MEcCAQAwBQYDK2VxBDsEOYlqvUFWVa3g3qywhvJF5Rsly4CS/K+2vbM3+fYvJWes
+GTr+9owAeV/hUJI1BmYIwvoFgyJF3dz7JQ==
+-----END PRIVATE KEY-----
diff --git a/src/test/resources/eddsa_ed448_public_key.pem b/src/test/resources/eddsa_ed448_public_key.pem
new file mode 100644
index 00000000..a5348547
--- /dev/null
+++ b/src/test/resources/eddsa_ed448_public_key.pem
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MEMwBQYDK2VxAzoA/pL1a9MsvdXgVpFpfJVEefmtYqdh7wHupmVvQg5nYPtfbDc2
+DZIxtAEGw4irOf4VolCmc8n+JjcA
+-----END PUBLIC KEY-----

From c42ec93dac63399680d4e429a193df0cea726f2e Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Mon, 17 Nov 2025 20:56:04 -0700
Subject: [PATCH 08/29] Working

---
 .../java/io/fusionauth/pem/PEMDecoder.java    |  1 -
 .../io/fusionauth/jwt/ed/EdDSASignerTest.java | 68 -------------------
 .../fusionauth/jwt/ed/EdDSAVerifierTest.java  | 36 ++++------
 .../jwk/ed_dsa_ed25519_private_key.json       |  8 +--
 4 files changed, 16 insertions(+), 97 deletions(-)

diff --git a/src/main/java/io/fusionauth/pem/PEMDecoder.java b/src/main/java/io/fusionauth/pem/PEMDecoder.java
index 7325737b..7f538a37 100644
--- a/src/main/java/io/fusionauth/pem/PEMDecoder.java
+++ b/src/main/java/io/fusionauth/pem/PEMDecoder.java
@@ -322,7 +322,6 @@ private PEM decode_PKCS_8(String encodedKey) throws NoSuchAlgorithmException, IO
         byte[] bitStringKeyBytes = new byte[publicKeyBytes.length + 1];
         bitStringKeyBytes[0] = 0x0;
         System.arraycopy(publicKeyBytes, 0, bitStringKeyBytes, 1, publicKeyBytes.length);
-        // [48, 67, 48, 5, 6, 3, 43, 101, 113, 3, 58, 0]
         derEncodedPublicKey = new DerOutputStream()
             .writeValue(new DerValue(Tag.Sequence, new DerOutputStream()
                 .writeValue(new DerValue(Tag.Sequence, algorithmIdentifier))
diff --git a/src/test/java/io/fusionauth/jwt/ed/EdDSASignerTest.java b/src/test/java/io/fusionauth/jwt/ed/EdDSASignerTest.java
index e9b94f94..3698e019 100644
--- a/src/test/java/io/fusionauth/jwt/ed/EdDSASignerTest.java
+++ b/src/test/java/io/fusionauth/jwt/ed/EdDSASignerTest.java
@@ -19,88 +19,20 @@
 import io.fusionauth.jwt.BaseJWTTest;
 import io.fusionauth.jwt.Signer;
 import io.fusionauth.jwt.Verifier;
-import io.fusionauth.jwt.domain.Algorithm;
 import io.fusionauth.jwt.domain.JWT;
 import io.fusionauth.pem.domain.PEM;
 import org.testng.annotations.Test;
 
 import java.nio.file.Files;
 import java.nio.file.Paths;
-import java.util.Arrays;
-import java.util.List;
 
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertTrue;
 
 /**
  * @author Daniel DeGroff
  */
 public class EdDSASignerTest extends BaseJWTTest {
-  @Test
-  public void canVerify() {
-    Verifier verifier = EdDSAVerifier.newVerifier(getPath("ed_dsa_public_key.pem"));
-    assertTrue(verifier.canVerify(Algorithm.EdDSA));
-  }
-
-  @Test
-  public void decodePrivateKey() throws Exception {
-    List<String> privateKeys = List.of(
-        "ed_dsa_ed448_private_key.pem",
-        "eddsa_ed448_private_key.pem",
-        "ed_dsa_ed25519_private_key.pem",
-        "ed_dsa_private_key.pem"
-    );
-
-    // These keys do not contain a public key. However, the public key can be produced from the private key for EdDSA.
-    for (String f : privateKeys) {
-      String message = "For file [" + f + "]";
-      String encodedPEM = new String(Files.readAllBytes(Paths.get("src/test/resources/" + f)));
-      assertTrue(encodedPEM.contains(PEM.PKCS_8_PRIVATE_KEY_PREFIX), message);
-
-      PEM pem = PEM.decode(encodedPEM);
-      assertNotNull(pem.privateKey, message);
-      assertEquals(pem.privateKey.getFormat(), "PKCS#8", message);
-      assertNotNull(pem.publicKey, message);
-      assertEquals(pem.publicKey.getFormat(), "X.509", message);
-      String expectedAlgorithm = fipsEnabled ? (f.contains("ed448") ? "Ed448" : "Ed25519") : "EdDSA";
-      assertEquals(pem.publicKey.getAlgorithm(), expectedAlgorithm, message);
-    }
-
-    // Private keys that contain a public key
-    for (String f : List.of("ed_dsa_ed25519_private_key_pub.pem")) {
-      String message = "For file [" + f + "]";
-      String encodedPEM = new String(Files.readAllBytes(Paths.get("src/test/resources/" + f)));
-      assertTrue(encodedPEM.contains(PEM.PKCS_8_PRIVATE_KEY_PREFIX), message);
-
-      PEM pem = PEM.decode(encodedPEM);
-      assertNotNull(pem.privateKey, message);
-      assertEquals(pem.privateKey.getFormat(), "PKCS#8", message);
-      assertNotNull(pem.publicKey, message);
-      assertEquals(pem.publicKey.getFormat(), "X.509", message);
-      String expectedAlgorithm = fipsEnabled ? "Ed25519" : "EdDSA";
-      assertEquals(pem.publicKey.getAlgorithm(), expectedAlgorithm, message);
-    }
-  }
-
-  @Test
-  public void decodePublicKey() throws Exception {
-    List<String> publicKeys = Arrays.asList(
-        "ed_dsa_ed25519_public_key.pem",
-        "ed_dsa_public_key.pem");
-
-    for (String f : publicKeys) {
-      String message = "For file [" + f + "]";
-      String encodedPEM = new String(Files.readAllBytes(Paths.get("src/test/resources/" + f)));
-      assertTrue(encodedPEM.contains(PEM.X509_PUBLIC_KEY_PREFIX), message);
-      assertTrue(encodedPEM.contains(PEM.X509_PUBLIC_KEY_SUFFIX), message);
-
-      PEM pem = PEM.decode(encodedPEM);
-      assertNotNull(pem.publicKey, message);
-      assertEquals(pem.publicKey.getFormat(), "X.509", message);
-    }
-  }
-
   @Test
   public void signAndVerify() throws Exception {
     JWT jwt = new JWT().setSubject("1234567890");
diff --git a/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java b/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java
index c31fcd8f..48a1fe52 100644
--- a/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java
+++ b/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java
@@ -17,10 +17,8 @@
 package io.fusionauth.jwt.ed;
 
 import io.fusionauth.jwt.BaseJWTTest;
-import io.fusionauth.jwt.Signer;
 import io.fusionauth.jwt.Verifier;
 import io.fusionauth.jwt.domain.Algorithm;
-import io.fusionauth.jwt.domain.JWT;
 import io.fusionauth.pem.domain.PEM;
 import org.testng.annotations.Test;
 
@@ -31,7 +29,6 @@
 
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
-import static org.testng.Assert.assertNull;
 import static org.testng.Assert.assertTrue;
 
 /**
@@ -54,12 +51,14 @@ public void canVerify() {
 
   @Test
   public void decodePrivateKey() throws Exception {
-    List<String> privateKeys = Arrays.asList(
-        "ed_dsa_ed25519_private_key.pem",
+    List<String> privateKeys = List.of(
         "ed_dsa_ed448_private_key.pem",
-        "ed_dsa_private_key.pem");
+        "eddsa_ed448_private_key.pem",
+        "ed_dsa_ed25519_private_key.pem",
+        "ed_dsa_private_key.pem"
+    );
 
-    // These keys do not contain a public key
+    // These keys do not contain a public key. However, the public key can be produced from the private key for EdDSA.
     for (String f : privateKeys) {
       String message = "For file [" + f + "]";
       String encodedPEM = new String(Files.readAllBytes(Paths.get("src/test/resources/" + f)));
@@ -68,7 +67,10 @@ public void decodePrivateKey() throws Exception {
       PEM pem = PEM.decode(encodedPEM);
       assertNotNull(pem.privateKey, message);
       assertEquals(pem.privateKey.getFormat(), "PKCS#8", message);
-      assertNull(pem.publicKey, message);
+      assertNotNull(pem.publicKey, message);
+      assertEquals(pem.publicKey.getFormat(), "X.509", message);
+      String expectedAlgorithm = fipsEnabled ? (f.contains("ed448") ? "Ed448" : "Ed25519") : "EdDSA";
+      assertEquals(pem.publicKey.getAlgorithm(), expectedAlgorithm, message);
     }
 
     // Private keys that contain a public key
@@ -82,6 +84,8 @@ public void decodePrivateKey() throws Exception {
       assertEquals(pem.privateKey.getFormat(), "PKCS#8", message);
       assertNotNull(pem.publicKey, message);
       assertEquals(pem.publicKey.getFormat(), "X.509", message);
+      String expectedAlgorithm = fipsEnabled ? "Ed25519" : "EdDSA";
+      assertEquals(pem.publicKey.getAlgorithm(), expectedAlgorithm, message);
     }
   }
 
@@ -103,20 +107,4 @@ public void decodePublicKey() throws Exception {
       assertEquals(pem.publicKey.getFormat(), "X.509", message);
     }
   }
-
-  @Test
-  public void signAndVerify() throws Exception {
-    JWT jwt = new JWT().setSubject("1234567890");
-
-    // Sign the JWT
-    Signer signer = EdDSASigner.newSigner(new String(Files.readAllBytes(Paths.get("src/test/resources/ed_dsa_private_key.pem"))));
-    String encodedJWT = JWT.getEncoder().encode(jwt, signer);
-
-    // Verify the JWT
-    Verifier verifier = EdDSAVerifier.newVerifier(Paths.get("src/test/resources/ed_dsa_public_key.pem"));
-    JWT actual = JWT.getDecoder().decode(encodedJWT, verifier);
-
-    assertEquals(actual.subject, jwt.subject);
-    assertEquals(actual.header.algorithm.name(), "EdDSA");
-  }
 }
diff --git a/src/test/resources/jwk/ed_dsa_ed25519_private_key.json b/src/test/resources/jwk/ed_dsa_ed25519_private_key.json
index 126073f3..dbf36e76 100644
--- a/src/test/resources/jwk/ed_dsa_ed25519_private_key.json
+++ b/src/test/resources/jwk/ed_dsa_ed25519_private_key.json
@@ -1,8 +1,8 @@
 {
-  "kty": "OKP",
   "alg": "EdDSA",
   "crv": "Ed25519",
-  "x": "un73P2PfgPZTvbRvlHjVkjhqUhAQOVC1wRa-vmX-dIc",
-  "d": "q66bJV1LcCEUCt44Ycti1Pg7bVhRgGJtqQY3OraRzCI",
-  "use": "sig"
+  "d": "1O5y2_kTWErVttjx92n4rTr-fCjL8dT74Jeoj0R1WEI",
+  "kty": "OKP",
+  "use": "sig",
+  "x": "Gb9ECWmEzf6FQbrBZ9w7lshQhqowtrbLDFw4rXAxZuE"
 }

From 7e92dcd5f8163a89d9f30a9ba5dc247e82b19964 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Mon, 17 Nov 2025 21:55:54 -0700
Subject: [PATCH 09/29] Working

---
 build.savant                                  |  4 +--
 src/test/java/io/fusionauth/BaseTest.java     | 26 +++++++++----------
 .../java/io/fusionauth/jwt/JWTUtilsTest.java  |  8 +++---
 .../fusionauth/jwt/ed/EdDSAVerifierTest.java  |  6 ++---
 4 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/build.savant b/build.savant
index 96993ef2..05dc0138 100644
--- a/build.savant
+++ b/build.savant
@@ -100,8 +100,8 @@ target(name: "test", description: "Runs the project's tests", dependsOn: ["jar"]
   // javaTestNG.settings.jvmArguments += "-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=5005"
 
   // Run the test suite twice, one with BC fips enabled, and once w/out.
-  [false, true].each { type ->
-    javaTestNG.settings.jvmArguments = "-Dtest.fips=${type}"
+  [false, true].each { enabled ->
+    javaTestNG.settings.jvmArguments = "-Dtest.fips=${enabled}"
     javaTestNG.test()
   }
 }
diff --git a/src/test/java/io/fusionauth/BaseTest.java b/src/test/java/io/fusionauth/BaseTest.java
index 9a877ea5..a43a6515 100644
--- a/src/test/java/io/fusionauth/BaseTest.java
+++ b/src/test/java/io/fusionauth/BaseTest.java
@@ -32,11 +32,23 @@
  * @author Daniel DeGroff
  */
 public abstract class BaseTest {
+  public static boolean FipsEnabled;
+
   public List<BuilderHTTPHandler> httpHandlers = new ArrayList<>();
 
   public List<HttpServer> httpServers = new ArrayList<>();
 
-  public boolean fipsEnabled;
+  @BeforeSuite
+  public void beforeSuite() {
+    FipsEnabled = Boolean.getBoolean("test.fips");
+    if (FipsEnabled) {
+      System.out.println("Testing in FIPS mode");
+      System.setProperty("org.bouncycastle.fips.approved_only", "true");
+      Security.insertProviderAt(new BouncyCastleFipsProvider(), 1);
+    } else {
+      System.out.println("Testing in default JCA mode");
+    }
+  }
 
   @AfterMethod
   public void afterMethod(ITestResult result) {
@@ -48,18 +60,6 @@ public void afterMethod(ITestResult result) {
     }
   }
 
-  @BeforeSuite
-  public void beforeSuite() {
-    fipsEnabled = Boolean.getBoolean("test.fips");
-    if (fipsEnabled) {
-      System.out.println("Testing in FIPS mode");
-      System.setProperty("org.bouncycastle.fips.approved_only", "true");
-      Security.insertProviderAt(new BouncyCastleFipsProvider(), 1);
-    } else {
-      System.out.println("Testing in default JCA mode");
-    }
-  }
-
   protected void startHttpServer(ThrowingConsumer<HttpServerBuilder> consumer) throws Exception {
     HttpServerBuilder builder = new HttpServerBuilder();
     consumer.accept(builder);
diff --git a/src/test/java/io/fusionauth/jwt/JWTUtilsTest.java b/src/test/java/io/fusionauth/jwt/JWTUtilsTest.java
index 4ae572d8..e8a40b96 100644
--- a/src/test/java/io/fusionauth/jwt/JWTUtilsTest.java
+++ b/src/test/java/io/fusionauth/jwt/JWTUtilsTest.java
@@ -148,12 +148,12 @@ public void generate_ed25519_EdDSAKeyPair() {
     EdECPrivateKey privateKey = PEM.decode(keyPair.privateKey).getPrivateKey();
     EdECPublicKey publicKey = PEM.decode(keyPair.publicKey).getPublicKey();
 
-    assertEquals(privateKey.getAlgorithm(), fipsEnabled ? "Ed25519" : "EdDSA");
+    assertEquals(privateKey.getAlgorithm(), FipsEnabled ? "Ed25519" : "EdDSA");
     assertEquals(privateKey.getFormat(), "PKCS#8");
     assertEquals(privateKey.getParams().getName(), "Ed25519");
     assertEquals(privateKey.getBytes().orElseThrow().length, 32);
 
-    assertEquals(publicKey.getAlgorithm(), fipsEnabled ? "Ed25519" : "EdDSA");
+    assertEquals(publicKey.getAlgorithm(), FipsEnabled ? "Ed25519" : "EdDSA");
     assertEquals(publicKey.getFormat(), "X.509");
   }
 
@@ -163,12 +163,12 @@ public void generate_ed448_EdDSAKeyPair() {
     EdECPrivateKey privateKey = PEM.decode(keyPair.privateKey).getPrivateKey();
     EdECPublicKey publicKey = PEM.decode(keyPair.publicKey).getPublicKey();
 
-    assertEquals(privateKey.getAlgorithm(), fipsEnabled ? "Ed448" : "EdDSA");
+    assertEquals(privateKey.getAlgorithm(), FipsEnabled ? "Ed448" : "EdDSA");
     assertEquals(privateKey.getFormat(), "PKCS#8");
     assertEquals(privateKey.getParams().getName(), "Ed448");
     assertEquals(privateKey.getBytes().orElseThrow().length, 57);
 
-    assertEquals(publicKey.getAlgorithm(), fipsEnabled ? "Ed448" : "EdDSA");
+    assertEquals(publicKey.getAlgorithm(), FipsEnabled ? "Ed448" : "EdDSA");
     assertEquals(publicKey.getFormat(), "X.509");
   }
 
diff --git a/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java b/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java
index 48a1fe52..6005c91c 100644
--- a/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java
+++ b/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java
@@ -60,7 +60,7 @@ public void decodePrivateKey() throws Exception {
 
     // These keys do not contain a public key. However, the public key can be produced from the private key for EdDSA.
     for (String f : privateKeys) {
-      String message = "For file [" + f + "]";
+      String message = "For file [" + f + "] Fips enabled [" + FipsEnabled + "]";
       String encodedPEM = new String(Files.readAllBytes(Paths.get("src/test/resources/" + f)));
       assertTrue(encodedPEM.contains(PEM.PKCS_8_PRIVATE_KEY_PREFIX), message);
 
@@ -69,7 +69,7 @@ public void decodePrivateKey() throws Exception {
       assertEquals(pem.privateKey.getFormat(), "PKCS#8", message);
       assertNotNull(pem.publicKey, message);
       assertEquals(pem.publicKey.getFormat(), "X.509", message);
-      String expectedAlgorithm = fipsEnabled ? (f.contains("ed448") ? "Ed448" : "Ed25519") : "EdDSA";
+      String expectedAlgorithm = FipsEnabled ? (f.contains("ed448") ? "Ed448" : "Ed25519") : "EdDSA";
       assertEquals(pem.publicKey.getAlgorithm(), expectedAlgorithm, message);
     }
 
@@ -84,7 +84,7 @@ public void decodePrivateKey() throws Exception {
       assertEquals(pem.privateKey.getFormat(), "PKCS#8", message);
       assertNotNull(pem.publicKey, message);
       assertEquals(pem.publicKey.getFormat(), "X.509", message);
-      String expectedAlgorithm = fipsEnabled ? "Ed25519" : "EdDSA";
+      String expectedAlgorithm = FipsEnabled ? "Ed25519" : "EdDSA";
       assertEquals(pem.publicKey.getAlgorithm(), expectedAlgorithm, message);
     }
   }

From 6b897d87025dbfc2002dd00ddf4b43334e7d2b7a Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Mon, 17 Nov 2025 22:08:53 -0700
Subject: [PATCH 10/29] Working

---
 src/test/java/io/fusionauth/BaseTest.java | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/test/java/io/fusionauth/BaseTest.java b/src/test/java/io/fusionauth/BaseTest.java
index a43a6515..1b94b55b 100644
--- a/src/test/java/io/fusionauth/BaseTest.java
+++ b/src/test/java/io/fusionauth/BaseTest.java
@@ -42,12 +42,13 @@ public abstract class BaseTest {
   public void beforeSuite() {
     FipsEnabled = Boolean.getBoolean("test.fips");
     if (FipsEnabled) {
-      System.out.println("Testing in FIPS mode");
       System.setProperty("org.bouncycastle.fips.approved_only", "true");
       Security.insertProviderAt(new BouncyCastleFipsProvider(), 1);
-    } else {
-      System.out.println("Testing in default JCA mode");
     }
+
+    System.out.printf("Testing in %s mode with security provider [%s]%n",
+        FipsEnabled ? "FIPS" : "the default JCA",
+        Security.getProviders()[0].getClass().getCanonicalName());
   }
 
   @AfterMethod

From 96fafa22055cee5958a329ac2efb32c06afeeb2b Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Tue, 18 Nov 2025 15:28:26 -0700
Subject: [PATCH 11/29] Working

---
 README.md                                     | 19 +++--
 fusionauth-jwt.ipr                            | 10 +++
 .../io/fusionauth/jwks/JSONWebKeyBuilder.java | 27 +++++--
 .../io/fusionauth/jwks/JSONWebKeyParser.java  | 47 +++++++++---
 .../java/io/fusionauth/pem/PEMDecoder.java    |  2 +-
 .../java/io/fusionauth/security/KeyUtils.java | 21 +++---
 .../jwks/JSONWebKeyBuilderTest.java           |  4 +-
 .../fusionauth/jwks/JSONWebKeyParserTest.java | 72 +++++++++++++++++--
 .../fusionauth/jwt/ed/EdDSAVerifierTest.java  | 17 +----
 .../io/fusionauth/pem/PEMEncoderTest.java     | 62 ++++++++++++++--
 .../resources/ed_dsa_ed25519_private_key.pem  |  4 +-
 .../ed_dsa_ed25519_private_key_pub.pem        |  5 --
 .../resources/ed_dsa_ed25519_public_key.pem   |  4 +-
 .../jwk/ed_dsa_ed25519_private_key.json       |  4 +-
 .../jwk/ed_dsa_ed25519_public_key.json        |  7 +-
 .../jwk/ed_dsa_ed448_public_key.json          |  5 +-
 16 files changed, 238 insertions(+), 72 deletions(-)
 delete mode 100644 src/test/resources/ed_dsa_ed25519_private_key_pub.pem

diff --git a/README.md b/README.md
index f2d12ffa..e7b8da46 100644
--- a/README.md
+++ b/README.md
@@ -8,10 +8,19 @@ We are very interested in compensating anyone that can identify a security relat
 
 ## Features
  - JWT signing using HMAC, RSA and Elliptic Curve support
-   - `HS256`, `HS384`, `HS512`, `RS256`, `RS384`, `RS512`, `ES256`, `ES384`, `ES512`
- - JWT signing using RSA-PSS signatures
-   - `PS256`, `PS384`, `PS512`
-   - Available in versions >= 3.5.0
+   - `HS256`
+   - `HS384`
+   - `HS512`
+   - `RS256`
+   - `RS384`
+   - `RS512`
+   - `ES256`
+   - `ES384`
+   - `ES512`
+   - `PS256` 
+   - `PS384`
+   - `PS512`
+   - `EdDSA` (`ed25519` and `ed448`)
  - Support for Bouncy Castle JCE or other third party providers.   
  - PEM decoding / encoding
    - Decode PEM files to PrivateKey or PublicKey
@@ -26,7 +35,9 @@ We are very interested in compensating anyone that can identify a security relat
    - Retrieve JWK from JWKS endpoints
  - Helpers
    - Generate RSA Key Pairs in `2048`, `3072` or `4096` bit sizes
+   - Generate RSA pSS Key Pairs in `2048`, `3072` or `4096` bit sizes
    - Generate EC Key Pairs in `256`, `384` and `521` bit sizes
+   - Generate EdDSA Key Pairs for `ed2559` and `ed448`
    - Generate `x5t` and `x5t#256` values from X.509 Certificates
    - Generate JWK thumbprint using `SHA-1` or `SHA-256` 
    - Generate ideal HMAC secret lengths for `SHA-256`, `SHA-384` and `SHA-512`
diff --git a/fusionauth-jwt.ipr b/fusionauth-jwt.ipr
index 0be912ff..03513f67 100644
--- a/fusionauth-jwt.ipr
+++ b/fusionauth-jwt.ipr
@@ -35,6 +35,16 @@
       <inspection_tool class="Duplicates" enabled="true" level="WARNING" enabled_by_default="true">
         <option name="minCloneLength" value="35" />
       </inspection_tool>
+      <inspection_tool class="ExtractMethodRecommender" enabled="true" level="WARNING" enabled_by_default="true">
+        <option name="minLength" value="550" />
+      </inspection_tool>
+      <inspection_tool class="SizeReplaceableByIsEmpty" enabled="true" level="WARNING" enabled_by_default="true">
+        <option name="ignoredTypes">
+          <set>
+            <option value="java.util.List" />
+          </set>
+        </option>
+      </inspection_tool>
     </profile>
     <version value="1.0" />
   </component>
diff --git a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
index a4f5daa1..8e020c1c 100644
--- a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
+++ b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
@@ -36,6 +36,7 @@
 import java.security.interfaces.ECPrivateKey;
 import java.security.interfaces.ECPublicKey;
 import java.security.interfaces.EdECPrivateKey;
+import java.security.interfaces.EdECPublicKey;
 import java.security.interfaces.RSAPrivateCrtKey;
 import java.security.interfaces.RSAPrivateKey;
 import java.security.interfaces.RSAPublicKey;
@@ -142,7 +143,7 @@ public JSONWebKey build(PrivateKey privateKey) {
 
   private String getCurveOID(Key key) {
     try {
-      return KeyUtils.getCurveOID(key);
+      return KeyUtils.getCurveName(key);
     } catch (Exception e) {
       throw new JSONWebKeyBuilderException("Unable to read the Object Identifier of the public key.", e);
     }
@@ -182,7 +183,22 @@ public JSONWebKey build(PublicKey publicKey) {
     } else if (key.kty == KeyType.OKP) {
       key.alg = Algorithm.EdDSA;
       key.crv = getCurveOID(publicKey);
-      key.x = base64EncodeUint(extractX(publicKey.getEncoded()));
+      int keyLength = KeyUtils.getKeyLength(publicKey);
+      if (publicKey instanceof EdECPublicKey edECPublicKey) {
+        key.y = base64EncodeUint(edECPublicKey.getPoint().getY(), keyLength);
+      }
+
+      byte[] publicKeyBytes = getPublicKeyFromDEREncodedBytes(publicKey.getEncoded());
+      BigInteger xBigInteger = new BigInteger(publicKeyBytes);
+      String x1 = base64EncodeUint(xBigInteger, keyLength);
+      key.x = x1;
+//      key.x = Base64.getUrlEncoder().withoutPadding().encodeToString(publicKeyBytes);
+//      if (!x1.equals(key.x)) {
+//        System.out.println("Not equal!");
+//        System.out.println(x1);
+//        System.out.println(key.x);
+//      }
+//      key.x = base64EncodeUint(extractXFromDerEncodedPublicKey(publicKey.getEncoded()), keyLength);
     }
 
     return key;
@@ -226,16 +242,15 @@ private KeyType getKeyType(Key key) {
       case "EdDSA", "Ed25519", "Ed448" -> KeyType.OKP;
       default -> null;
     };
-
   }
 
-  private BigInteger extractX(byte[] bytes) {
+  private byte[] getPublicKeyFromDEREncodedBytes(byte[] bytes) {
     var is = new DerInputStream(bytes);
     try {
       var sequence = is.getSequence();
-      return sequence[1].getBigInteger();
+      return sequence[1].toByteArray();
     } catch (DerDecodingException e) {
-      throw new JSONWebKeyBuilderException("Unable to read x coordinate from the public key.", e);
+      throw new JSONWebKeyBuilderException("Unable to read the public key from the DER encoded key.", e);
     }
   }
 }
diff --git a/src/main/java/io/fusionauth/jwks/JSONWebKeyParser.java b/src/main/java/io/fusionauth/jwks/JSONWebKeyParser.java
index 9e0b14da..f637b239 100644
--- a/src/main/java/io/fusionauth/jwks/JSONWebKeyParser.java
+++ b/src/main/java/io/fusionauth/jwks/JSONWebKeyParser.java
@@ -31,7 +31,12 @@
 import java.security.spec.ECParameterSpec;
 import java.security.spec.ECPoint;
 import java.security.spec.ECPublicKeySpec;
+import java.security.spec.EdECPoint;
+import java.security.spec.EdECPublicKeySpec;
+import java.security.spec.KeySpec;
+import java.security.spec.NamedParameterSpec;
 import java.security.spec.RSAPublicKeySpec;
+import java.util.Base64;
 import java.util.Objects;
 
 import static io.fusionauth.jwks.JWKUtils.base64DecodeUint;
@@ -40,9 +45,8 @@
  * @author Daniel DeGroff
  */
 public class JSONWebKeyParser {
-
   /**
-   * Parse a JSON Web Key and extract the the public key.
+   * Parse a JSON Web Key and extract the public key.
    *
    * @param key the JSON web key
    * @return the public key
@@ -57,7 +61,7 @@ public PublicKey parse(JSONWebKey key) {
         BigInteger publicExponent = base64DecodeUint(key.e);
         PublicKey publicKey = KeyFactory.getInstance("RSA").generatePublic(new RSAPublicKeySpec(modulus, publicExponent));
 
-        // If an x5c is found in the key, verify the public key
+        // If the x5c is non-null, verify the public key
         if (key.x5c != null && key.x5c.size() > 0) {
           verifyX5cRSA(key, modulus, publicExponent);
         }
@@ -86,12 +90,27 @@ public PublicKey parse(JSONWebKey key) {
         ECPoint ecPoint = new ECPoint(xCoordinate, yCoordinate);
         PublicKey publicKey = KeyFactory.getInstance("EC").generatePublic(new ECPublicKeySpec(ecPoint, ecParameterSpec));
 
-        // If an x5c is found in the key, verify the public key
+        // If the x5x is non-null, verify the public key
         if (key.x5c != null && key.x5c.size() > 0) {
           verifyX5cEC(key, xCoordinate, yCoordinate);
         }
 
         return publicKey;
+      } else if (key.kty == KeyType.OKP) {
+        if (!"Ed25519".equals(key.crv) && !"Ed448".equals(key.crv)) {
+          throw new UnsupportedOperationException("Only a Ed25519 or Ed448 OKP JSON Web key may be parsed.");
+        }
+
+        byte[] bytes = Base64.getUrlDecoder().decode(key.x);
+        reverseArray(bytes);
+
+        int lastBit = bytes[0] & 0xFF;
+        boolean xOdd = (lastBit & 0b1000_0000) == 0b1000_0000;
+        bytes[0] = (byte) (lastBit & Byte.MAX_VALUE);
+        BigInteger y = new BigInteger(1, bytes);
+
+        KeySpec keySpec = new EdECPublicKeySpec(new NamedParameterSpec(key.crv), new EdECPoint(xOdd, y));
+        return KeyFactory.getInstance(key.crv).generatePublic(keySpec);
       }
     } catch (JSONWebKeyParserException e) {
       throw e;
@@ -99,7 +118,7 @@ public PublicKey parse(JSONWebKey key) {
       throw new JSONWebKeyParserException("Failed to parse the provided JSON Web Key", e);
     }
 
-    throw new UnsupportedOperationException("Only RSA or EC JSON Web Keys may be parsed.");
+    throw new UnsupportedOperationException("Only RSA, EC or OKP JSON Web Keys may be parsed.");
   }
 
   private void verifyX5cEC(JSONWebKey key, BigInteger expectedXCoordinate, BigInteger expectedYCoordinate) {
@@ -108,11 +127,10 @@ private void verifyX5cEC(JSONWebKey key, BigInteger expectedXCoordinate, BigInte
     String encodedCertificate = key.x5c.get(0);
     String pem = new PEMEncoder().parseEncodedCertificate(encodedCertificate);
     PublicKey actual = PEM.decode(pem).publicKey;
-    if (!(actual instanceof ECPublicKey)) {
+    if (!(actual instanceof ECPublicKey ecPublicKey)) {
       throw new JSONWebKeyParserException("The public key found in the [x5c] property does not match the expected key type specified by the [kty] property.");
     }
 
-    ECPublicKey ecPublicKey = (ECPublicKey) actual;
     ECPoint point = ecPublicKey.getW();
 
     if (!point.getAffineX().equals(expectedXCoordinate)) {
@@ -125,6 +143,18 @@ private void verifyX5cEC(JSONWebKey key, BigInteger expectedXCoordinate, BigInte
     }
   }
 
+  private void reverseArray(byte[] arr) {
+    int i = 0;
+    int j = arr.length - 1;
+
+    while (i < j) {
+      byte tmp = arr[i];
+      arr[i] = arr[j];
+      arr[j] = tmp;
+      i++;
+      j--;
+    }
+  }
 
   private void verifyX5cRSA(JSONWebKey key, BigInteger expectedModulus, BigInteger expectedPublicExponent) {
     // The first key in this array MUST contain the public key.
@@ -133,11 +163,10 @@ private void verifyX5cRSA(JSONWebKey key, BigInteger expectedModulus, BigInteger
     String pem = new PEMEncoder().parseEncodedCertificate(encodedCertificate);
     PublicKey actual = PEM.decode(pem).publicKey;
 
-    if (!(actual instanceof RSAPublicKey)) {
+    if (!(actual instanceof RSAPublicKey rsaPublicKey)) {
       throw new JSONWebKeyParserException("The public key found in the [x5c] property does not match the expected key type specified by the [kty] property.");
     }
 
-    RSAPublicKey rsaPublicKey = (RSAPublicKey) actual;
     if (!rsaPublicKey.getModulus().equals(expectedModulus)) {
       throw new JSONWebKeyParserException("Expected a modulus value of [" + expectedModulus + "] but found [" + rsaPublicKey.getModulus() + "].  The certificate found in [x5c] does not match the [n] property.");
     }
diff --git a/src/main/java/io/fusionauth/pem/PEMDecoder.java b/src/main/java/io/fusionauth/pem/PEMDecoder.java
index 7f538a37..12976116 100644
--- a/src/main/java/io/fusionauth/pem/PEMDecoder.java
+++ b/src/main/java/io/fusionauth/pem/PEMDecoder.java
@@ -316,7 +316,7 @@ private PEM decode_PKCS_8(String encodedKey) throws NoSuchAlgorithmException, IO
         derEncodedPublicKey = derEncodePublicKey(algorithmIdentifier, publicKeyBytes);
       } else {
         // The private key did not contain the public key. The public key can be derived from the privat key.
-        String curve = KeyUtils.getCurveOID(privateKey);
+        String curve = KeyUtils.getCurveName(privateKey);
         publicKeyBytes = KeyUtils.deriveEdDSAPublicKeyFromPrivate(edECPrivateKey.getBytes().orElseThrow(), curve);
 
         byte[] bitStringKeyBytes = new byte[publicKeyBytes.length + 1];
diff --git a/src/main/java/io/fusionauth/security/KeyUtils.java b/src/main/java/io/fusionauth/security/KeyUtils.java
index 021c60e5..e33d4db7 100644
--- a/src/main/java/io/fusionauth/security/KeyUtils.java
+++ b/src/main/java/io/fusionauth/security/KeyUtils.java
@@ -18,6 +18,7 @@
 
 import io.fusionauth.der.DerInputStream;
 import io.fusionauth.der.DerValue;
+import io.fusionauth.der.ObjectIdentifier;
 
 import java.io.IOException;
 import java.security.InvalidAlgorithmParameterException;
@@ -46,15 +47,13 @@
  * @author Daniel DeGroff
  */
 public class KeyUtils {
-
   /**
-   *
    * @param key the key
    * @return the name of the curve used by the key or null if it cannot be identified.
    */
-  public static String getCurveOID(Key key) throws IOException {
+  public static String getCurveName(Key key) throws IOException {
     // Match up the Curve Object Identifier to a string value
-    String oid = readCurveObjectIdentifier(key);
+    String oid = getCurveOID(key).decode();
     return switch (oid) {
       case ECDSA_P256 -> "P-256";
       case ECDSA_P384 -> "P-384";
@@ -65,24 +64,28 @@ public static String getCurveOID(Key key) throws IOException {
     };
   }
 
-  private static String readCurveObjectIdentifier(Key key) throws IOException {
+  /**
+   * @param key the key
+   * @return the Object Identifier (OID) of the curve used by the key.
+   */
+  public static ObjectIdentifier getCurveOID(Key key) throws IOException {
     DerValue[] sequence = new DerInputStream(key.getEncoded()).getSequence();
     if (key instanceof PrivateKey) {
       if (key instanceof EdECPrivateKey) {
-        return sequence[1].getOID().decode();
+        return sequence[1].getOID();
       }
 
       // Read the first value in the sequence, it is the algorithm OID, the second will be the curve
       sequence[1].getOID();
-      return sequence[1].getOID().decode();
+      return sequence[1].getOID();
     } else {
       if (key instanceof EdECPublicKey) {
-        return sequence[0].getOID().decode();
+        return sequence[0].getOID();
       }
 
       // Read the first value in the sequence, it is the algorithm OID, the second will be the curve
       sequence[0].getOID();
-      return sequence[0].getOID().decode();
+      return sequence[0].getOID();
     }
   }
 
diff --git a/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java b/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
index 8e254957..a77edd5a 100644
--- a/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
+++ b/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
@@ -167,7 +167,7 @@ public void rsa_public() throws Exception {
     assertJSONEquals(JSONWebKey.build(cert2), "src/test/resources/jwk/rsa_certificate_gd_bundle_g2.json");
   }
 
-  @Test
+  @Test(invocationCount = 100)
   public void eddsa_private() throws Exception {
     // ed25519
     EdECPrivateKey key25519 = PEM.decode(Paths.get("src/test/resources/ed_dsa_ed25519_private_key.pem")).getPrivateKey();
@@ -178,7 +178,7 @@ public void eddsa_private() throws Exception {
     assertJSONEquals(JSONWebKey.build(key448), "src/test/resources/jwk/ed_dsa_ed448_private_key.json");
   }
 
-  @Test
+  @Test(invocationCount = 100)
   public void eddsa_public() throws Exception {
     // ed25519
     EdECPublicKey key25519 = PEM.decode(Paths.get("src/test/resources/ed_dsa_ed25519_public_key.pem")).getPublicKey();
diff --git a/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java b/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
index 6c0c49b9..9cb5845e 100644
--- a/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
+++ b/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -24,9 +24,12 @@
 import io.fusionauth.jwt.domain.KeyType;
 import io.fusionauth.jwt.json.Mapper;
 import io.fusionauth.pem.domain.PEM;
+import org.bouncycastle.util.io.pem.PemObject;
+import org.bouncycastle.util.io.pem.PemReader;
 import org.testng.annotations.DataProvider;
 import org.testng.annotations.Test;
 
+import java.io.StringReader;
 import java.math.BigInteger;
 import java.nio.file.Files;
 import java.nio.file.Paths;
@@ -136,7 +139,6 @@ public void parse_ec_keys(String curve, String x, String y) {
     assertEquals(JSONWebKey.build(pem.publicKey).y, expected.y);
   }
 
-
   @Test(dataProvider = "rsaPublicKeys")
   public void parse_well_known(String exponent, String modulus) {
     JSONWebKey expected = new JSONWebKey();
@@ -184,7 +186,7 @@ public void unsignedEncodingTest() {
     assertEquals(key.e, encodedE);
   }
 
-  @Test
+  @Test(invocationCount = 1_000)
   public void parse_ec() {
     KeyPair keyPair = JWTUtils.generate256_ECKeyPair();
 
@@ -206,7 +208,69 @@ public void parse_ec() {
     assertEquals(JSONWebKey.build(pem.publicKey).y, expected.y);
   }
 
-  @Test
+  @DataProvider(name = "EdDSA")
+  public Object[][] edDSA() {
+    return new Object[][]{
+        {"Ed25519"},
+        {"Ed448"},
+    };
+  }
+
+  @Test(dataProvider = "EdDSA", invocationCount = 1_000)
+  public void parse_eddsa(String curve) throws Exception {
+    KeyPair keyPair = curve.equals("Ed25519")
+        ? JWTUtils.generate_ed25519_EdDSAKeyPair()
+        : JWTUtils.generate_ed448_EdDSAKeyPair();
+
+    // Build a JSON Web Key from our own EdDSA key pair
+    JSONWebKey expected = JSONWebKey.build(keyPair.publicKey);
+    expected.alg = Algorithm.EdDSA;
+
+    PublicKey publicKey = JSONWebKey.parse(expected);
+    assertNotNull(publicKey);
+
+    // Compare to the original expected key
+    String encodedPEM = PEM.encode(publicKey);
+    PemReader bcPEMReader = new PemReader(new StringReader(encodedPEM));
+    PemObject bcPEMObject = bcPEMReader.readPemObject();
+    byte[] bcPublicKeyBytes = bcPEMObject.getContent();
+
+    // BC bytes
+    // [48, 42, 48, 5, 6, 3, 43, 101, 112, 3, 33, 0, -24, 70, 53, 73, 35, -31, 108, -115, 115, -115, -63, 123, -8, -116, 112, 74, -40, -55, 116, -35, 57, -96, 114, -53, 4, 99, -74, 61, 55, 91, 59, 68]
+    // publicKey.getEncoded()
+    // [48, 42, 48, 5, 6, 3, 43, 101, 112, 3, 33, 0, -24, 70, 53, 73, 35, -31, 108, -115, 115, -115, -63, 123, -8, -116, 112, 74, -40, -55, 116, -35, 57, -96, 114, -53, 4, 99, -74, 61, 55, 91, 59, 68]
+//    System.out.println("here");
+
+//    JSONWebKey newJSONWebKey = JSONWebKey.build(encodedPEM);
+//    if (!newJSONWebKey.x.equals(expected.x)) {
+//      String actualX = newJSONWebKey.x;
+//      byte[] actualXBytes = base64DecodeUint(actualX).toByteArray();
+//      byte[] expectedXBytes = base64DecodeUint(expected.x).toByteArray();
+//      System.out.println("yo!");
+//    }
+    // It is plausible the base64 encoding may vary based upon padding. Assert equality on the integer values instead.
+//    BigInteger actualXInteger = base64DecodeUint(newJSONWebKey.x);
+//    BigInteger expectedXInteger = base64DecodeUint(expected.x);
+//    assertEquals(actualXInteger, expectedXInteger);
+
+//    byte[] expectedXBytes = base64DecodeUint(expected.x).toByteArray();
+
+
+    if (!JSONWebKey.build(encodedPEM).x.equals(expected.x)) {
+      System.out.println(encodedPEM);
+      System.out.println("Actual:   " + JSONWebKey.build(encodedPEM).x);
+      System.out.println("Expected: " + expected.x);
+    }
+    assertEquals(JSONWebKey.build(encodedPEM).x, expected.x);
+    assertEquals(JSONWebKey.build(encodedPEM).y, expected.y);
+
+    // Get the public key from the PEM, and assert against the expected values
+    PEM pem = PEM.decode(encodedPEM);
+    assertEquals(JSONWebKey.build(pem.publicKey).x, expected.x);
+    assertEquals(JSONWebKey.build(pem.publicKey).y, expected.y);
+  }
+
+  @Test(invocationCount = 1_000)
   public void parse_rsa() {
     KeyPair keyPair = JWTUtils.generate2048_RSAKeyPair();
 
diff --git a/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java b/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java
index 6005c91c..de8f3ba6 100644
--- a/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java
+++ b/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java
@@ -71,21 +71,10 @@ public void decodePrivateKey() throws Exception {
       assertEquals(pem.publicKey.getFormat(), "X.509", message);
       String expectedAlgorithm = FipsEnabled ? (f.contains("ed448") ? "Ed448" : "Ed25519") : "EdDSA";
       assertEquals(pem.publicKey.getAlgorithm(), expectedAlgorithm, message);
-    }
-
-    // Private keys that contain a public key
-    for (String f : List.of("ed_dsa_ed25519_private_key_pub.pem")) {
-      String message = "For file [" + f + "]";
-      String encodedPEM = new String(Files.readAllBytes(Paths.get("src/test/resources/" + f)));
-      assertTrue(encodedPEM.contains(PEM.PKCS_8_PRIVATE_KEY_PREFIX), message);
 
-      PEM pem = PEM.decode(encodedPEM);
-      assertNotNull(pem.privateKey, message);
-      assertEquals(pem.privateKey.getFormat(), "PKCS#8", message);
-      assertNotNull(pem.publicKey, message);
-      assertEquals(pem.publicKey.getFormat(), "X.509", message);
-      String expectedAlgorithm = FipsEnabled ? "Ed25519" : "EdDSA";
-      assertEquals(pem.publicKey.getAlgorithm(), expectedAlgorithm, message);
+      String publicKeyFile = f.replace("_private_", "_public_");
+      String actualPublicPEM = new String(Files.readAllBytes(Paths.get("src/test/resources/" + publicKeyFile))).trim();
+      assertEquals(actualPublicPEM, PEM.encode(pem.publicKey), message);
     }
   }
 
diff --git a/src/test/java/io/fusionauth/pem/PEMEncoderTest.java b/src/test/java/io/fusionauth/pem/PEMEncoderTest.java
index b207e139..75b04c3a 100644
--- a/src/test/java/io/fusionauth/pem/PEMEncoderTest.java
+++ b/src/test/java/io/fusionauth/pem/PEMEncoderTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -39,7 +39,57 @@
  * @author Daniel DeGroff
  */
 public class PEMEncoderTest extends BaseTest {
-  @Test
+  @Test(invocationCount = 250)
+  public void eddsa() throws Exception {
+    String privateKeyPEM = new String(Files.readAllBytes(Paths.get("src/test/resources/ed_dsa_ed25519_private_key.pem"))).trim();
+    String publicKeyPEM = new String(Files.readAllBytes(Paths.get("src/test/resources/ed_dsa_ed25519_public_key.pem"))).trim();
+
+    PEM pem = PEM.decode(privateKeyPEM);
+    String extractedPublicKeyPEM = PEM.encode(pem.publicKey);
+    assertEquals(publicKeyPEM, extractedPublicKeyPEM);
+
+    // The key is already in the correct format, and we don't recombine them. So the result should be equal to the private key.
+    String pkcs8PEM = PEM.encode(pem.getPrivateKey(), pem.getPublicKey());
+    assertEquals(privateKeyPEM, pkcs8PEM);
+
+    // Key generation and PEM Encoding
+    KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("Ed25519");
+    KeyPair keyPair = keyPairGenerator.generateKeyPair();
+
+    String encodedPublicKey = PEM.encode(keyPair.getPublic());
+    assertNotNull(encodedPublicKey);
+    assertTrue(encodedPublicKey.startsWith(PEM.X509_PUBLIC_KEY_PREFIX));
+    assertTrue(encodedPublicKey.endsWith(PEM.X509_PUBLIC_KEY_SUFFIX));
+
+    String encodedPrivateKey = PEM.encode(keyPair.getPrivate());
+    assertNotNull(encodedPrivateKey);
+    assertTrue(encodedPrivateKey.startsWith(PEM.PKCS_8_PRIVATE_KEY_PREFIX));
+    assertTrue(encodedPrivateKey.endsWith(PEM.PKCS_8_PRIVATE_KEY_SUFFIX));
+
+    // The public key can always be derived from the private key, so expect them both to be returned.
+    PEM pem2 = PEM.decode(encodedPrivateKey);
+    assertNotNull(pem2.getPrivateKey());
+    assertEquals(pem2.getPrivateKey().getFormat(), "PKCS#8");
+    assertEquals(pem2.getPrivateKey().getAlgorithm(), FipsEnabled ? "Ed25519" : "EdDSA");
+    assertNotNull(pem2.getPublicKey());
+    assertEquals(pem2.getPublicKey().getFormat(), "X.509");
+    assertEquals(pem2.getPublicKey().getAlgorithm(), FipsEnabled ? "Ed25519" : "EdDSA");
+
+    // Try again, but provide both keys to encode into the PEM. The PEM won't include the public key, but it can always be derived.
+    String encodedPrivateKey2 = PEM.encode(keyPair.getPrivate(), keyPair.getPublic());
+    assertNotNull(encodedPrivateKey2);
+    PEM pem3 = PEM.decode(encodedPrivateKey2);
+    // They will be the same, we didn't repackage it.
+    assertEquals(encodedPrivateKey, encodedPrivateKey2);
+    assertNotNull(pem3.getPrivateKey());
+    assertEquals(pem3.getPrivateKey().getFormat(), "PKCS#8");
+    assertEquals(pem3.getPrivateKey().getAlgorithm(), FipsEnabled ? "Ed25519" : "EdDSA");
+    assertNotNull(pem3.getPublicKey());
+    assertEquals(pem3.getPublicKey().getFormat(), "X.509");
+    assertEquals(pem3.getPublicKey().getAlgorithm(), FipsEnabled ? "Ed25519" : "EdDSA");
+  }
+
+  @Test(invocationCount = 250)
   public void ec() throws Exception {
     KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("EC");
     keyPairGenerator.initialize(256);
@@ -68,7 +118,7 @@ public void ec() throws Exception {
     assertNotNull(pem2.getPublicKey());
   }
 
-  @Test
+  @Test(invocationCount = 250)
   public void ec_backAndForth() throws Exception {
     // Start with openSSL PKCS#8 private key and X.509 public key
     String expectedPrivate = new String(Files.readAllBytes(Paths.get("src/test/resources/ec_private_prime256v1_p_256_openssl_pkcs8.pem"))).trim();
@@ -96,7 +146,7 @@ public void ec_backAndForth() throws Exception {
     assertEquals(encodedPublicKey, expectedPublic);
   }
 
-  @Test
+  @Test(invocationCount = 250)
   public void rsa() throws Exception {
     KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
     keyPairGenerator.initialize(2048);
@@ -121,7 +171,7 @@ public void rsa() throws Exception {
     assertNotNull(pem.getPublicKey());
   }
 
-  @Test
+  @Test(invocationCount = 250)
   public void rsa_backAndForth_pkcs_1() throws Exception {
     // Start externally created PKCS#1 private key and X.509 public key
     String expectedPrivate_pkcs_1 = new String(Files.readAllBytes(Paths.get("src/test/resources/rsa_private_key_2048_pkcs_1_control.pem"))).trim();
@@ -153,7 +203,7 @@ public void rsa_backAndForth_pkcs_1() throws Exception {
     assertEquals(encodedPublicKey, expectedPublic);
   }
 
-  @Test
+  @Test(invocationCount = 250)
   public void rsa_backAndForth_pkcs_8() throws Exception {
     // Start externally created PKCS#1 private key and X.509 public key
     String expectedPrivate = new String(Files.readAllBytes(Paths.get("src/test/resources/rsa_private_key_2048_pkcs_8_control.pem"))).trim();
diff --git a/src/test/resources/ed_dsa_ed25519_private_key.pem b/src/test/resources/ed_dsa_ed25519_private_key.pem
index 84961082..26f7b5b9 100644
--- a/src/test/resources/ed_dsa_ed25519_private_key.pem
+++ b/src/test/resources/ed_dsa_ed25519_private_key.pem
@@ -1,5 +1,3 @@
 -----BEGIN PRIVATE KEY-----
-MHICAQEwBQYDK2VwBCIEINTuctv5E1hK1bbY8fdp+K06/nwoy/HU++CXqI9EdVhC
-oB8wHQYKKoZIhvcNAQkJFDEPDA1DdXJkbGUgQ2hhaXJzgSEAGb9ECWmEzf6FQbrB
-Z9w7lshQhqowtrbLDFw4rXAxZuE=
+MC4CAQAwBQYDK2VwBCIEIBkw8lkoSlf7XAVpXgpY/SPasbkgqqMT6xr1efkWUniV
 -----END PRIVATE KEY-----
diff --git a/src/test/resources/ed_dsa_ed25519_private_key_pub.pem b/src/test/resources/ed_dsa_ed25519_private_key_pub.pem
deleted file mode 100644
index 7179f294..00000000
--- a/src/test/resources/ed_dsa_ed25519_private_key_pub.pem
+++ /dev/null
@@ -1,5 +0,0 @@
------BEGIN PRIVATE KEY-----
-MHICAQEwBQYDK2VwBCIEINTuctv5E1hK1bbY8fdp+K06/nwoy/HU++CXqI9EdVhC
-oB8wHQYKKoZIhvcNAQkJFDEPDA1DdXJkbGUgQ2hhaXJzgSEAGb9ECWmEzf6FQbrB
-Z9w7lshQhqowtrbLDFw4rXAxZuE=
------END PRIVATE KEY-----
\ No newline at end of file
diff --git a/src/test/resources/ed_dsa_ed25519_public_key.pem b/src/test/resources/ed_dsa_ed25519_public_key.pem
index 5769a943..42596616 100644
--- a/src/test/resources/ed_dsa_ed25519_public_key.pem
+++ b/src/test/resources/ed_dsa_ed25519_public_key.pem
@@ -1,3 +1,3 @@
 -----BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEAun73P2PfgPZTvbRvlHjVkjhqUhAQOVC1wRa+vmX+dIc=
------END PUBLIC KEY-----
\ No newline at end of file
+MCowBQYDK2VwAyEAm3hg6spkvQ31omhXHH//ux5BwleSlufOXEfOlUWOl30=
+-----END PUBLIC KEY-----
diff --git a/src/test/resources/jwk/ed_dsa_ed25519_private_key.json b/src/test/resources/jwk/ed_dsa_ed25519_private_key.json
index dbf36e76..58f3e155 100644
--- a/src/test/resources/jwk/ed_dsa_ed25519_private_key.json
+++ b/src/test/resources/jwk/ed_dsa_ed25519_private_key.json
@@ -1,8 +1,8 @@
 {
   "alg": "EdDSA",
   "crv": "Ed25519",
-  "d": "1O5y2_kTWErVttjx92n4rTr-fCjL8dT74Jeoj0R1WEI",
+  "d": "GTDyWShKV_tcBWleClj9I9qxuSCqoxPrGvV5-RZSeJU",
   "kty": "OKP",
   "use": "sig",
-  "x": "Gb9ECWmEzf6FQbrBZ9w7lshQhqowtrbLDFw4rXAxZuE"
+  "x": "m3hg6spkvQ31omhXHH__ux5BwleSlufOXEfOlUWOl30"
 }
diff --git a/src/test/resources/jwk/ed_dsa_ed25519_public_key.json b/src/test/resources/jwk/ed_dsa_ed25519_public_key.json
index 029912da..c8ab5d5b 100644
--- a/src/test/resources/jwk/ed_dsa_ed25519_public_key.json
+++ b/src/test/resources/jwk/ed_dsa_ed25519_public_key.json
@@ -1,7 +1,8 @@
 {
-  "kty": "OKP",
   "alg": "EdDSA",
   "crv": "Ed25519",
-  "x": "un73P2PfgPZTvbRvlHjVkjhqUhAQOVC1wRa-vmX-dIc",
-  "use": "sig"
+  "kty": "OKP",
+  "use": "sig",
+  "x": "m3hg6spkvQ31omhXHH__ux5BwleSlufOXEfOlUWOl30",
+  "y": "fZeORZXOR1zO55aSV8JBHrv_fxxXaKL1Db1kyupgeJs"
 }
diff --git a/src/test/resources/jwk/ed_dsa_ed448_public_key.json b/src/test/resources/jwk/ed_dsa_ed448_public_key.json
index 778c8054..7d3005d1 100644
--- a/src/test/resources/jwk/ed_dsa_ed448_public_key.json
+++ b/src/test/resources/jwk/ed_dsa_ed448_public_key.json
@@ -1,7 +1,8 @@
 {
-  "kty": "OKP",
   "alg": "EdDSA",
   "crv": "Ed448",
+  "kty": "OKP",
+  "use": "sig",
   "x": "gWl4sYkZhkljqw4C0GDCjDgU44Q3-Sxnd9XXZKcP-kcIoEMmcoSFW7aMWJXcWKa5BB6_eyuTE1IA",
-  "use": "sig"
+  "y": "AFITkyt7vx4EuaZY3JVYjLZbhYRyJkOgCEf6D6dk19V3Zyz5N4TjFDiMwmDQAg6rY0mGGYmxeGmB"
 }

From b53e9571da2cf16a655e8a85437aa6f07f6b4df3 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Tue, 18 Nov 2025 15:31:07 -0700
Subject: [PATCH 12/29] cleanup

---
 .../io/fusionauth/jwks/JSONWebKeyBuilder.java | 30 ++++++-------------
 1 file changed, 9 insertions(+), 21 deletions(-)

diff --git a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
index 8e020c1c..1ee3595a 100644
--- a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
+++ b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
@@ -188,17 +188,15 @@ public JSONWebKey build(PublicKey publicKey) {
         key.y = base64EncodeUint(edECPublicKey.getPoint().getY(), keyLength);
       }
 
-      byte[] publicKeyBytes = getPublicKeyFromDEREncodedBytes(publicKey.getEncoded());
-      BigInteger xBigInteger = new BigInteger(publicKeyBytes);
-      String x1 = base64EncodeUint(xBigInteger, keyLength);
-      key.x = x1;
-//      key.x = Base64.getUrlEncoder().withoutPadding().encodeToString(publicKeyBytes);
-//      if (!x1.equals(key.x)) {
-//        System.out.println("Not equal!");
-//        System.out.println(x1);
-//        System.out.println(key.x);
-//      }
-//      key.x = base64EncodeUint(extractXFromDerEncodedPublicKey(publicKey.getEncoded()), keyLength);
+      byte[] publicKeyBytes;
+      try {
+        var sequence = new DerInputStream(publicKey.getEncoded()).getSequence();
+        publicKeyBytes = sequence[1].toByteArray();
+      } catch (DerDecodingException e) {
+        throw new JSONWebKeyBuilderException("Unable to read the public key from the DER encoded key.", e);
+      }
+
+      key.x = base64EncodeUint(new BigInteger(publicKeyBytes), keyLength);
     }
 
     return key;
@@ -243,14 +241,4 @@ private KeyType getKeyType(Key key) {
       default -> null;
     };
   }
-
-  private byte[] getPublicKeyFromDEREncodedBytes(byte[] bytes) {
-    var is = new DerInputStream(bytes);
-    try {
-      var sequence = is.getSequence();
-      return sequence[1].toByteArray();
-    } catch (DerDecodingException e) {
-      throw new JSONWebKeyBuilderException("Unable to read the public key from the DER encoded key.", e);
-    }
-  }
 }

From d03a75cfe133663a81d0f5d00222dbc4569a8fb9 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Tue, 18 Nov 2025 15:31:53 -0700
Subject: [PATCH 13/29] cleanup

---
 .../fusionauth/jwks/JSONWebKeyParserTest.java | 35 +------------------
 1 file changed, 1 insertion(+), 34 deletions(-)

diff --git a/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java b/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
index 9cb5845e..80110aca 100644
--- a/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
+++ b/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
@@ -24,12 +24,9 @@
 import io.fusionauth.jwt.domain.KeyType;
 import io.fusionauth.jwt.json.Mapper;
 import io.fusionauth.pem.domain.PEM;
-import org.bouncycastle.util.io.pem.PemObject;
-import org.bouncycastle.util.io.pem.PemReader;
 import org.testng.annotations.DataProvider;
 import org.testng.annotations.Test;
 
-import java.io.StringReader;
 import java.math.BigInteger;
 import java.nio.file.Files;
 import java.nio.file.Paths;
@@ -217,7 +214,7 @@ public Object[][] edDSA() {
   }
 
   @Test(dataProvider = "EdDSA", invocationCount = 1_000)
-  public void parse_eddsa(String curve) throws Exception {
+  public void parse_eddsa(String curve) {
     KeyPair keyPair = curve.equals("Ed25519")
         ? JWTUtils.generate_ed25519_EdDSAKeyPair()
         : JWTUtils.generate_ed448_EdDSAKeyPair();
@@ -231,36 +228,6 @@ public void parse_eddsa(String curve) throws Exception {
 
     // Compare to the original expected key
     String encodedPEM = PEM.encode(publicKey);
-    PemReader bcPEMReader = new PemReader(new StringReader(encodedPEM));
-    PemObject bcPEMObject = bcPEMReader.readPemObject();
-    byte[] bcPublicKeyBytes = bcPEMObject.getContent();
-
-    // BC bytes
-    // [48, 42, 48, 5, 6, 3, 43, 101, 112, 3, 33, 0, -24, 70, 53, 73, 35, -31, 108, -115, 115, -115, -63, 123, -8, -116, 112, 74, -40, -55, 116, -35, 57, -96, 114, -53, 4, 99, -74, 61, 55, 91, 59, 68]
-    // publicKey.getEncoded()
-    // [48, 42, 48, 5, 6, 3, 43, 101, 112, 3, 33, 0, -24, 70, 53, 73, 35, -31, 108, -115, 115, -115, -63, 123, -8, -116, 112, 74, -40, -55, 116, -35, 57, -96, 114, -53, 4, 99, -74, 61, 55, 91, 59, 68]
-//    System.out.println("here");
-
-//    JSONWebKey newJSONWebKey = JSONWebKey.build(encodedPEM);
-//    if (!newJSONWebKey.x.equals(expected.x)) {
-//      String actualX = newJSONWebKey.x;
-//      byte[] actualXBytes = base64DecodeUint(actualX).toByteArray();
-//      byte[] expectedXBytes = base64DecodeUint(expected.x).toByteArray();
-//      System.out.println("yo!");
-//    }
-    // It is plausible the base64 encoding may vary based upon padding. Assert equality on the integer values instead.
-//    BigInteger actualXInteger = base64DecodeUint(newJSONWebKey.x);
-//    BigInteger expectedXInteger = base64DecodeUint(expected.x);
-//    assertEquals(actualXInteger, expectedXInteger);
-
-//    byte[] expectedXBytes = base64DecodeUint(expected.x).toByteArray();
-
-
-    if (!JSONWebKey.build(encodedPEM).x.equals(expected.x)) {
-      System.out.println(encodedPEM);
-      System.out.println("Actual:   " + JSONWebKey.build(encodedPEM).x);
-      System.out.println("Expected: " + expected.x);
-    }
     assertEquals(JSONWebKey.build(encodedPEM).x, expected.x);
     assertEquals(JSONWebKey.build(encodedPEM).y, expected.y);
 

From b5d3ee0ea5bc2013461e3afd149c431a7142fd82 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Wed, 19 Nov 2025 11:48:41 -0700
Subject: [PATCH 14/29] cleanup

---
 CHANGES                                       |  4 ++
 README.md                                     |  2 +-
 build.savant                                  | 13 ++++--
 .../io/fusionauth/jwks/JSONWebKeyBuilder.java |  4 +-
 .../java/io/fusionauth/jwt/OpenIDConnect.java | 19 +++++----
 .../io/fusionauth/jwt/domain/Algorithm.java   | 12 ++++--
 .../io/fusionauth/jwt/ed/EdDSASigner.java     | 31 +++++++-------
 .../io/fusionauth/jwt/ed/EdDSAVerifier.java   | 12 +++++-
 .../io/fusionauth/jwt/rsa/RSAVerifier.java    | 12 ++----
 .../jwks/JSONWebKeyBuilderTest.java           |  8 ++++
 .../fusionauth/jwks/JSONWebKeyParserTest.java |  2 +-
 .../io/fusionauth/jwt/OpenIdConnectTest.java  | 41 +++++++++++++++----
 .../io/fusionauth/jwt/ed/EdDSASignerTest.java | 15 ++++++-
 .../fusionauth/jwt/ed/EdDSAVerifierTest.java  |  9 ++--
 .../resources/ed_dsa_ed25519_certificate.pem  |  9 ++++
 .../resources/ed_dsa_ed448_certificate.pem    | 11 +++++
 .../jwk/ed_dsa_ed25519_certificate.json       | 13 ++++++
 .../jwk/ed_dsa_ed25519_private_key.json       |  2 +-
 .../jwk/ed_dsa_ed25519_public_key.json        |  2 +-
 .../jwk/ed_dsa_ed448_certificate.json         | 13 ++++++
 .../jwk/ed_dsa_ed448_private_key.json         |  2 +-
 .../jwk/ed_dsa_ed448_public_key.json          |  2 +-
 .../resources/jwk/ed_dsa_private_key.json     |  4 +-
 src/test/resources/jwk/ed_dsa_public_key.json |  4 +-
 24 files changed, 186 insertions(+), 60 deletions(-)
 create mode 100644 src/test/resources/ed_dsa_ed25519_certificate.pem
 create mode 100644 src/test/resources/ed_dsa_ed448_certificate.pem
 create mode 100644 src/test/resources/jwk/ed_dsa_ed25519_certificate.json
 create mode 100644 src/test/resources/jwk/ed_dsa_ed448_certificate.json

diff --git a/CHANGES b/CHANGES
index ad2b9248..51742ba3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,10 @@ Changes in 6.0.0
  * Move to Java 17 LTS as the minimum requirement.
  * Remove CryptoProvider and just use JCE to use a third party provider such as BouncyCastle.
    * Tested against Bouncy Castle FIPS provider, but any provider could be used.
+ * Added support for EdDSA curves Ed25519 and Ed448.
+   * It is is not advised to use the EdDSA alg header as it has bee deprecated in favor of Ed25519 and Ed448.
+   * In order to use the OpenIDConnect c_hash or at_hash methods with the Ed448 algorithm, you will need to register a crypto provider that can provide the SHAKE256 digest, such as BouncyCastle.
+     * Using these methods with the default Java JCA will throw an exception because the SHAKE256 message digest will not be found.
 
 Changes in 5.3.3
 
diff --git a/README.md b/README.md
index e7b8da46..b9b9d6bc 100644
--- a/README.md
+++ b/README.md
@@ -20,7 +20,7 @@ We are very interested in compensating anyone that can identify a security relat
    - `PS256` 
    - `PS384`
    - `PS512`
-   - `EdDSA` (`ed25519` and `ed448`)
+   - `EdDSA` (`Ed25519` and `Ed448`)
  - Support for Bouncy Castle JCE or other third party providers.   
  - PEM decoding / encoding
    - Decode PEM files to PrivateKey or PublicKey
diff --git a/build.savant b/build.savant
index 05dc0138..652e6f51 100644
--- a/build.savant
+++ b/build.savant
@@ -99,9 +99,16 @@ target(name: "test", description: "Runs the project's tests", dependsOn: ["jar"]
   // Example:
   // javaTestNG.settings.jvmArguments += "-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=5005"
 
-  // Run the test suite twice, one with BC fips enabled, and once w/out.
-  [false, true].each { enabled ->
-    javaTestNG.settings.jvmArguments = "-Dtest.fips=${enabled}"
+  if (switches.has("fips")) {
+    javaTestNG.settings.jvmArguments = "-Dtest.fips=true"
+    javaTestNG.test()
+  } else if (switches.has("jca")) {
+    javaTestNG.settings.jvmArguments = "-Dtest.fips=false"
+    javaTestNG.test()
+  } else {
+    javaTestNG.settings.jvmArguments = "-Dtest.fips=false"
+    javaTestNG.test()
+    javaTestNG.settings.jvmArguments = "-Dtest.fips=true"
     javaTestNG.test()
   }
 }
diff --git a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
index 1ee3595a..541721dd 100644
--- a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
+++ b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
@@ -126,7 +126,7 @@ public JSONWebKey build(PrivateKey privateKey) {
       key.y = base64EncodeUint(ecPrivateKey.getParams().getGenerator().getAffineY(), byteLength);
     } else if (privateKey instanceof EdECPrivateKey edPrivateKey) {
       key.crv = getCurveOID(edPrivateKey);
-      key.alg = Algorithm.EdDSA;
+      key.alg = Algorithm.fromName(key.crv);
 
       var privateKeyBytes = edPrivateKey.getBytes().orElseThrow(() -> new JSONWebKeyBuilderException("Unable to obtain the private key bytes."));
       key.d = Base64.getUrlEncoder().withoutPadding().encodeToString(privateKeyBytes);
@@ -181,8 +181,8 @@ public JSONWebKey build(PublicKey publicKey) {
       key.x = base64EncodeUint(ecPublicKey.getW().getAffineX(), byteLength);
       key.y = base64EncodeUint(ecPublicKey.getW().getAffineY(), byteLength);
     } else if (key.kty == KeyType.OKP) {
-      key.alg = Algorithm.EdDSA;
       key.crv = getCurveOID(publicKey);
+      key.alg = Algorithm.fromName(key.crv);
       int keyLength = KeyUtils.getKeyLength(publicKey);
       if (publicKey instanceof EdECPublicKey edECPublicKey) {
         key.y = base64EncodeUint(edECPublicKey.getPoint().getY(), keyLength);
diff --git a/src/main/java/io/fusionauth/jwt/OpenIDConnect.java b/src/main/java/io/fusionauth/jwt/OpenIDConnect.java
index a7f9b0c4..b19b41fb 100644
--- a/src/main/java/io/fusionauth/jwt/OpenIDConnect.java
+++ b/src/main/java/io/fusionauth/jwt/OpenIDConnect.java
@@ -63,19 +63,22 @@ private static String generate_hash(String string, Algorithm algorithm) {
     leftMostBits = switch (algorithm) {
       case ES256, HS256, RS256 -> {
         messageDigest = getDigest("SHA-256");
-        yield 128;
+        yield 128; // 32 * 8 / 2 = 256
       }
       case ES384, HS384, RS384 -> {
         messageDigest = getDigest("SHA-384");
-        yield 192;
+        yield 192; // 48 * 8 / 2 = 192
       }
-      case EdDSA, ES512, HS512, RS512 -> {
-        // Note that EdDSA ed25519 uses SHA-512. But EdDSA ed448 uses SHAKE256. No standard has been published
-        // such that the consumer of the at_hash or c_hash would know which curve was being used with the EdDSA algorithm.
-        // - Defaulting to SHA-512, but this means the hash may be unpredictable if you choose to utilize ed448.
-        // - Discussion: https://bitbucket.org/openid/connect/issues/1125/_hash-algorithm-for-eddsa-id-tokens
+      case Ed25519, ES512, HS512, RS512 -> {
         messageDigest = getDigest("SHA-512");
-        yield 256;
+        yield 256; // 64 * 8 / 2 = 256
+      }
+      case Ed448 -> {
+        // Ed448 uses a 114 byte SHAKE256 hash. The recommended hash length here is the same, see discussion thread:
+        // - https://bitbucket.org/openid/connect/issues/1125
+        // The JCA does not ship with SHAKE256, expect this to exception if you have not registered a provider with support for this algorithm (such as BC)
+        messageDigest = getDigest("SHAKE256");
+        yield 456; // 114 * 8 / 2 = 456
       }
       default ->
           throw new IllegalArgumentException("You specified an unsupported algorithm. The algorithm [" + algorithm + "]"
diff --git a/src/main/java/io/fusionauth/jwt/domain/Algorithm.java b/src/main/java/io/fusionauth/jwt/domain/Algorithm.java
index 983377da..a927f931 100644
--- a/src/main/java/io/fusionauth/jwt/domain/Algorithm.java
+++ b/src/main/java/io/fusionauth/jwt/domain/Algorithm.java
@@ -25,10 +25,16 @@
  */
 public enum Algorithm {
   /**
-   * EdDSA (ed25519, ed448)
-   * OID: 1.3.101.112, and 1.3.101.112
+   * Edwards-curve Digital Signature Algorithm (EdDSA) Ed25519
+   * OID: 1.3.101.112
    */
-  EdDSA("EdDSA"),
+  Ed25519("Ed25519"),
+
+  /**
+   * Edwards-curve Digital Signature Algorithm (EdDSA) Ed448
+   * OID: 1.3.101.113
+   */
+  Ed448("Ed448"),
 
   /**
    * ECDSA using P-256 and SHA-256
diff --git a/src/main/java/io/fusionauth/jwt/ed/EdDSASigner.java b/src/main/java/io/fusionauth/jwt/ed/EdDSASigner.java
index 79770261..08005b32 100644
--- a/src/main/java/io/fusionauth/jwt/ed/EdDSASigner.java
+++ b/src/main/java/io/fusionauth/jwt/ed/EdDSASigner.java
@@ -42,26 +42,24 @@ public class EdDSASigner implements Signer {
 
   private final EdECPrivateKey privateKey;
 
-  private EdDSASigner(Algorithm algorithm, PrivateKey privateKey, String kid) {
-    Objects.requireNonNull(algorithm);
+  private EdDSASigner(PrivateKey privateKey, String kid) {
     Objects.requireNonNull(privateKey);
 
-    this.algorithm = algorithm;
-    this.kid = kid;
-
     if (!(privateKey instanceof EdECPrivateKey)) {
       throw new InvalidKeyTypeException("Expecting a private key of type [EdECPrivateKey], but found [" + privateKey.getClass().getSimpleName() + "].");
     }
 
+    this.kid = kid;
     this.privateKey = (EdECPrivateKey) privateKey;
+    this.algorithm = Algorithm.fromName(this.privateKey.getParams().getName());
+    if (this.algorithm == null) {
+      throw new InvalidKeyTypeException("Unsupported algorithm reported by the private key. [" + this.privateKey.getParams().getName() + "].");
+    }
   }
 
-  private EdDSASigner(Algorithm algorithm, String privateKey, String kid) {
-    Objects.requireNonNull(algorithm);
+  private EdDSASigner(String privateKey, String kid) {
     Objects.requireNonNull(privateKey);
 
-    this.algorithm = algorithm;
-    this.kid = kid;
     PEM pem = PEM.decode(privateKey);
     if (pem.privateKey == null) {
       throw new MissingPrivateKeyException("The provided PEM encoded string did not contain a private key.");
@@ -71,7 +69,12 @@ private EdDSASigner(Algorithm algorithm, String privateKey, String kid) {
       throw new InvalidKeyTypeException("Expecting a private key of type [EdECPrivateKey], but found [" + pem.privateKey.getClass().getSimpleName() + "].");
     }
 
+    this.kid = kid;
     this.privateKey = pem.getPrivateKey();
+    this.algorithm = Algorithm.fromName(this.privateKey.getParams().getName());
+    if (this.algorithm == null) {
+      throw new InvalidKeyTypeException("Unsupported algorithm reported by the private key. [" + this.privateKey.getParams().getName() + "].");
+    }
   }
 
   /**
@@ -82,7 +85,7 @@ private EdDSASigner(Algorithm algorithm, String privateKey, String kid) {
    * @return a new EdDSA signer.
    */
   public static EdDSASigner newSigner(PrivateKey privateKey, String kid) {
-    return new EdDSASigner(Algorithm.EdDSA, privateKey, kid);
+    return new EdDSASigner(privateKey, kid);
   }
 
   /**
@@ -92,7 +95,7 @@ public static EdDSASigner newSigner(PrivateKey privateKey, String kid) {
    * @return a new EdDSA signer.
    */
   public static EdDSASigner newSigner(PrivateKey privateKey) {
-    return new EdDSASigner(Algorithm.EdDSA, privateKey, null);
+    return new EdDSASigner(privateKey, null);
   }
 
   /**
@@ -103,7 +106,7 @@ public static EdDSASigner newSigner(PrivateKey privateKey) {
    * @return a new EdDSA signer.
    */
   public static EdDSASigner newSigner(String privateKey, String kid) {
-    return new EdDSASigner(Algorithm.EdDSA, privateKey, kid);
+    return new EdDSASigner(privateKey, kid);
   }
 
   /**
@@ -113,12 +116,12 @@ public static EdDSASigner newSigner(String privateKey, String kid) {
    * @return a new EdDSA signer.
    */
   public static EdDSASigner newSigner(String privateKey) {
-    return new EdDSASigner(Algorithm.EdDSA, privateKey, null);
+    return new EdDSASigner(privateKey, null);
   }
 
   @Override
   public Algorithm getAlgorithm() {
-    return Algorithm.EdDSA;
+    return this.algorithm;
   }
 
   @Override
diff --git a/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java b/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java
index 3e7cd9b7..c0ccb079 100644
--- a/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java
+++ b/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java
@@ -39,6 +39,8 @@
  * @author Daniel DeGroff
  */
 public class EdDSAVerifier implements Verifier {
+  private final Algorithm algorithm;
+
   private final EdECPublicKey publicKey;
 
   private EdDSAVerifier(PublicKey publicKey) {
@@ -49,6 +51,10 @@ private EdDSAVerifier(PublicKey publicKey) {
     }
 
     this.publicKey = (EdECPublicKey) publicKey;
+    this.algorithm = Algorithm.fromName(this.publicKey.getParams().getName());
+    if (this.algorithm == null) {
+      throw new InvalidKeyTypeException("Unsupported algorithm reported by the public key. [" + this.publicKey.getParams().getName() + "].");
+    }
   }
 
   private EdDSAVerifier(String publicKey) {
@@ -64,6 +70,10 @@ private EdDSAVerifier(String publicKey) {
     }
 
     this.publicKey = pem.getPublicKey();
+    this.algorithm = Algorithm.fromName(this.publicKey.getParams().getName());
+    if (this.algorithm == null) {
+      throw new InvalidKeyTypeException("Unsupported algorithm reported by the public key. [" + this.publicKey.getParams().getName() + "].");
+    }
   }
 
   /**
@@ -105,7 +115,7 @@ public static EdDSAVerifier newVerifier(PublicKey publicKey) {
 
   @Override
   public boolean canVerify(Algorithm algorithm) {
-    return algorithm.equals(Algorithm.EdDSA);
+    return this.algorithm == algorithm;
   }
 
   @Override
diff --git a/src/main/java/io/fusionauth/jwt/rsa/RSAVerifier.java b/src/main/java/io/fusionauth/jwt/rsa/RSAVerifier.java
index c5aee760..6ddf8fdb 100644
--- a/src/main/java/io/fusionauth/jwt/rsa/RSAVerifier.java
+++ b/src/main/java/io/fusionauth/jwt/rsa/RSAVerifier.java
@@ -119,14 +119,10 @@ public static RSAVerifier newVerifier(byte[] bytes) {
   @Override
   @SuppressWarnings("Duplicates")
   public boolean canVerify(Algorithm algorithm) {
-    switch (algorithm) {
-      case RS256:
-      case RS384:
-      case RS512:
-        return true;
-      default:
-        return false;
-    }
+    return switch (algorithm) {
+      case RS256, RS384, RS512 -> true;
+      default -> false;
+    };
   }
 
   public void verify(Algorithm algorithm, byte[] message, byte[] signature) {
diff --git a/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java b/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
index a77edd5a..e23c47dd 100644
--- a/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
+++ b/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
@@ -184,8 +184,16 @@ public void eddsa_public() throws Exception {
     EdECPublicKey key25519 = PEM.decode(Paths.get("src/test/resources/ed_dsa_ed25519_public_key.pem")).getPublicKey();
     assertJSONEquals(JSONWebKey.build(key25519), "src/test/resources/jwk/ed_dsa_ed25519_public_key.json");
 
+    // X.509 PEM encoded
+    Certificate cert25519 = PEM.decode(Paths.get("src/test/resources/ed_dsa_ed25519_certificate.pem")).certificate;
+    assertJSONEquals(JSONWebKey.build(cert25519), "src/test/resources/jwk/ed_dsa_ed25519_certificate.json");
+
     // ed448
     EdECPublicKey key448 = PEM.decode(Paths.get("src/test/resources/ed_dsa_ed448_public_key.pem")).getPublicKey();
     assertJSONEquals(JSONWebKey.build(key448), "src/test/resources/jwk/ed_dsa_ed448_public_key.json");
+
+    // X.509 PEM encoded
+    Certificate cert448 = PEM.decode(Paths.get("src/test/resources/ed_dsa_ed448_certificate.pem")).certificate;
+    assertJSONEquals(JSONWebKey.build(cert448), "src/test/resources/jwk/ed_dsa_ed448_certificate.json");
   }
 }
diff --git a/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java b/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
index 80110aca..d29a2e8c 100644
--- a/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
+++ b/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
@@ -221,7 +221,7 @@ public void parse_eddsa(String curve) {
 
     // Build a JSON Web Key from our own EdDSA key pair
     JSONWebKey expected = JSONWebKey.build(keyPair.publicKey);
-    expected.alg = Algorithm.EdDSA;
+    expected.alg = Algorithm.Ed25519;
 
     PublicKey publicKey = JSONWebKey.parse(expected);
     assertNotNull(publicKey);
diff --git a/src/test/java/io/fusionauth/jwt/OpenIdConnectTest.java b/src/test/java/io/fusionauth/jwt/OpenIdConnectTest.java
index 30ef232e..95183573 100644
--- a/src/test/java/io/fusionauth/jwt/OpenIdConnectTest.java
+++ b/src/test/java/io/fusionauth/jwt/OpenIdConnectTest.java
@@ -16,6 +16,7 @@
 
 package io.fusionauth.jwt;
 
+import io.fusionauth.BaseTest;
 import io.fusionauth.jwt.domain.Algorithm;
 import org.testng.annotations.Test;
 
@@ -27,7 +28,7 @@
 /**
  * @author Daniel DeGroff
  */
-public class OpenIdConnectTest {
+public class OpenIdConnectTest extends BaseTest {
   @Test
   public void test_at_hash() {
     assertEquals(at_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.HS256), "wfgvmE9VxjAudsl9lc6TqA");
@@ -42,13 +43,31 @@ public void test_at_hash() {
     assertEquals(at_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.RS384), "phZaPQJosyg-qi-OIYyQ3xJB9wsHYEEz");
     assertEquals(at_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.RS512), "8xltSlOGYrWy8W9yNvRlEth1i_bXW-JROWPLvCv5zog");
 
-    // Note that we are not able to differentiate between ed25519 and ed448
-    // - https://bitbucket.org/openid/connect/issues/1125/_hash-algorithm-for-eddsa-id-tokens
-    assertEquals(at_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.EdDSA), "8xltSlOGYrWy8W9yNvRlEth1i_bXW-JROWPLvCv5zog");
+    assertEquals(at_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.Ed25519), "8xltSlOGYrWy8W9yNvRlEth1i_bXW-JROWPLvCv5zog");
+    requiresShake256(() ->
+        assertEquals(at_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.Ed448), "ACuRpk9jl5IEa3yqpBCNNOCpBEI7qjud6mc80cs6vWX2fcqpsk8RozYBKTUuSS6SqJhw302xFZeM"));
 
     // Controls
     assertEquals(at_hash("1940a308-d492-3660-a9f8-46723cc582e9", Algorithm.RS256), "JrZY9MtYVEIIJUx-DDBmww");
     assertEquals(at_hash("jHkWEdUXMU1BwAsC4vtUsZwnNvTIxEl0z9K3vx5KF0Y", Algorithm.RS256), "77QmUPtjPfzWtF2AnpK9RQ");
+    // https://bitbucket.org/openid/connect/issues/1125
+    requiresShake256(() ->
+        assertEquals(at_hash("YmJiZTAwYmYtMzgyOC00NzhkLTkyOTItNjJjNDM3MGYzOWIy9sFhvH8K_x8UIHj1osisS57f5DduL", Algorithm.Ed448), "sB_U72jyb0WgtX8TsVoqJnm6CD295W9gfSDRxkilB3LAL7REi9JYutRW_s1yE4lD8cOfMZf83gi4"));
+  }
+
+  private void requiresShake256(Runnable runnable) {
+    // The JCA does not ship with SHAKE256 which will be used to calculate the hash for Ed448.
+    // - Expect failure unless FIPS has been enabled.
+    try {
+      runnable.run();
+      if (!FipsEnabled) {
+        fail("Expected this to fail unless FIPS was enabled.");
+      }
+    } catch (Exception e) {
+      if (FipsEnabled) {
+        throw e;
+      }
+    }
   }
 
   @Test
@@ -65,9 +84,17 @@ public void test_c_hash() {
     assertEquals(c_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.RS384), "phZaPQJosyg-qi-OIYyQ3xJB9wsHYEEz");
     assertEquals(c_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.RS512), "8xltSlOGYrWy8W9yNvRlEth1i_bXW-JROWPLvCv5zog");
 
-    // Note that we are not able to differentiate between ed25519 and ed448
-    // - https://bitbucket.org/openid/connect/issues/1125/_hash-algorithm-for-eddsa-id-tokens
-    assertEquals(c_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.EdDSA), "8xltSlOGYrWy8W9yNvRlEth1i_bXW-JROWPLvCv5zog");
+    assertEquals(c_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.Ed25519), "8xltSlOGYrWy8W9yNvRlEth1i_bXW-JROWPLvCv5zog");
+
+    // The JCA does not ship with SHAKE256 which will be used to calculate the hash for Ed448.
+    // - Expect this to fail unless FIPS has been enabled.
+    try {
+      assertEquals(c_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.Ed448), "ACuRpk9jl5IEa3yqpBCNNOCpBEI7qjud6mc80cs6vWX2fcqpsk8RozYBKTUuSS6SqJhw302xFZeM");
+    } catch (Exception e) {
+      if (FipsEnabled) {
+        throw e;
+      }
+    }
 
     // Controls
     assertEquals(c_hash("16fd899f-5f0c-3114-875e-2547b629cd05", Algorithm.HS256), "S5UOXRNNyYsI6Z0G3xxdpw");
diff --git a/src/test/java/io/fusionauth/jwt/ed/EdDSASignerTest.java b/src/test/java/io/fusionauth/jwt/ed/EdDSASignerTest.java
index 3698e019..b054e98a 100644
--- a/src/test/java/io/fusionauth/jwt/ed/EdDSASignerTest.java
+++ b/src/test/java/io/fusionauth/jwt/ed/EdDSASignerTest.java
@@ -17,6 +17,7 @@
 package io.fusionauth.jwt.ed;
 
 import io.fusionauth.jwt.BaseJWTTest;
+import io.fusionauth.jwt.MissingVerifierException;
 import io.fusionauth.jwt.Signer;
 import io.fusionauth.jwt.Verifier;
 import io.fusionauth.jwt.domain.JWT;
@@ -28,6 +29,8 @@
 
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertTrue;
+import static org.testng.Assert.fail;
 
 /**
  * @author Daniel DeGroff
@@ -46,7 +49,17 @@ public void signAndVerify() throws Exception {
     JWT actual = JWT.getDecoder().decode(encodedJWT, verifier);
 
     assertEquals(actual.subject, jwt.subject);
-    assertEquals(actual.header.algorithm.name(), "EdDSA");
+    assertEquals(actual.header.algorithm.name(), "Ed25519");
+
+    Verifier verifier448 = EdDSAVerifier.newVerifier(getPath("ed_dsa_ed448_public_key.pem"));
+    try {
+      // You can't double stamp a triple stamp, or verify a JWT signed using Ed25519 with an Ed448 verifier.
+      JWT.getDecoder().decode(encodedJWT, verifier448);
+      fail("Expected an exception to be thrown.");
+    } catch (Exception e) {
+      assertTrue(e instanceof MissingVerifierException);
+      assertEquals(e.getMessage(), "No Verifier has been provided for verify a signature signed using [Ed25519]");
+    }
   }
 
   @Test
diff --git a/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java b/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java
index de8f3ba6..a40ac3bc 100644
--- a/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java
+++ b/src/test/java/io/fusionauth/jwt/ed/EdDSAVerifierTest.java
@@ -28,6 +28,7 @@
 import java.util.List;
 
 import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertFalse;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.assertTrue;
 
@@ -38,15 +39,17 @@ public class EdDSAVerifierTest extends BaseJWTTest {
   @Test
   public void canVerify() {
     Verifier verifier = EdDSAVerifier.newVerifier(getPath("ed_dsa_public_key.pem"));
-    assertTrue(verifier.canVerify(Algorithm.EdDSA));
+    assertTrue(verifier.canVerify(Algorithm.Ed25519));
     PEM pem = PEM.decode(getPath("ed_dsa_public_key.pem"));
     EdDSAVerifier.newVerifier(pem.publicKey);
 
     Verifier verifier25519 = EdDSAVerifier.newVerifier(getPath("ed_dsa_ed25519_public_key.pem"));
-    assertTrue(verifier25519.canVerify(Algorithm.EdDSA));
+    assertTrue(verifier25519.canVerify(Algorithm.Ed25519));
+    assertFalse(verifier25519.canVerify(Algorithm.Ed448));
 
     Verifier verifier448 = EdDSAVerifier.newVerifier(getPath("ed_dsa_ed448_public_key.pem"));
-    assertTrue(verifier448.canVerify(Algorithm.EdDSA));
+    assertFalse(verifier448.canVerify(Algorithm.Ed25519));
+    assertTrue(verifier448.canVerify(Algorithm.Ed448));
   }
 
   @Test
diff --git a/src/test/resources/ed_dsa_ed25519_certificate.pem b/src/test/resources/ed_dsa_ed25519_certificate.pem
new file mode 100644
index 00000000..827458d9
--- /dev/null
+++ b/src/test/resources/ed_dsa_ed25519_certificate.pem
@@ -0,0 +1,9 @@
+-----BEGIN CERTIFICATE-----
+MIIBRjCB+aADAgECAhRkaWbKP+7fMvU0YeWFaLNP4fTOrDAFBgMrZXAwGTEXMBUG
+A1UEAwwOWW91ckNvbW1vbk5hbWUwHhcNMjUxMTE5MTgzNzExWhcNMzUxMTE3MTgz
+NzExWjAZMRcwFQYDVQQDDA5Zb3VyQ29tbW9uTmFtZTAqMAUGAytlcAMhAJt4YOrK
+ZL0N9aJoVxx//7seQcJXkpbnzlxHzpVFjpd9o1MwUTAdBgNVHQ4EFgQU0EsYYr79
+uEtDvXm5BC7S2cP/l3wwHwYDVR0jBBgwFoAU0EsYYr79uEtDvXm5BC7S2cP/l3ww
+DwYDVR0TAQH/BAUwAwEB/zAFBgMrZXADQQCng75PlxDw8C/6YsU0xmR1CCIrysno
+dQUc/Y+SidnkIdUOuX02nkUwmUacmiZqoiPazywA1mS9TiHyh9tIBYIO
+-----END CERTIFICATE-----
diff --git a/src/test/resources/ed_dsa_ed448_certificate.pem b/src/test/resources/ed_dsa_ed448_certificate.pem
new file mode 100644
index 00000000..a1095f58
--- /dev/null
+++ b/src/test/resources/ed_dsa_ed448_certificate.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBkjCCARKgAwIBAgIUN0sbt0cpXo+mn5o2kU9Kp9F2e+kwBQYDK2VxMBkxFzAV
+BgNVBAMMDllvdXJDb21tb25OYW1lMB4XDTI1MTExOTE4Mzc1NVoXDTM1MTExNzE4
+Mzc1NVowGTEXMBUGA1UEAwwOWW91ckNvbW1vbk5hbWUwQzAFBgMrZXEDOgBrxOwI
+OB/g8RZoBmAoNYziyKnx7CVA0YG+b2D77k5k5rhIwXnZbDMybdEsy+bBHtApB5b5
+dcJT+gCjUzBRMB0GA1UdDgQWBBSQ6b0X7ezulZj6ELR0xIO+Jb+WBTAfBgNVHSME
+GDAWgBSQ6b0X7ezulZj6ELR0xIO+Jb+WBTAPBgNVHRMBAf8EBTADAQH/MAUGAytl
+cQNzACin0AxBvCvWbsKKeToIXdmnvD+1OgAeuysO77Y/dyiNInkFxINrxtbNrbx+
+EDuLyGO5oHgal6usgJ/83RapwP2+Zfed+a4ZQ/HynSKNNzOo2LEWDC0mpu3/4ASa
+TIhpiM800u/QzXilSexuTUG8tZwYAA==
+-----END CERTIFICATE-----
diff --git a/src/test/resources/jwk/ed_dsa_ed25519_certificate.json b/src/test/resources/jwk/ed_dsa_ed25519_certificate.json
new file mode 100644
index 00000000..ea0ab935
--- /dev/null
+++ b/src/test/resources/jwk/ed_dsa_ed25519_certificate.json
@@ -0,0 +1,13 @@
+{
+  "alg": "Ed25519",
+  "crv": "Ed25519",
+  "kty": "OKP",
+  "use": "sig",
+  "x": "m3hg6spkvQ31omhXHH__ux5BwleSlufOXEfOlUWOl30",
+  "x5c": [
+    "MIIBRjCB+aADAgECAhRkaWbKP+7fMvU0YeWFaLNP4fTOrDAFBgMrZXAwGTEXMBUGA1UEAwwOWW91ckNvbW1vbk5hbWUwHhcNMjUxMTE5MTgzNzExWhcNMzUxMTE3MTgzNzExWjAZMRcwFQYDVQQDDA5Zb3VyQ29tbW9uTmFtZTAqMAUGAytlcAMhAJt4YOrKZL0N9aJoVxx//7seQcJXkpbnzlxHzpVFjpd9o1MwUTAdBgNVHQ4EFgQU0EsYYr79uEtDvXm5BC7S2cP/l3wwHwYDVR0jBBgwFoAU0EsYYr79uEtDvXm5BC7S2cP/l3wwDwYDVR0TAQH/BAUwAwEB/zAFBgMrZXADQQCng75PlxDw8C/6YsU0xmR1CCIrysnodQUc/Y+SidnkIdUOuX02nkUwmUacmiZqoiPazywA1mS9TiHyh9tIBYIO"
+  ],
+  "x5t": "JPLrwBHnDr6gxvCHibgDjW6yJCk",
+  "x5t#S256": "aSQLmuU9GKdPVWLRAnUB9dD3Kgm_RlPuFGDR7VoL_yE",
+  "y": "fZeORZXOR1zO55aSV8JBHrv_fxxXaKL1Db1kyupgeJs"
+}
diff --git a/src/test/resources/jwk/ed_dsa_ed25519_private_key.json b/src/test/resources/jwk/ed_dsa_ed25519_private_key.json
index 58f3e155..676268d4 100644
--- a/src/test/resources/jwk/ed_dsa_ed25519_private_key.json
+++ b/src/test/resources/jwk/ed_dsa_ed25519_private_key.json
@@ -1,5 +1,5 @@
 {
-  "alg": "EdDSA",
+  "alg": "Ed25519",
   "crv": "Ed25519",
   "d": "GTDyWShKV_tcBWleClj9I9qxuSCqoxPrGvV5-RZSeJU",
   "kty": "OKP",
diff --git a/src/test/resources/jwk/ed_dsa_ed25519_public_key.json b/src/test/resources/jwk/ed_dsa_ed25519_public_key.json
index c8ab5d5b..8bedf1ff 100644
--- a/src/test/resources/jwk/ed_dsa_ed25519_public_key.json
+++ b/src/test/resources/jwk/ed_dsa_ed25519_public_key.json
@@ -1,5 +1,5 @@
 {
-  "alg": "EdDSA",
+  "alg": "Ed25519",
   "crv": "Ed25519",
   "kty": "OKP",
   "use": "sig",
diff --git a/src/test/resources/jwk/ed_dsa_ed448_certificate.json b/src/test/resources/jwk/ed_dsa_ed448_certificate.json
new file mode 100644
index 00000000..6e786517
--- /dev/null
+++ b/src/test/resources/jwk/ed_dsa_ed448_certificate.json
@@ -0,0 +1,13 @@
+{
+  "alg": "Ed448",
+  "crv": "Ed448",
+  "kty": "OKP",
+  "use": "sig",
+  "x": "a8TsCDgf4PEWaAZgKDWM4sip8ewlQNGBvm9g--5OZOa4SMF52WwzMm3RLMvmwR7QKQeW-XXCU_oA",
+  "x5c": [
+    "MIIBkjCCARKgAwIBAgIUN0sbt0cpXo+mn5o2kU9Kp9F2e+kwBQYDK2VxMBkxFzAVBgNVBAMMDllvdXJDb21tb25OYW1lMB4XDTI1MTExOTE4Mzc1NVoXDTM1MTExNzE4Mzc1NVowGTEXMBUGA1UEAwwOWW91ckNvbW1vbk5hbWUwQzAFBgMrZXEDOgBrxOwIOB/g8RZoBmAoNYziyKnx7CVA0YG+b2D77k5k5rhIwXnZbDMybdEsy+bBHtApB5b5dcJT+gCjUzBRMB0GA1UdDgQWBBSQ6b0X7ezulZj6ELR0xIO+Jb+WBTAfBgNVHSMEGDAWgBSQ6b0X7ezulZj6ELR0xIO+Jb+WBTAPBgNVHRMBAf8EBTADAQH/MAUGAytlcQNzACin0AxBvCvWbsKKeToIXdmnvD+1OgAeuysO77Y/dyiNInkFxINrxtbNrbx+EDuLyGO5oHgal6usgJ/83RapwP2+Zfed+a4ZQ/HynSKNNzOo2LEWDC0mpu3/4ASaTIhpiM800u/QzXilSexuTUG8tZwYAA=="
+  ],
+  "x5t": "s6yEmdTmvYlE14xE62q9JgEa3sA",
+  "x5t#S256": "eZJkos1xtzK7wCH9ZcRX9e6LFpbSOKaATVphIFjj8v0",
+  "y": "APpTwnX5lgcp0B7B5sss0W0yM2zZecFIuOZkTu77YG--gdFAJezxqcjijDUoYAZoFvHgHzgI7MRr"
+}
diff --git a/src/test/resources/jwk/ed_dsa_ed448_private_key.json b/src/test/resources/jwk/ed_dsa_ed448_private_key.json
index eff55f80..0cf6408a 100644
--- a/src/test/resources/jwk/ed_dsa_ed448_private_key.json
+++ b/src/test/resources/jwk/ed_dsa_ed448_private_key.json
@@ -1,5 +1,5 @@
 {
-  "alg": "EdDSA",
+  "alg": "Ed448",
   "crv": "Ed448",
   "d": "1myhFBFcCoH6SgpuL4IYwedjSyCh_N957uuCKvdUsV9nGrDuwkpfhECLpR5zbSxoDJSCXZVEEnIk",
   "kty": "OKP",
diff --git a/src/test/resources/jwk/ed_dsa_ed448_public_key.json b/src/test/resources/jwk/ed_dsa_ed448_public_key.json
index 7d3005d1..773cdf43 100644
--- a/src/test/resources/jwk/ed_dsa_ed448_public_key.json
+++ b/src/test/resources/jwk/ed_dsa_ed448_public_key.json
@@ -1,5 +1,5 @@
 {
-  "alg": "EdDSA",
+  "alg": "Ed448",
   "crv": "Ed448",
   "kty": "OKP",
   "use": "sig",
diff --git a/src/test/resources/jwk/ed_dsa_private_key.json b/src/test/resources/jwk/ed_dsa_private_key.json
index 519550eb..8428040b 100644
--- a/src/test/resources/jwk/ed_dsa_private_key.json
+++ b/src/test/resources/jwk/ed_dsa_private_key.json
@@ -1,7 +1,7 @@
 {
-  "alg": "EdDSA",
+  "alg": "Ed25519",
   "crv": "Ed25519",
   "kty": "OKP",
   "use": "sig",
   "d": ""
-}
\ No newline at end of file
+}
diff --git a/src/test/resources/jwk/ed_dsa_public_key.json b/src/test/resources/jwk/ed_dsa_public_key.json
index c84acd17..d6bea8a4 100644
--- a/src/test/resources/jwk/ed_dsa_public_key.json
+++ b/src/test/resources/jwk/ed_dsa_public_key.json
@@ -1,7 +1,7 @@
 {
-  "alg": "EdDSA",
+  "alg": "Ed25519",
   "crv": "Ed25519",
   "kty": "OKP",
   "use": "sig",
   "x": "Z0zsq2DU48BL841rio_Xt6BIPmhpPfJHFe5h_2-S_O0"
-}
\ No newline at end of file
+}

From c1b285083d79c1127b25792156e01167d83b39c1 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Wed, 19 Nov 2025 12:00:29 -0700
Subject: [PATCH 15/29] cleanup

---
 build.savant                                      | 15 +++++++--------
 .../io/fusionauth/jwks/JSONWebKeyBuilderTest.java | 10 ++++++++++
 .../io/fusionauth/jwks/JSONWebKeyParserTest.java  | 10 ++++++++++
 src/test/java/io/fusionauth/jwt/JWTTest.java      | 10 ++++++++++
 .../java/io/fusionauth/pem/PEMEncoderTest.java    | 10 ++++++++++
 .../io/fusionauth/security/KeyUtilsTests.java     | 12 +++++++++++-
 6 files changed, 58 insertions(+), 9 deletions(-)

diff --git a/build.savant b/build.savant
index 652e6f51..2f6612b3 100644
--- a/build.savant
+++ b/build.savant
@@ -99,16 +99,15 @@ target(name: "test", description: "Runs the project's tests", dependsOn: ["jar"]
   // Example:
   // javaTestNG.settings.jvmArguments += "-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=5005"
 
+  boolean[] fipsEnabled = [true, false]
   if (switches.has("fips")) {
-    javaTestNG.settings.jvmArguments = "-Dtest.fips=true"
-    javaTestNG.test()
+    fipsEnabled = [true]
   } else if (switches.has("jca")) {
-    javaTestNG.settings.jvmArguments = "-Dtest.fips=false"
-    javaTestNG.test()
-  } else {
-    javaTestNG.settings.jvmArguments = "-Dtest.fips=false"
-    javaTestNG.test()
-    javaTestNG.settings.jvmArguments = "-Dtest.fips=true"
+    fipsEnabled = [false]
+  }
+
+  fipsEnabled.each { enabled ->
+    javaTestNG.settings.jvmArguments = "-Dtest.fips=${enabled}"
     javaTestNG.test()
   }
 }
diff --git a/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java b/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
index e23c47dd..bacc2fc2 100644
--- a/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
+++ b/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
@@ -41,6 +41,16 @@
 import static org.testng.Assert.assertEquals;
 
 /**
+ * Note that the higher invocationCount parameters are helpful to indentify incorrect assumptions in key parsing.
+ * <p>
+ * Key lengths can differ, and when encoding larger integers in DER encode sequences, or parsing them in and out of
+ * JWK formats, we want to be certain we are not making incorrect assumptions. During development, you may wish to
+ * run some of these with 5-10k invocation counts to ensure these types of anomalies are un-covered and addressed.
+ * <p>
+ * It may be reasonable to reduce the invocation counts if tests take too long to run - once we know that the tests
+ * will pass with a high number of invocations. However, the time is not yet that significant, and there is value to
+ * ensuring that the same result can be expected regardless of the number of times we run the same test.
+ *
  * @author Daniel DeGroff
  */
 public class JSONWebKeyBuilderTest extends BaseJWTTest {
diff --git a/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java b/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
index d29a2e8c..c39b0e7d 100644
--- a/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
+++ b/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
@@ -41,6 +41,16 @@
 import static org.testng.Assert.fail;
 
 /**
+ * Note that the higher invocationCount parameters are helpful to indentify incorrect assumptions in key parsing.
+ * <p>
+ * Key lengths can differ, and when encoding larger integers in DER encode sequences, or parsing them in and out of
+ * JWK formats, we want to be certain we are not making incorrect assumptions. During development, you may wish to
+ * run some of these with 5-10k invocation counts to ensure these types of anomalies are un-covered and addressed.
+ * <p>
+ * It may be reasonable to reduce the invocation counts if tests take too long to run - once we know that the tests
+ * will pass with a high number of invocations. However, the time is not yet that significant, and there is value to
+ * ensuring that the same result can be expected regardless of the number of times we run the same test.
+ *
  * @author Daniel DeGroff
  */
 public class JSONWebKeyParserTest extends BaseJWTTest {
diff --git a/src/test/java/io/fusionauth/jwt/JWTTest.java b/src/test/java/io/fusionauth/jwt/JWTTest.java
index 77ca352a..a76ad473 100644
--- a/src/test/java/io/fusionauth/jwt/JWTTest.java
+++ b/src/test/java/io/fusionauth/jwt/JWTTest.java
@@ -59,6 +59,16 @@
 import static org.testng.Assert.assertTrue;
 
 /**
+ * Note that the higher invocationCount parameters are helpful to indentify incorrect assumptions in key parsing.
+ * <p>
+ * Key lengths can differ, and when encoding larger integers in DER encode sequences, or parsing them in and out of
+ * JWK formats, we want to be certain we are not making incorrect assumptions. During development, you may wish to
+ * run some of these with 5-10k invocation counts to ensure these types of anomalies are un-covered and addressed.
+ * <p>
+ * It may be reasonable to reduce the invocation counts if tests take too long to run - once we know that the tests
+ * will pass with a high number of invocations. However, the time is not yet that significant, and there is value to
+ * ensuring that the same result can be expected regardless of the number of times we run the same test.
+ *
  * @author Daniel DeGroff
  */
 public class JWTTest extends BaseJWTTest {
diff --git a/src/test/java/io/fusionauth/pem/PEMEncoderTest.java b/src/test/java/io/fusionauth/pem/PEMEncoderTest.java
index 75b04c3a..9df7458c 100644
--- a/src/test/java/io/fusionauth/pem/PEMEncoderTest.java
+++ b/src/test/java/io/fusionauth/pem/PEMEncoderTest.java
@@ -36,6 +36,16 @@
 import static org.testng.Assert.assertTrue;
 
 /**
+ * Note that the higher invocationCount parameters are helpful to indentify incorrect assumptions in key parsing.
+ * <p>
+ * Key lengths can differ, and when encoding larger integers in DER encode sequences, or parsing them in and out of
+ * JWK formats, we want to be certain we are not making incorrect assumptions. During development, you may wish to
+ * run some of these with 5-10k invocation counts to ensure these types of anomalies are un-covered and addressed.
+ * <p>
+ * It may be reasonable to reduce the invocation counts if tests take too long to run - once we know that the tests
+ * will pass with a high number of invocations. However, the time is not yet that significant, and there is value to
+ * ensuring that the same result can be expected regardless of the number of times we run the same test.
+ *
  * @author Daniel DeGroff
  */
 public class PEMEncoderTest extends BaseTest {
diff --git a/src/test/java/io/fusionauth/security/KeyUtilsTests.java b/src/test/java/io/fusionauth/security/KeyUtilsTests.java
index 198f5382..9a1d49a9 100644
--- a/src/test/java/io/fusionauth/security/KeyUtilsTests.java
+++ b/src/test/java/io/fusionauth/security/KeyUtilsTests.java
@@ -28,6 +28,16 @@
 import static org.testng.Assert.assertEquals;
 
 /**
+ * Note that the higher invocationCount parameters are helpful to indentify incorrect assumptions in key parsing.
+ * <p>
+ * Key lengths can differ, and when encoding larger integers in DER encode sequences, or parsing them in and out of
+ * JWK formats, we want to be certain we are not making incorrect assumptions. During development, you may wish to
+ * run some of these with 5-10k invocation counts to ensure these types of anomalies are un-covered and addressed.
+ * <p>
+ * It may be reasonable to reduce the invocation counts if tests take too long to run - once we know that the tests
+ * will pass with a high number of invocations. However, the time is not yet that significant, and there is value to
+ * ensuring that the same result can be expected regardless of the number of times we run the same test.
+ *
  * @author Daniel DeGroff
  */
 public class KeyUtilsTests {
@@ -60,7 +70,7 @@ public void problematicKey() {
 
   // Running 500 times to ensure we get consistency. EC keys can vary in length, but the "reported" size returned
   // from the .getKeyLength() should be consistent. Out of 500 tests (if we had an error in the logic) we may get 1-5
-  // failures where the key is not an exact size and we have to figure out which key size it should be reported as.
+  // failures where the key is not an exact size, and we have to figure out which key size it should be reported as.
   // - For testing locally, you can ramp up this invocation count to 100k or something like that to prove that we have
   //   consistency over time.
   @Test(dataProvider = "ecKeyLengths", invocationCount = 500)

From 7e4b5d22d0602ef2b737cd6b415654327a8aad74 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Wed, 19 Nov 2025 12:05:03 -0700
Subject: [PATCH 16/29] cleanup

---
 build.savant | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/build.savant b/build.savant
index 2f6612b3..edc25813 100644
--- a/build.savant
+++ b/build.savant
@@ -31,9 +31,6 @@ project(group: "io.fusionauth", name: "fusionauth-jwt", version: "6.0.0", licens
     publish {
       cache()
     }
-    semanticVersions {
-      mapping(id: "org.bouncycastle:bc-fips:1.0.2.6", version: "1.0.2+P6")
-    }
   }
 
   publishWorkflow {

From 70ea74212a66f6b9f0c5500d600ae4586aab3eeb Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Wed, 19 Nov 2025 12:51:46 -0700
Subject: [PATCH 17/29] cleanup

---
 README.md                                     | 23 ++++++-------------
 .../java/io/fusionauth/jwt/OpenIDConnect.java |  2 +-
 .../io/fusionauth/jwt/rsa/RSAVerifier.java    |  2 +-
 .../java/io/fusionauth/pem/PEMEncoder.java    |  2 +-
 .../java/io/fusionauth/security/KeyUtils.java | 13 +++++------
 .../io/fusionauth/security/KeyUtilsTests.java | 11 +++++++++
 6 files changed, 27 insertions(+), 26 deletions(-)

diff --git a/README.md b/README.md
index b9b9d6bc..f1989889 100644
--- a/README.md
+++ b/README.md
@@ -7,20 +7,11 @@ If you find a vulnerability or other security related bug, [please report the vu
 We are very interested in compensating anyone that can identify a security related bug or vulnerability and properly disclose it to us.
 
 ## Features
- - JWT signing using HMAC, RSA and Elliptic Curve support
-   - `HS256`
-   - `HS384`
-   - `HS512`
-   - `RS256`
-   - `RS384`
-   - `RS512`
-   - `ES256`
-   - `ES384`
-   - `ES512`
-   - `PS256` 
-   - `PS384`
-   - `PS512`
-   - `EdDSA` (`Ed25519` and `Ed448`)
+ - JWT signing using the following algorithms
+   - `HS256`, `HS384`, `HS512`, `RS256`, `RS384`, `RS512`, `ES256`, `ES384`, `ES512`, `PS256`, `PS384`, `PS512`, `Ed25519`, `Ed448`
+     - In order to use the OpenID Connect hashing functions for `at_hash` or `c_hash` with this algorithm, you must register a provider to add support for the `SHAKE256` message digest, such as BouncyCastle as this algorithm is not provided in the default JCA.
+     - When using `Ed25519` or `Ed448`, the `alg` JWT header and the JWK `alg` property will be equal to the algorithm name. The legacy `EdDSA` value has been deprecated in JOSE in favor of the fully-specified algorithm names `Ed25519` and `Ed448`. In practice this means that this library will be unable to accept a JWT using the `EdDSA` value for the `alg` in the JWT header.
+       - https://www.iana.org/assignments/jose/jose.xhtml#web-signature-encryption-algorithms
  - Support for Bouncy Castle JCE or other third party providers.   
  - PEM decoding / encoding
    - Decode PEM files to PrivateKey or PublicKey
@@ -35,9 +26,9 @@ We are very interested in compensating anyone that can identify a security relat
    - Retrieve JWK from JWKS endpoints
  - Helpers
    - Generate RSA Key Pairs in `2048`, `3072` or `4096` bit sizes
-   - Generate RSA pSS Key Pairs in `2048`, `3072` or `4096` bit sizes
+   - Generate RSA PSS Key Pairs in `2048`, `3072` or `4096` bit sizes
    - Generate EC Key Pairs in `256`, `384` and `521` bit sizes
-   - Generate EdDSA Key Pairs for `ed2559` and `ed448`
+   - Generate EdDSA Key Pairs for `ed2559` and `ed448` curves
    - Generate `x5t` and `x5t#256` values from X.509 Certificates
    - Generate JWK thumbprint using `SHA-1` or `SHA-256` 
    - Generate ideal HMAC secret lengths for `SHA-256`, `SHA-384` and `SHA-512`
diff --git a/src/main/java/io/fusionauth/jwt/OpenIDConnect.java b/src/main/java/io/fusionauth/jwt/OpenIDConnect.java
index b19b41fb..f5572bb0 100644
--- a/src/main/java/io/fusionauth/jwt/OpenIDConnect.java
+++ b/src/main/java/io/fusionauth/jwt/OpenIDConnect.java
@@ -82,7 +82,7 @@ private static String generate_hash(String string, Algorithm algorithm) {
       }
       default ->
           throw new IllegalArgumentException("You specified an unsupported algorithm. The algorithm [" + algorithm + "]"
-              + " is not supported. You must use EdDSA, ES256, ES384, ES512,  HS256, HS384, HS512, RS256, RS384 or RS512.");
+              + " is not supported. You must use Ed25519, Ed448, ES256, ES384, ES512,  HS256, HS384, HS512, RS256, RS384 or RS512.");
     };
 
     byte[] digest = string.getBytes(StandardCharsets.UTF_8);
diff --git a/src/main/java/io/fusionauth/jwt/rsa/RSAVerifier.java b/src/main/java/io/fusionauth/jwt/rsa/RSAVerifier.java
index 6ddf8fdb..f5744042 100644
--- a/src/main/java/io/fusionauth/jwt/rsa/RSAVerifier.java
+++ b/src/main/java/io/fusionauth/jwt/rsa/RSAVerifier.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2022, FusionAuth, All Rights Reserved
+ * Copyright (c) 2016-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/src/main/java/io/fusionauth/pem/PEMEncoder.java b/src/main/java/io/fusionauth/pem/PEMEncoder.java
index f7e67c48..28444d06 100644
--- a/src/main/java/io/fusionauth/pem/PEMEncoder.java
+++ b/src/main/java/io/fusionauth/pem/PEMEncoder.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
diff --git a/src/main/java/io/fusionauth/security/KeyUtils.java b/src/main/java/io/fusionauth/security/KeyUtils.java
index e33d4db7..d63ed07e 100644
--- a/src/main/java/io/fusionauth/security/KeyUtils.java
+++ b/src/main/java/io/fusionauth/security/KeyUtils.java
@@ -138,13 +138,12 @@ public static int getKeyLength(Key key) {
     } else if (key instanceof RSAKey rsaKey) {
       return rsaKey.getModulus().bitLength();
     } else if (key instanceof EdECKey edECKey) {
-      // Assuming Ed25519 or Ed448
-      if (key instanceof EdECPrivateKey) {
-        return edECKey.getParams().getName().equals("Ed25519")
-            ? 32 : 57;
-      } else if (key instanceof EdECPublicKey) {
-        return edECKey.getParams().getName().equals("Ed25519")
-            ? 32 : 57;
+      // Only recognizing Ed25519 and Ed448.
+      String curve = edECKey.getParams().getName();
+      if ("Ed25519".equals(curve)) {
+        return 32;
+      } else if ("Ed448".equals(curve)) {
+        return 57;
       }
     }
 
diff --git a/src/test/java/io/fusionauth/security/KeyUtilsTests.java b/src/test/java/io/fusionauth/security/KeyUtilsTests.java
index 9a1d49a9..cb77f754 100644
--- a/src/test/java/io/fusionauth/security/KeyUtilsTests.java
+++ b/src/test/java/io/fusionauth/security/KeyUtilsTests.java
@@ -16,6 +16,7 @@
 
 package io.fusionauth.security;
 
+import io.fusionauth.jwt.JWTUtils;
 import io.fusionauth.pem.domain.PEM;
 import org.testng.annotations.DataProvider;
 import org.testng.annotations.Test;
@@ -127,6 +128,11 @@ public void eddsa_25519_keyLength() throws Exception {
 
     assertEquals(KeyUtils.getKeyLength(keyPair.getPrivate()), 32);
     assertEquals(KeyUtils.getKeyLength(keyPair.getPublic()), 32);
+
+    io.fusionauth.jwt.domain.KeyPair keyPair2 = JWTUtils.generate_ed25519_EdDSAKeyPair();
+    PEM pem = PEM.decode(keyPair2.privateKey);
+    assertEquals(KeyUtils.getKeyLength(pem.privateKey), 32);
+    assertEquals(KeyUtils.getKeyLength(pem.publicKey), 32);
   }
 
   @Test
@@ -136,5 +142,10 @@ public void eddsa_448_keyLength() throws Exception {
 
     assertEquals(KeyUtils.getKeyLength(keyPair.getPrivate()), 57);
     assertEquals(KeyUtils.getKeyLength(keyPair.getPublic()), 57);
+
+    io.fusionauth.jwt.domain.KeyPair keyPair2 = JWTUtils.generate_ed448_EdDSAKeyPair();
+    PEM pem = PEM.decode(keyPair2.privateKey);
+    assertEquals(KeyUtils.getKeyLength(pem.privateKey), 57);
+    assertEquals(KeyUtils.getKeyLength(pem.publicKey), 57);
   }
 }

From a218f9c608afa134b0ba87e956d9426d22ac1102 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Wed, 19 Nov 2025 13:10:00 -0700
Subject: [PATCH 18/29] Replicate test runner config in pom.xml.

---
 pom.xml | 152 ++++++++++++++++++++++++++++++--------------------------
 1 file changed, 82 insertions(+), 70 deletions(-)

diff --git a/pom.xml b/pom.xml
index 27393b4a..e9c31cfd 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1,4 +1,5 @@
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://maven.apache.org/POM/4.0.0"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
     <modelVersion>4.0.0</modelVersion>
 
     <groupId>io.fusionauth</groupId>
@@ -7,7 +8,7 @@
     <packaging>jar</packaging>
 
     <name>FusionAuth JWT</name>
-    <description>A Java 8 fluent API for signing, verifying and building JSON Web Tokens</description>
+    <description>A Java library for signing, verifying and building JSON Web Tokens</description>
     <url>https://github.com/FusionAuth/fusionauth-jwt</url>
 
     <distributionManagement>
@@ -40,12 +41,12 @@
     </developers>
 
     <licenses>
-    <license>
-      <name>Apache-2.0</name>
-      <url>https://www.apache.org/licenses/LICENSE-2.0</url>
-      <distribution>repo</distribution>
-    </license>
-  </licenses>
+        <license>
+            <name>Apache-2.0</name>
+            <url>https://www.apache.org/licenses/LICENSE-2.0</url>
+            <distribution>repo</distribution>
+        </license>
+    </licenses>
 
     <scm>
         <connection>scm:git:ssh://github.com:fusionauth/fusionauth-jwt</connection>
@@ -53,62 +54,62 @@
     </scm>
 
     <properties>
-        <maven.compiler.source>1.8</maven.compiler.source>
-        <maven.compiler.target>1.8</maven.compiler.target>
+        <maven.compiler.source>17</maven.compiler.source>
+        <maven.compiler.target>17</maven.compiler.target>
         <java.module.version>9</java.module.version>
         <project.build.sourceEncoding>UTF8</project.build.sourceEncoding>
     </properties>
 
     <dependencies>
-    <dependency>
-      <groupId>com.fasterxml.jackson.core</groupId>
-      <artifactId>jackson-core</artifactId>
-      <version>2.15.4</version>
-      <type>jar</type>
-      <scope>compile</scope>
-      <optional>false</optional>
-    </dependency>
-    <dependency>
-      <groupId>com.fasterxml.jackson.core</groupId>
-      <artifactId>jackson-databind</artifactId>
-      <version>2.15.4</version>
-      <type>jar</type>
-      <scope>compile</scope>
-      <optional>false</optional>
-    </dependency>
-    <dependency>
-      <groupId>com.fasterxml.jackson.core</groupId>
-      <artifactId>jackson-annotations</artifactId>
-      <version>2.15.4</version>
-      <type>jar</type>
-      <scope>compile</scope>
-      <optional>false</optional>
-    </dependency>
-    <dependency>
-      <groupId>org.bouncycastle</groupId>
-      <artifactId>bc-fips</artifactId>
-      <version>2.1.2</version>
-      <type>jar</type>
-      <scope>test</scope>
-      <optional>false</optional>
-    </dependency>
-    <dependency>
-      <groupId>org.testng</groupId>
-      <artifactId>testng</artifactId>
-      <version>7.9.0</version>
-      <type>jar</type>
-      <scope>test</scope>
-      <optional>false</optional>
-    </dependency>
-    <dependency>
-      <groupId>org.slf4j</groupId>
-      <artifactId>slf4j-nop</artifactId>
-      <version>1.7.36</version>
-      <type>jar</type>
-      <scope>test</scope>
-      <optional>false</optional>
-    </dependency>
-  </dependencies>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-core</artifactId>
+            <version>2.15.4</version>
+            <type>jar</type>
+            <scope>compile</scope>
+            <optional>false</optional>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+            <version>2.15.4</version>
+            <type>jar</type>
+            <scope>compile</scope>
+            <optional>false</optional>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-annotations</artifactId>
+            <version>2.15.4</version>
+            <type>jar</type>
+            <scope>compile</scope>
+            <optional>false</optional>
+        </dependency>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bc-fips</artifactId>
+            <version>2.1.2</version>
+            <type>jar</type>
+            <scope>test</scope>
+            <optional>false</optional>
+        </dependency>
+        <dependency>
+            <groupId>org.testng</groupId>
+            <artifactId>testng</artifactId>
+            <version>7.9.0</version>
+            <type>jar</type>
+            <scope>test</scope>
+            <optional>false</optional>
+        </dependency>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-nop</artifactId>
+            <version>1.7.36</version>
+            <type>jar</type>
+            <scope>test</scope>
+            <optional>false</optional>
+        </dependency>
+    </dependencies>
 
     <build>
         <plugins>
@@ -116,19 +117,30 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
                 <version>3.0.0-M5</version>
-                <configuration>
-                    <properties>
-                        <property>
-                            <name>listener</name>
-                            <value>io.fusionauth.jwt.TestNGAnnotationTransformer</value>
-                        </property>
-                    </properties>
-                </configuration>
+                <!-- Run the tests twice, w/ and w/out FIPS enabled -->
+                <executions>
+                    <execution>
+                        <id>test-with-fips-disabled</id>
+                        <configuration>
+                            <systemPropertyVariables>
+                                <test.fips>false</test.fips>
+                            </systemPropertyVariables>
+                        </configuration>
+                    </execution>
+                    <execution>
+                        <id>test-with-fips-enabled</id>
+                        <configuration>
+                            <systemPropertyVariables>
+                                <test.fips>true</test.fips>
+                            </systemPropertyVariables>
+                        </configuration>
+                    </execution>
+                </executions>
             </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-source-plugin</artifactId>
-                <version>2.2.1</version>
+                <version>3.3.1</version>
                 <executions>
                     <execution>
                         <id>attach-sources</id>
@@ -141,7 +153,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-javadoc-plugin</artifactId>
-                <version>2.9.1</version>
+                <version>3.11.2</version>
                 <executions>
                     <execution>
                         <id>attach-javadocs</id>
@@ -213,4 +225,4 @@
         </profile>
     </profiles>
 
-</project>
\ No newline at end of file
+</project>

From 2851e67dd0038b37e229f977bae3e7b19c51d1a1 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Wed, 19 Nov 2025 14:01:22 -0700
Subject: [PATCH 19/29] Quiet down javadoc plugin , README

---
 README.md | 40 ++++++++++++++++++++++++++++++++++++----
 pom.xml   | 22 +++-------------------
 2 files changed, 39 insertions(+), 23 deletions(-)

diff --git a/README.md b/README.md
index f1989889..fc81c586 100644
--- a/README.md
+++ b/README.md
@@ -28,7 +28,7 @@ We are very interested in compensating anyone that can identify a security relat
    - Generate RSA Key Pairs in `2048`, `3072` or `4096` bit sizes
    - Generate RSA PSS Key Pairs in `2048`, `3072` or `4096` bit sizes
    - Generate EC Key Pairs in `256`, `384` and `521` bit sizes
-   - Generate EdDSA Key Pairs for `ed2559` and `ed448` curves
+   - Generate EdDSA Key Pairs for `Ed2559` and `Ed448` curves
    - Generate `x5t` and `x5t#256` values from X.509 Certificates
    - Generate JWK thumbprint using `SHA-1` or `SHA-256` 
    - Generate ideal HMAC secret lengths for `SHA-256`, `SHA-384` and `SHA-512`
@@ -309,18 +309,50 @@ String json = jwk.toJSON();
 
 ## Building
  
-## Building with Maven
+### Maven
  ```bash
  $ mvn install
  ```
 
-
-## Building with Savant
+### Savant
 
 ```bash
 $ sb int
 ```
 
+## Testing
+
+### Maven
+ 
+ ```bash
+ $ mvn test
+ ```
+
+Run tests the BouncyCastle FIPS provider
+ 
+```bash
+ $ mvn test -Dtest.fips=true
+```
+
+### Savant
+
+```bash
+$ sb test
+```
+
+Run tests using only the BouncyCastle FIPS provider
+ 
+```bash
+ $ sb test --fips
+```
+
+Run tests using only the default JCA provider
+ 
+```bash
+ $ sb test --jca
+```
+
+## Savant Install
 **Note:** If you do not yet have Savant build tool installed, use the following instructions.
 
 ```bash
diff --git a/pom.xml b/pom.xml
index e9c31cfd..ec8f2b85 100644
--- a/pom.xml
+++ b/pom.xml
@@ -117,25 +117,6 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
                 <version>3.0.0-M5</version>
-                <!-- Run the tests twice, w/ and w/out FIPS enabled -->
-                <executions>
-                    <execution>
-                        <id>test-with-fips-disabled</id>
-                        <configuration>
-                            <systemPropertyVariables>
-                                <test.fips>false</test.fips>
-                            </systemPropertyVariables>
-                        </configuration>
-                    </execution>
-                    <execution>
-                        <id>test-with-fips-enabled</id>
-                        <configuration>
-                            <systemPropertyVariables>
-                                <test.fips>true</test.fips>
-                            </systemPropertyVariables>
-                        </configuration>
-                    </execution>
-                </executions>
             </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
@@ -154,6 +135,9 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-javadoc-plugin</artifactId>
                 <version>3.11.2</version>
+                <configuration>
+                    <doclint>all,-missing</doclint>
+                </configuration>
                 <executions>
                     <execution>
                         <id>attach-javadocs</id>

From 55ca4258ea4b048ad89dd34a87ce78b42486bfd4 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Wed, 19 Nov 2025 14:28:51 -0700
Subject: [PATCH 20/29] cleanup

---
 README.md                                     | 33 -------------------
 pom.xml                                       | 27 +++++++++++++++
 .../java/io/fusionauth/jwt/VerifierTest.java  | 22 ++++++-------
 .../io/fusionauth/jwt/ec/ECVerifierTest.java  | 26 +++++++--------
 4 files changed, 51 insertions(+), 57 deletions(-)

diff --git a/README.md b/README.md
index fc81c586..5ca75624 100644
--- a/README.md
+++ b/README.md
@@ -320,39 +320,6 @@ String json = jwk.toJSON();
 $ sb int
 ```
 
-## Testing
-
-### Maven
- 
- ```bash
- $ mvn test
- ```
-
-Run tests the BouncyCastle FIPS provider
- 
-```bash
- $ mvn test -Dtest.fips=true
-```
-
-### Savant
-
-```bash
-$ sb test
-```
-
-Run tests using only the BouncyCastle FIPS provider
- 
-```bash
- $ sb test --fips
-```
-
-Run tests using only the default JCA provider
- 
-```bash
- $ sb test --jca
-```
-
-## Savant Install
 **Note:** If you do not yet have Savant build tool installed, use the following instructions.
 
 ```bash
diff --git a/pom.xml b/pom.xml
index ec8f2b85..1344a94a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -117,6 +117,33 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
                 <version>3.0.0-M5</version>
+                <!-- Run the tests twice, w/ and w/out FIPS enabled -->
+                <executions>
+                    <execution>
+                        <id>default-test</id>
+                        <phase>test</phase>
+                        <goals>
+                            <goal>test</goal>
+                        </goals>
+                        <configuration>
+                            <systemPropertyVariables>
+                                <test.fips>false</test.fips>
+                            </systemPropertyVariables>
+                        </configuration>
+                    </execution>
+                    <execution>
+                        <id>test-with-fips-enabled</id>
+                        <phase>test</phase>
+                        <goals>
+                            <goal>test</goal>
+                        </goals>
+                        <configuration>
+                            <systemPropertyVariables>
+                                <test.fips>true</test.fips>
+                            </systemPropertyVariables>
+                        </configuration>
+                    </execution>
+                </executions>
             </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
diff --git a/src/test/java/io/fusionauth/jwt/VerifierTest.java b/src/test/java/io/fusionauth/jwt/VerifierTest.java
index a3d9d4ab..d9c15209 100644
--- a/src/test/java/io/fusionauth/jwt/VerifierTest.java
+++ b/src/test/java/io/fusionauth/jwt/VerifierTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2016-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2016-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -38,6 +38,16 @@
 public class VerifierTest {
   static List<Pair<Verifier, String>> algorithms = new ArrayList<>();
 
+  static {
+    try {
+      algorithms.add(new Pair<>(HMACVerifier.newVerifier("secret"), "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkifQ.qHdut1UR4-2FSAvh7U3YdeRR5r5boVqjIGQ16Ztp894"));
+      algorithms.add(new Pair<>(RSAVerifier.newVerifier(new String(Files.readAllBytes(Paths.get("src/test/resources/rsa_public_key_4096.pem")))),
+          "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkifQ.kRXJkOHC98D0LCT2oPg5fTmQJDFXkMRQJopbt7QM6prmQDHwjJL_xO-_EXRXnbvf5NLORto45By3XNn2ZzWmY3pAOxj46MlQ5elhROx2S-EnHZNLfQhoG8ZXPZ54q-Obz_6K7ZSlkAQ8jmeZUO3Ryi8jRlHQ2PT4LbBtLpaf982SGJfeTyUMw1LbvowZUTZSF-E6JARaokmmx8M2GeLuKcFhU-YsBTXUarKp0IJCy3jpMQ2zW_HGjyVWH8WwSIbSdpBn7ztoQEJYO-R5H3qVaAz2BsTuGLRxoyIu1iy2-QcDp5uTufmX1roXM8ciQMpcfwKGiyNpKVIZm-lF8aROXRL4kk4rqp6KUzJuOPljPXRU--xKSua-DeR0BEerKzI9hbwIMWiblCslAciNminoSc9G7pUyVwV5Z5IT8CGJkVgoyVGELeBmYCDy7LHwXrr0poc0hPbE3mJXhzolga4BB84nCg2Hb9tCNiHU8F-rKgZWCONaSSIdhQ49x8OiPafFh2DJBEBe5Xbm6xdCfh3KVG0qe4XL18R5s98aIP9UIC4i62UEgPy6W7Fr7QgUxpXrjRCERBV3MiNu4L8NNJb3oZleq5lQi72EfdS-Bt8ZUOVInIcAvSmu-3i8jB_2sF38XUXdl8gkW8k_b9dJkzDcivCFehvSqGmm3vBm5X4bNmk"));
+    } catch (IOException e) {
+      throw new RuntimeException(e);
+    }
+  }
+
   @Test
   public void verify() {
     // JWT Subject : 123456789
@@ -53,14 +63,4 @@ public void verify() {
       }
     }
   }
-
-  static {
-    try {
-      algorithms.add(new Pair<>(HMACVerifier.newVerifier("secret"), "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkifQ.qHdut1UR4-2FSAvh7U3YdeRR5r5boVqjIGQ16Ztp894"));
-      algorithms.add(new Pair<>(RSAVerifier.newVerifier(new String(Files.readAllBytes(Paths.get("src/test/resources/rsa_public_key_4096.pem")))),
-          "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkifQ.kRXJkOHC98D0LCT2oPg5fTmQJDFXkMRQJopbt7QM6prmQDHwjJL_xO-_EXRXnbvf5NLORto45By3XNn2ZzWmY3pAOxj46MlQ5elhROx2S-EnHZNLfQhoG8ZXPZ54q-Obz_6K7ZSlkAQ8jmeZUO3Ryi8jRlHQ2PT4LbBtLpaf982SGJfeTyUMw1LbvowZUTZSF-E6JARaokmmx8M2GeLuKcFhU-YsBTXUarKp0IJCy3jpMQ2zW_HGjyVWH8WwSIbSdpBn7ztoQEJYO-R5H3qVaAz2BsTuGLRxoyIu1iy2-QcDp5uTufmX1roXM8ciQMpcfwKGiyNpKVIZm-lF8aROXRL4kk4rqp6KUzJuOPljPXRU--xKSua-DeR0BEerKzI9hbwIMWiblCslAciNminoSc9G7pUyVwV5Z5IT8CGJkVgoyVGELeBmYCDy7LHwXrr0poc0hPbE3mJXhzolga4BB84nCg2Hb9tCNiHU8F-rKgZWCONaSSIdhQ49x8OiPafFh2DJBEBe5Xbm6xdCfh3KVG0qe4XL18R5s98aIP9UIC4i62UEgPy6W7Fr7QgUxpXrjRCERBV3MiNu4L8NNJb3oZleq5lQi72EfdS-Bt8ZUOVInIcAvSmu-3i8jB_2sF38XUXdl8gkW8k_b9dJkzDcivCFehvSqGmm3vBm5X4bNmk"));
-    } catch (IOException e) {
-      throw new RuntimeException(e);
-    }
-  }
 }
diff --git a/src/test/java/io/fusionauth/jwt/ec/ECVerifierTest.java b/src/test/java/io/fusionauth/jwt/ec/ECVerifierTest.java
index de09446a..2eaf81b9 100644
--- a/src/test/java/io/fusionauth/jwt/ec/ECVerifierTest.java
+++ b/src/test/java/io/fusionauth/jwt/ec/ECVerifierTest.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2018-2019, FusionAuth, All Rights Reserved
+ * Copyright (c) 2018-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -40,9 +40,9 @@ public class ECVerifierTest extends BaseJWTTest {
   @Test
   public void test_public_pem_parsing() {
     Arrays.asList(
-        "ec_public_key_p_256.pem",
-        "ec_public_key_p_384.pem",
-        "ec_public_key_p_521.pem")
+            "ec_public_key_p_256.pem",
+            "ec_public_key_p_384.pem",
+            "ec_public_key_p_521.pem")
         .forEach(fileName -> {
           // Take a Path arg
           assertECVerifier(ECVerifier.newVerifier(getPath(fileName)));
@@ -56,19 +56,19 @@ public void test_public_pem_parsing() {
 
     // Public key parsing fails with private keys w/out an encoded public key
     Arrays.asList(
-        "ec_private_key_p_256.pem",
-        "ec_private_key_p_384.pem",
-        "ec_private_key_p_521.pem")
+            "ec_private_key_p_256.pem",
+            "ec_private_key_p_384.pem",
+            "ec_private_key_p_521.pem")
         .forEach(this::assertFailed);
 
     // Public key parsing works with private keys when the private key contains a public key
     Arrays.asList(
-        "ec_private_prime256v1_p_256_openssl.pem",
-        "ec_private_prime256v1_p_256_openssl_pkcs8.pem",
-        "ec_private_secp384r1_p_384_openssl.pem",
-        "ec_private_secp384r1_p_384_openssl_pkcs8.pem",
-        "ec_private_secp521r1_p_512_openssl.pem",
-        "ec_private_secp521r1_p_512_openssl_pkcs8.pem")
+            "ec_private_prime256v1_p_256_openssl.pem",
+            "ec_private_prime256v1_p_256_openssl_pkcs8.pem",
+            "ec_private_secp384r1_p_384_openssl.pem",
+            "ec_private_secp384r1_p_384_openssl_pkcs8.pem",
+            "ec_private_secp521r1_p_512_openssl.pem",
+            "ec_private_secp521r1_p_512_openssl_pkcs8.pem")
         .forEach(fileName -> {
           // Take a Path arg
           assertECVerifier(ECVerifier.newVerifier(getPath(fileName)));

From c501fdc171a2566580cd191f3ed2167bb955a9b5 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Wed, 19 Nov 2025 14:33:33 -0700
Subject: [PATCH 21/29] cleanup

---
 src/test/java/io/fusionauth/der/ObjectIdentifierTest.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/test/java/io/fusionauth/der/ObjectIdentifierTest.java b/src/test/java/io/fusionauth/der/ObjectIdentifierTest.java
index fb6481a0..f1f75b37 100644
--- a/src/test/java/io/fusionauth/der/ObjectIdentifierTest.java
+++ b/src/test/java/io/fusionauth/der/ObjectIdentifierTest.java
@@ -37,7 +37,7 @@ public void decode() throws Exception {
 
     // EdDSA Ed25519
     assertEquals(decode(0x2B, 0x65, 0x70), "1.3.101.112");
-    // EdDSA ed448
+    // EdDSA Ed448
     assertEquals(decode(0x2B, 0x65, 0x71), "1.3.101.113");
 
     // RSA

From 9fae781378bc6e6061353128a33113bd01d481db Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Wed, 19 Nov 2025 15:13:44 -0700
Subject: [PATCH 22/29] Tests

---
 .../io/fusionauth/jwks/JSONWebKeyBuilder.java |  2 +-
 .../java/io/fusionauth/jwt/JWTDecoder.java    |  8 ++--
 .../io/fusionauth/jwt/domain/Algorithm.java   |  6 +--
 .../jwks/JSONWebKeyBuilderTest.java           | 40 +++++++++++++++++++
 src/test/java/io/fusionauth/jwt/JWTTest.java  |  2 +-
 .../jwk/rsa_pss_private_key_2048.json         | 12 ++++++
 .../jwk/rsa_pss_public_key_2048.json          |  6 +++
 .../rsa_pss_public_key_2048_certificate.json  | 12 ++++++
 .../rsa_pss_public_key_2048_certificate.pem   | 21 ++++++++++
 9 files changed, 100 insertions(+), 9 deletions(-)
 create mode 100644 src/test/resources/jwk/rsa_pss_private_key_2048.json
 create mode 100644 src/test/resources/jwk/rsa_pss_public_key_2048.json
 create mode 100644 src/test/resources/jwk/rsa_pss_public_key_2048_certificate.json
 create mode 100644 src/test/resources/rsa_pss_public_key_2048_certificate.pem

diff --git a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
index 541721dd..54e54b3a 100644
--- a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
+++ b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
@@ -234,7 +234,7 @@ private int getCoordinateLength(ECKey key) {
 
   private KeyType getKeyType(Key key) {
     return switch (key.getAlgorithm()) {
-      case "RSA" -> KeyType.RSA;
+      case "RSA", "RSASSA-PSS" -> KeyType.RSA;
       case "EC" -> KeyType.EC;
       // JCE returns EdDSA, and BC returns Ed25519 or Ed448 respectively
       case "EdDSA", "Ed25519", "Ed448" -> KeyType.OKP;
diff --git a/src/main/java/io/fusionauth/jwt/JWTDecoder.java b/src/main/java/io/fusionauth/jwt/JWTDecoder.java
index c6711ad2..7bdaf8f3 100644
--- a/src/main/java/io/fusionauth/jwt/JWTDecoder.java
+++ b/src/main/java/io/fusionauth/jwt/JWTDecoder.java
@@ -207,7 +207,7 @@ private JWT validate(String encodedJWT, String[] parts, Header header, Verifier
       }
 
       if (header.algorithm != Algorithm.none) {
-        throw new MissingSignatureException("Your provided a JWT with the algorithm [" + header.algorithm.getName() + "] but it is missing a signature");
+        throw new MissingSignatureException("Your provided a JWT with the algorithm [" + header.algorithm.name() + "] but it is missing a signature");
       }
     } else {
       // When parts.length == 3, we have a signature.
@@ -219,13 +219,13 @@ private JWT validate(String encodedJWT, String[] parts, Header header, Verifier
       }
 
       if (verifier == null) {
-        throw new MissingVerifierException("No Verifier has been provided for verify a signature signed using [" + header.algorithm.getName() + "]");
+        throw new MissingVerifierException("No Verifier has been provided for verify a signature signed using [" + header.algorithm.name() + "]");
       }
 
       // When the verifier has been selected based upon the 'kid' or other identifier in the header, we must verify it can verify the algorithm.
       // - When multiple verifiers are provided to .decode w/out a kid, we may have already called 'canVerify', this is ok.
       if (!verifier.canVerify(header.algorithm)) {
-        throw new MissingVerifierException("No Verifier has been provided for verify a signature signed using [" + header.algorithm.getName() + "]");
+        throw new MissingVerifierException("No Verifier has been provided for verify a signature signed using [" + header.algorithm.name() + "]");
       }
 
       verifySignature(verifier, header, parts[2], encodedJWT);
@@ -275,4 +275,4 @@ private void verifySignature(Verifier verifier, Header header, String signature,
     byte[] signatureBytes = base64Decode(signature);
     verifier.verify(header.algorithm, message, signatureBytes);
   }
-}
\ No newline at end of file
+}
diff --git a/src/main/java/io/fusionauth/jwt/domain/Algorithm.java b/src/main/java/io/fusionauth/jwt/domain/Algorithm.java
index a927f931..43414037 100644
--- a/src/main/java/io/fusionauth/jwt/domain/Algorithm.java
+++ b/src/main/java/io/fusionauth/jwt/domain/Algorithm.java
@@ -76,19 +76,19 @@ public enum Algorithm {
    * RSASSA-PSS using SHA-256 and MGF1 with SHA-256
    * - SHA256withRSAandMGF1
    */
-  PS256("SHA-256"),
+  PS256("SHA256withRSAandMGF1"),
 
   /**
    * RSASSA-PSS using SHA-384 and MGF1 with SHA-384
    * - SHA384withRSAandMGF1
    */
-  PS384("SHA-384"),
+  PS384("SHA384withRSAandMGF1"),
 
   /**
    * RSASSA-PSS using SHA-512 and MGF1 with SHA-512
    * - SHA512withRSAandMGF1
    */
-  PS512("SHA-512"),
+  PS512("SHA512withRSAandMGF1"),
 
   /**
    * RSASSA-PKCS1-v1_5 using SHA-256
diff --git a/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java b/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
index bacc2fc2..d36f33ab 100644
--- a/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
+++ b/src/test/java/io/fusionauth/jwks/JSONWebKeyBuilderTest.java
@@ -20,12 +20,17 @@
 import io.fusionauth.jwt.BaseJWTTest;
 import io.fusionauth.jwt.JWTUtils;
 import io.fusionauth.jwt.Signer;
+import io.fusionauth.jwt.Verifier;
+import io.fusionauth.jwt.domain.Algorithm;
 import io.fusionauth.jwt.domain.Header;
 import io.fusionauth.jwt.domain.JWT;
+import io.fusionauth.jwt.rsa.RSAPSSSigner;
+import io.fusionauth.jwt.rsa.RSAPSSVerifier;
 import io.fusionauth.jwt.rsa.RSASigner;
 import io.fusionauth.pem.domain.PEM;
 import org.testng.annotations.Test;
 
+import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 import java.security.cert.Certificate;
@@ -132,6 +137,41 @@ public void rsa_private() throws Exception {
     assertJSONEquals(JSONWebKey.build(privateKey), "src/test/resources/jwk/rsa_private_key_jwk_control.json");
   }
 
+  @Test
+  public void rsa_pss_private() throws Exception {
+    // RSA PSS private key
+    RSAPrivateKey privateKey = PEM.decode(Paths.get("src/test/resources/rsa_pss_private_key_2048.pem")).getPrivateKey();
+    // Note that the alg property in the JWK is optional, and with an RSA key we don't know the algorithm.
+    // - This key could be used with PS256, PS384 or PS512.
+    assertJSONEquals(JSONWebKey.build(privateKey), "src/test/resources/jwk/rsa_pss_private_key_2048.json");
+
+    // See!
+    Signer signer = RSAPSSSigner.newSHA256Signer(privateKey);
+    String message = "hello world!";
+    byte[] messageBytes = message.getBytes(StandardCharsets.UTF_8);
+    byte[] signature = signer.sign(message);
+
+    RSAPublicKey publicKey = PEM.decode(Paths.get("src/test/resources/rsa_pss_public_key_2048.pem")).getPublicKey();
+    Verifier verifier = RSAPSSVerifier.newVerifier(publicKey);
+    verifier.canVerify(Algorithm.PS256);
+    verifier.canVerify(Algorithm.PS384);
+    verifier.canVerify(Algorithm.PS512);
+    verifier.verify(Algorithm.PS256, messageBytes, signature);
+  }
+
+  @Test
+  public void rsa_pss_public() throws Exception {
+    // RSA PSS public key
+    RSAPublicKey publicKey = PEM.decode(Paths.get("src/test/resources/rsa_pss_public_key_2048.pem")).getPublicKey();
+    // Note that the alg property in the JWK is optional, and with an RSA key we don't know the algorithm.
+    // - This key could be used with PS256, PS384 or PS512.
+    assertJSONEquals(JSONWebKey.build(publicKey), "src/test/resources/jwk/rsa_pss_public_key_2048.json");
+
+    // X.509 cert, the certificate will contain the algorithm 'SHA256withRSAandMGF1' so we will expect PS256 in the JWK
+    Certificate certificate = PEM.decode(Paths.get("src/test/resources/rsa_pss_public_key_2048_certificate.pem")).certificate;
+    assertJSONEquals(JSONWebKey.build(certificate), "src/test/resources/jwk/rsa_pss_public_key_2048_certificate.json");
+  }
+
   @Test
   public void embedded_jwk() {
     JWT jwt = new JWT();
diff --git a/src/test/java/io/fusionauth/jwt/JWTTest.java b/src/test/java/io/fusionauth/jwt/JWTTest.java
index a76ad473..c0ccbbbb 100644
--- a/src/test/java/io/fusionauth/jwt/JWTTest.java
+++ b/src/test/java/io/fusionauth/jwt/JWTTest.java
@@ -189,7 +189,7 @@ public void decoding_performance() throws Exception {
       BigDecimal average = durationInMillis.divide(BigDecimal.valueOf(iterationCount), RoundingMode.HALF_DOWN);
       long perSecond = iterationCount / (duration.toMillis() / 1000);
 
-      System.out.println("[" + signer.getAlgorithm().getName() + "] " + duration.toMillis() + " milliseconds total. [" + iterationCount + "] iterations. [" + average + "] milliseconds per iteration. Approx. [" + perSecond + "] per second.");
+      System.out.println("[" + signer.getAlgorithm().name() + "] " + duration.toMillis() + " milliseconds total. [" + iterationCount + "] iterations. [" + average + "] milliseconds per iteration. Approx. [" + perSecond + "] per second.");
 
     }
   }
diff --git a/src/test/resources/jwk/rsa_pss_private_key_2048.json b/src/test/resources/jwk/rsa_pss_private_key_2048.json
new file mode 100644
index 00000000..69c1c87f
--- /dev/null
+++ b/src/test/resources/jwk/rsa_pss_private_key_2048.json
@@ -0,0 +1,12 @@
+{
+  "d": "EJH10HKG3hGJ8nI1GisExYjxyIexlSHrv3t_4A_OMex_thEOQvIzB9RgN1RQ5sJnhAfOouCTq3PQSOhn3K9TYNJsW_mXy_yN2_I-5dlDHFz2XQBuknaze-Ev8LMQdZBgI579chhBFAXA-D0CbgxhostbVaVxWPKzARjVJfBVUKTaEh7Ig_qJaJSczY5DisKQsvpU3ePbpu1gOBSs18x4vCcTjSXslrlYMPI6nNHAY9Y9xUc2lkxC-SqXSGxb5j6ZRk9q4Lg8ht7h3Gb0hOhc_Fgi6aaoRBrAUtFVmBKPgFlMCHiXj858-smcXiSVqHhoVsIA8NKfEEhL-9ZA9VrxGQ",
+  "kty": "RSA",
+  "dp": "WTfZxUylsWpdtkieb6b8bI2cfajNdkCSk81xMN4Sf4hft0KFQ82aHPrx1coqfTmry-NHTlXsdw6XkD4RTLD-i5L0A4zIGjAFKmUcIeRrtITZHnBFNzZt-TfIa9DPbEqHGssyUM7Hxb81EM0IWTvcagbQoosqbEwXuiP5dSusOws",
+  "dq": "O--Q0ga1G8h4Dq-5NrulpJFpavSti1SlQUx8_dtuy6okzAwcruzrrjLg9G-QbO1K-PGVic3zSQtwONg3B1EOy0DalPDSekYvSJU7s9wKRnydh-plyJo_h2dj41Hg-1iG4h9w5EfWGhRA5Z0Twx1Zqorc7L1AU3822MzZk32i_Ws",
+  "e": "AQAB",
+  "n": "vlGU-GNj5XVHJ8Hi8b0Dhjk3m-1uULwdIrEZMckvuWnderIKDMMpdORGg79nmMd7fPayrvA7ZxOjnEBIAzGfovDje9NN3esWAZ6uQpZAUdZO3wPW2qPBTgFtdzTnLEY-z5itxCL1J7KyeQuD82Jrda5C-9FLkf40CMlGj_5Z9BSF4OXlsY8LwLlNd-3jQLK3tzCFQwUncmXenprsZmw37fyEqN6mfoXVp22i0LbtHdh7-JbLg7AWaovKkqikh79HKG7ptcAmwpd4uc4zbH5yowBepscfqsYKlvwheYBudJumxq-H_-8ZippSt3__fcCK64IqwW0DkbsU61SlzntkvQ",
+  "p": "-V_zCqvziDSo-lCxk8WnXFYA4yg-91IEFmeJoLgpdpIZhdlrsK1yPnEqYbfgjH9nurl9-zsyT6CaajVoM3jHuQEN-Eznf8cLG78KzyAE0HUEi4zf0XwC7BfoMaA9HEnjV9ctij9w-g9s6NfugwsDPdJTRv_IAWGeyVnXgX3kRoc",
+  "q": "w1_6uSjS_ptRIzrWr84KNvg-zfkAzWNdPoD3DZDzJAi3IW-kDezOXiFtLZQcORD_WobtNfglEO57imb1aaxrxwB-lyKJokRYjlz7KZ8TtHPsPrJ2yZ37XFb73uqS7kGnsO5nKRLc17rFAXBCn05OW8MG4jGlu0K2nnkSU8yxB5s",
+  "qi": "GQpitPntsdYUdVK3tYk-Utl7vDJA0HH7rxwAqx6gwxVXLDZf9SEYocJtulNWl8HIzUmoHu0KdMsosq721WbU4Jt35QiOpfa-zRNMcKV_7C_MUMvKTOWg9LzuJ2H2IJYxnglacScv5SYH6ms2LRs52-NUm4yAqJzSjUa9Zi-jgos",
+  "use": "sig"
+}
diff --git a/src/test/resources/jwk/rsa_pss_public_key_2048.json b/src/test/resources/jwk/rsa_pss_public_key_2048.json
new file mode 100644
index 00000000..5ca5080f
--- /dev/null
+++ b/src/test/resources/jwk/rsa_pss_public_key_2048.json
@@ -0,0 +1,6 @@
+{
+  "e": "AQAB",
+  "kty": "RSA",
+  "n": "vlGU-GNj5XVHJ8Hi8b0Dhjk3m-1uULwdIrEZMckvuWnderIKDMMpdORGg79nmMd7fPayrvA7ZxOjnEBIAzGfovDje9NN3esWAZ6uQpZAUdZO3wPW2qPBTgFtdzTnLEY-z5itxCL1J7KyeQuD82Jrda5C-9FLkf40CMlGj_5Z9BSF4OXlsY8LwLlNd-3jQLK3tzCFQwUncmXenprsZmw37fyEqN6mfoXVp22i0LbtHdh7-JbLg7AWaovKkqikh79HKG7ptcAmwpd4uc4zbH5yowBepscfqsYKlvwheYBudJumxq-H_-8ZippSt3__fcCK64IqwW0DkbsU61SlzntkvQ",
+  "use": "sig"
+}
diff --git a/src/test/resources/jwk/rsa_pss_public_key_2048_certificate.json b/src/test/resources/jwk/rsa_pss_public_key_2048_certificate.json
new file mode 100644
index 00000000..7ee939e8
--- /dev/null
+++ b/src/test/resources/jwk/rsa_pss_public_key_2048_certificate.json
@@ -0,0 +1,12 @@
+{
+  "alg": "PS256",
+  "e": "AQAB",
+  "kty": "RSA",
+  "n": "vlGU-GNj5XVHJ8Hi8b0Dhjk3m-1uULwdIrEZMckvuWnderIKDMMpdORGg79nmMd7fPayrvA7ZxOjnEBIAzGfovDje9NN3esWAZ6uQpZAUdZO3wPW2qPBTgFtdzTnLEY-z5itxCL1J7KyeQuD82Jrda5C-9FLkf40CMlGj_5Z9BSF4OXlsY8LwLlNd-3jQLK3tzCFQwUncmXenprsZmw37fyEqN6mfoXVp22i0LbtHdh7-JbLg7AWaovKkqikh79HKG7ptcAmwpd4uc4zbH5yowBepscfqsYKlvwheYBudJumxq-H_-8ZippSt3__fcCK64IqwW0DkbsU61SlzntkvQ",
+  "use": "sig",
+  "x5c": [
+    "MIIDeTCCAi2gAwIBAgIUT4pGD7o7p19ffPEjhBb/+7okKwowQQYJKoZIhvcNAQEKMDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIDAgEgMBkxFzAVBgNVBAMMDllvdXJDb21tb25OYW1lMB4XDTI1MTExOTIyMDQ0MFoXDTM1MTExNzIyMDQ0MFowGTEXMBUGA1UEAwwOWW91ckNvbW1vbk5hbWUwggEgMAsGCSqGSIb3DQEBCgOCAQ8AMIIBCgKCAQEAvlGU+GNj5XVHJ8Hi8b0Dhjk3m+1uULwdIrEZMckvuWnderIKDMMpdORGg79nmMd7fPayrvA7ZxOjnEBIAzGfovDje9NN3esWAZ6uQpZAUdZO3wPW2qPBTgFtdzTnLEY+z5itxCL1J7KyeQuD82Jrda5C+9FLkf40CMlGj/5Z9BSF4OXlsY8LwLlNd+3jQLK3tzCFQwUncmXenprsZmw37fyEqN6mfoXVp22i0LbtHdh7+JbLg7AWaovKkqikh79HKG7ptcAmwpd4uc4zbH5yowBepscfqsYKlvwheYBudJumxq+H/+8ZippSt3//fcCK64IqwW0DkbsU61SlzntkvQIDAQABo1MwUTAdBgNVHQ4EFgQUaYHpMLSO63cRr8sgmoLc+5M6XTUwHwYDVR0jBBgwFoAUaYHpMLSO63cRr8sgmoLc+5M6XTUwDwYDVR0TAQH/BAUwAwEB/zBBBgkqhkiG9w0BAQowNKAPMA0GCWCGSAFlAwQCAQUAoRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAQUAogMCASADggEBAAUo7hZ29UOnb7sCxjrvCQ3tCMcIR+aT2vu0owDibJ9zsFRvRoIJgXqFdOtpJFPfx2U0zSVAy3eqCyf5cOJ0fDyApt9SLAd6pF45MTKRMNwH3iY13wRYIdN2Rcdd1Z3gR8HtrMYFf1RU/AwgQKPTvCKmRUbya4ZCbUGckoTdfHfYZZ7o+D7i4Eov+4MV9o/QOpz6jF9Q+j7S0+kNa/hUbJxs8C5TpHz9B9z1U28Z59Xezt2m2fPLzQ2XfHRAjTFpM5rNJUS8q3ZKHskVrKBuM6jZ9ML0CfCZozU9093inmaflGnwKeVmGgZ1DSlz2YQ92lTN2xSqfgRJN5nqs8OuM6I="
+  ],
+  "x5t": "baN9dfF8TqyfmLsfyjy-kKGIB0Y",
+  "x5t#S256": "t6-s3DRQhe_g-12YNvHrrWnLane49ikW62ir5NIqRQ8"
+}
diff --git a/src/test/resources/rsa_pss_public_key_2048_certificate.pem b/src/test/resources/rsa_pss_public_key_2048_certificate.pem
new file mode 100644
index 00000000..1ea932dd
--- /dev/null
+++ b/src/test/resources/rsa_pss_public_key_2048_certificate.pem
@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDeTCCAi2gAwIBAgIUT4pGD7o7p19ffPEjhBb/+7okKwowQQYJKoZIhvcNAQEK
+MDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEF
+AKIDAgEgMBkxFzAVBgNVBAMMDllvdXJDb21tb25OYW1lMB4XDTI1MTExOTIyMDQ0
+MFoXDTM1MTExNzIyMDQ0MFowGTEXMBUGA1UEAwwOWW91ckNvbW1vbk5hbWUwggEg
+MAsGCSqGSIb3DQEBCgOCAQ8AMIIBCgKCAQEAvlGU+GNj5XVHJ8Hi8b0Dhjk3m+1u
+ULwdIrEZMckvuWnderIKDMMpdORGg79nmMd7fPayrvA7ZxOjnEBIAzGfovDje9NN
+3esWAZ6uQpZAUdZO3wPW2qPBTgFtdzTnLEY+z5itxCL1J7KyeQuD82Jrda5C+9FL
+kf40CMlGj/5Z9BSF4OXlsY8LwLlNd+3jQLK3tzCFQwUncmXenprsZmw37fyEqN6m
+foXVp22i0LbtHdh7+JbLg7AWaovKkqikh79HKG7ptcAmwpd4uc4zbH5yowBepscf
+qsYKlvwheYBudJumxq+H/+8ZippSt3//fcCK64IqwW0DkbsU61SlzntkvQIDAQAB
+o1MwUTAdBgNVHQ4EFgQUaYHpMLSO63cRr8sgmoLc+5M6XTUwHwYDVR0jBBgwFoAU
+aYHpMLSO63cRr8sgmoLc+5M6XTUwDwYDVR0TAQH/BAUwAwEB/zBBBgkqhkiG9w0B
+AQowNKAPMA0GCWCGSAFlAwQCAQUAoRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQC
+AQUAogMCASADggEBAAUo7hZ29UOnb7sCxjrvCQ3tCMcIR+aT2vu0owDibJ9zsFRv
+RoIJgXqFdOtpJFPfx2U0zSVAy3eqCyf5cOJ0fDyApt9SLAd6pF45MTKRMNwH3iY1
+3wRYIdN2Rcdd1Z3gR8HtrMYFf1RU/AwgQKPTvCKmRUbya4ZCbUGckoTdfHfYZZ7o
++D7i4Eov+4MV9o/QOpz6jF9Q+j7S0+kNa/hUbJxs8C5TpHz9B9z1U28Z59Xezt2m
+2fPLzQ2XfHRAjTFpM5rNJUS8q3ZKHskVrKBuM6jZ9ML0CfCZozU9093inmaflGnw
+KeVmGgZ1DSlz2YQ92lTN2xSqfgRJN5nqs8OuM6I=
+-----END CERTIFICATE-----

From b9887b1346f069afd3487db1effa01d4c417e79f Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Wed, 19 Nov 2025 15:16:26 -0700
Subject: [PATCH 23/29] Tests

---
 build.savant | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.savant b/build.savant
index edc25813..395b33db 100644
--- a/build.savant
+++ b/build.savant
@@ -96,7 +96,7 @@ target(name: "test", description: "Runs the project's tests", dependsOn: ["jar"]
   // Example:
   // javaTestNG.settings.jvmArguments += "-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=5005"
 
-  boolean[] fipsEnabled = [true, false]
+  boolean[] fipsEnabled = [false, true]
   if (switches.has("fips")) {
     fipsEnabled = [true]
   } else if (switches.has("jca")) {

From ea2dd4760bd2111bca153daad5452811ed2d1dff Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Wed, 19 Nov 2025 15:41:55 -0700
Subject: [PATCH 24/29] Tests

---
 .../java/io/fusionauth/jwt/domain/Algorithm.java  | 10 ++++++++++
 .../java/io/fusionauth/jwt/rsa/RSAPSSSigner.java  | 15 +++++++++------
 .../io/fusionauth/jwt/rsa/RSAPSSVerifier.java     |  3 ++-
 3 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/src/main/java/io/fusionauth/jwt/domain/Algorithm.java b/src/main/java/io/fusionauth/jwt/domain/Algorithm.java
index 43414037..ff977963 100644
--- a/src/main/java/io/fusionauth/jwt/domain/Algorithm.java
+++ b/src/main/java/io/fusionauth/jwt/domain/Algorithm.java
@@ -130,6 +130,16 @@ public String getName() {
     return algorithm;
   }
 
+  public String getDigest() {
+    return switch (this) {
+      case PS256 -> "SHA-256";
+      case PS384 -> "SHA-384";
+      case PS512 -> "SHA-512";
+      default ->
+          throw new IllegalStateException("An incompatible algorithm was provided, this method is only used for RSASSA-PSS algorithms.");
+    };
+  }
+
   public int getSaltLength() {
     return switch (this) {
       case PS256 -> 32;
diff --git a/src/main/java/io/fusionauth/jwt/rsa/RSAPSSSigner.java b/src/main/java/io/fusionauth/jwt/rsa/RSAPSSSigner.java
index 904cba5b..48486f11 100644
--- a/src/main/java/io/fusionauth/jwt/rsa/RSAPSSSigner.java
+++ b/src/main/java/io/fusionauth/jwt/rsa/RSAPSSSigner.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2020, FusionAuth, All Rights Reserved
+ * Copyright (c) 2020-2025, FusionAuth, All Rights Reserved
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -36,6 +36,8 @@
 import java.security.spec.PSSParameterSpec;
 import java.util.Objects;
 
+import static io.fusionauth.jwt.domain.Algorithm.PS256;
+
 /**
  * This class can sign a JWT using an RSA Private key.
  *
@@ -95,7 +97,7 @@ private RSAPSSSigner(Algorithm algorithm, String privateKey, String kid) {
    * @return a new RSA signer.
    */
   public static RSAPSSSigner newSHA256Signer(String privateKey) {
-    return new RSAPSSSigner(Algorithm.PS256, privateKey, null);
+    return new RSAPSSSigner(PS256, privateKey, null);
   }
 
   /**
@@ -106,7 +108,7 @@ public static RSAPSSSigner newSHA256Signer(String privateKey) {
    * @return a new RSA signer.
    */
   public static RSAPSSSigner newSHA256Signer(String privateKey, String kid) {
-    return new RSAPSSSigner(Algorithm.PS256, privateKey, kid);
+    return new RSAPSSSigner(PS256, privateKey, kid);
   }
 
   /**
@@ -116,7 +118,7 @@ public static RSAPSSSigner newSHA256Signer(String privateKey, String kid) {
    * @return a new RSA signer.
    */
   public static RSAPSSSigner newSHA256Signer(PrivateKey privateKey) {
-    return new RSAPSSSigner(Algorithm.PS256, privateKey, null);
+    return new RSAPSSSigner(PS256, privateKey, null);
   }
 
   /**
@@ -127,7 +129,7 @@ public static RSAPSSSigner newSHA256Signer(PrivateKey privateKey) {
    * @return a new RSA signer.
    */
   public static RSAPSSSigner newSHA256Signer(PrivateKey privateKey, String kid) {
-    return new RSAPSSSigner(Algorithm.PS256, privateKey, kid);
+    return new RSAPSSSigner(PS256, privateKey, kid);
   }
 
   /**
@@ -229,7 +231,8 @@ public byte[] sign(String message) {
 
     try {
       Signature signature = Signature.getInstance("RSASSA-PSS");
-      signature.setParameter(new PSSParameterSpec(algorithm.getName(), "MGF1", new MGF1ParameterSpec(algorithm.getName()), algorithm.getSaltLength(), 1));
+      String digestName = algorithm.getDigest();
+      signature.setParameter(new PSSParameterSpec(digestName, "MGF1", new MGF1ParameterSpec(digestName), algorithm.getSaltLength(), 1));
       signature.initSign(privateKey);
       signature.update(message.getBytes(StandardCharsets.UTF_8));
       return signature.sign();
diff --git a/src/main/java/io/fusionauth/jwt/rsa/RSAPSSVerifier.java b/src/main/java/io/fusionauth/jwt/rsa/RSAPSSVerifier.java
index affa6d5f..bcddded6 100644
--- a/src/main/java/io/fusionauth/jwt/rsa/RSAPSSVerifier.java
+++ b/src/main/java/io/fusionauth/jwt/rsa/RSAPSSVerifier.java
@@ -135,7 +135,8 @@ public void verify(Algorithm algorithm, byte[] message, byte[] signature) {
 
     try {
       Signature verifier = Signature.getInstance("RSASSA-PSS");
-      verifier.setParameter(new PSSParameterSpec(algorithm.getName(), "MGF1", new MGF1ParameterSpec(algorithm.getName()), algorithm.getSaltLength(), 1));
+      String digestName = algorithm.getDigest();
+      verifier.setParameter(new PSSParameterSpec(digestName, "MGF1", new MGF1ParameterSpec(digestName), algorithm.getSaltLength(), 1));
       verifier.initVerify(publicKey);
       verifier.update(message);
       if (!verifier.verify(signature)) {

From dabd198f4591410bc52492554e3b76fc434aa975 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Wed, 19 Nov 2025 16:16:15 -0700
Subject: [PATCH 25/29] Tests

---
 .../io/fusionauth/der/ObjectIdentifier.java   | 15 ++++++++
 .../io/fusionauth/jwks/JSONWebKeyBuilder.java | 37 ++++++++++++++++++-
 2 files changed, 50 insertions(+), 2 deletions(-)

diff --git a/src/main/java/io/fusionauth/der/ObjectIdentifier.java b/src/main/java/io/fusionauth/der/ObjectIdentifier.java
index 66180c7d..e22596be 100644
--- a/src/main/java/io/fusionauth/der/ObjectIdentifier.java
+++ b/src/main/java/io/fusionauth/der/ObjectIdentifier.java
@@ -84,6 +84,21 @@ public class ObjectIdentifier implements Buildable<ObjectIdentifier> {
    */
   public static final String RSA_SHA512 = "1.2.840.113549.1.1.13";
 
+  /**
+   * Secure Hash Algorithm that uses a 256-bit key (SHA256)
+   */
+  public static final String SHA256 = "2.16.840.1.101.3.4.2.1";
+
+  /**
+   * Secure Hash Algorithm that uses a 384-bit key (SHA384)
+   */
+  public static final String SHA384 = "2.16.840.1.101.3.4.2.2";
+
+  /**
+   * Secure Hash Algorithm that uses a 512-bit key (SHA512)
+   */
+  public static final String SHA512 = "2.16.840.1.101.3.4.2.3";
+
   /**
    * The raw byte array of this Object Identifier.
    */
diff --git a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
index 54e54b3a..5276bda9 100644
--- a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
+++ b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
@@ -18,6 +18,7 @@
 
 import io.fusionauth.der.DerDecodingException;
 import io.fusionauth.der.DerInputStream;
+import io.fusionauth.der.ObjectIdentifier;
 import io.fusionauth.jwks.domain.JSONWebKey;
 import io.fusionauth.jwt.JWTUtils;
 import io.fusionauth.jwt.domain.Algorithm;
@@ -25,6 +26,7 @@
 import io.fusionauth.pem.domain.PEM;
 import io.fusionauth.security.KeyUtils;
 
+import java.io.IOException;
 import java.math.BigInteger;
 import java.security.Key;
 import java.security.PrivateKey;
@@ -211,9 +213,9 @@ public JSONWebKey build(PublicKey publicKey) {
   public JSONWebKey build(Certificate certificate) {
     Objects.requireNonNull(certificate);
     JSONWebKey key = build(certificate.getPublicKey());
-    if (certificate instanceof X509Certificate) {
+    if (certificate instanceof X509Certificate x509Certificate) {
       if (key.alg == null) {
-        key.alg = Algorithm.fromName(((X509Certificate) certificate).getSigAlgName());
+        key.alg = determineKeyAlgorithm(x509Certificate);
       }
 
       try {
@@ -232,6 +234,37 @@ private int getCoordinateLength(ECKey key) {
     return (int) Math.ceil(key.getParams().getCurve().getField().getFieldSize() / 8d);
   }
 
+  private Algorithm determineKeyAlgorithm(X509Certificate x509Certificate) {
+    String sigAlgName = x509Certificate.getSigAlgName();
+    Algorithm result = Algorithm.fromName(sigAlgName);
+    if (result != null) {
+      return result;
+    }
+
+    // The JCA reports RSASSA-PSS, while BC will report the actual algorithm such as SHA256withRSAandMGF1.
+    // - Java really makes you work for it. Dig out the digest OID to identify the algorithm.
+    if ("RSASSA-PSS".equals(sigAlgName)) {
+      byte[] encodedBytes = x509Certificate.getSigAlgParams();
+      try {
+        String oid = new DerInputStream(new DerInputStream(encodedBytes)
+            .getSequence()[1].toByteArray())
+            .getSequence()[1]
+            .getOID().toString();
+
+        result = switch (oid) {
+          case ObjectIdentifier.SHA256 -> Algorithm.PS256; // SHA256withRSAandMGF1
+          case ObjectIdentifier.SHA384 -> Algorithm.PS384; // SHA384withRSAandMGF1
+          case ObjectIdentifier.SHA512 -> Algorithm.PS512; // SHA512withRSAandMGF1
+          default -> null;
+        };
+      } catch (IOException e) {
+        throw new JSONWebKeyBuilderException("Failed to decode X.509 certificate signature algorithm parameters to determine the key type.", e);
+      }
+    }
+
+    return result;
+  }
+
   private KeyType getKeyType(Key key) {
     return switch (key.getAlgorithm()) {
       case "RSA", "RSASSA-PSS" -> KeyType.RSA;

From b2a0c236cfd93a0529d316619b2ab8b922cbeb32 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Wed, 19 Nov 2025 16:26:43 -0700
Subject: [PATCH 26/29] Tests

---
 src/main/java/io/fusionauth/jwt/rsa/RSAPSSSigner.java  | 10 ++++------
 .../java/io/fusionauth/jwks/JSONWebKeyParserTest.java  |  3 +--
 2 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/src/main/java/io/fusionauth/jwt/rsa/RSAPSSSigner.java b/src/main/java/io/fusionauth/jwt/rsa/RSAPSSSigner.java
index 48486f11..f3caa9f1 100644
--- a/src/main/java/io/fusionauth/jwt/rsa/RSAPSSSigner.java
+++ b/src/main/java/io/fusionauth/jwt/rsa/RSAPSSSigner.java
@@ -36,8 +36,6 @@
 import java.security.spec.PSSParameterSpec;
 import java.util.Objects;
 
-import static io.fusionauth.jwt.domain.Algorithm.PS256;
-
 /**
  * This class can sign a JWT using an RSA Private key.
  *
@@ -97,7 +95,7 @@ private RSAPSSSigner(Algorithm algorithm, String privateKey, String kid) {
    * @return a new RSA signer.
    */
   public static RSAPSSSigner newSHA256Signer(String privateKey) {
-    return new RSAPSSSigner(PS256, privateKey, null);
+    return new RSAPSSSigner(Algorithm.PS256, privateKey, null);
   }
 
   /**
@@ -108,7 +106,7 @@ public static RSAPSSSigner newSHA256Signer(String privateKey) {
    * @return a new RSA signer.
    */
   public static RSAPSSSigner newSHA256Signer(String privateKey, String kid) {
-    return new RSAPSSSigner(PS256, privateKey, kid);
+    return new RSAPSSSigner(Algorithm.PS256, privateKey, kid);
   }
 
   /**
@@ -118,7 +116,7 @@ public static RSAPSSSigner newSHA256Signer(String privateKey, String kid) {
    * @return a new RSA signer.
    */
   public static RSAPSSSigner newSHA256Signer(PrivateKey privateKey) {
-    return new RSAPSSSigner(PS256, privateKey, null);
+    return new RSAPSSSigner(Algorithm.PS256, privateKey, null);
   }
 
   /**
@@ -129,7 +127,7 @@ public static RSAPSSSigner newSHA256Signer(PrivateKey privateKey) {
    * @return a new RSA signer.
    */
   public static RSAPSSSigner newSHA256Signer(PrivateKey privateKey, String kid) {
-    return new RSAPSSSigner(PS256, privateKey, kid);
+    return new RSAPSSSigner(Algorithm.PS256, privateKey, kid);
   }
 
   /**
diff --git a/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java b/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
index c39b0e7d..07af13d4 100644
--- a/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
+++ b/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
@@ -35,7 +35,6 @@
 
 import static io.fusionauth.jwks.JWKUtils.base64DecodeUint;
 import static io.fusionauth.jwks.JWKUtils.base64EncodeUint;
-import static io.fusionauth.jwt.domain.Algorithm.RS256;
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
 import static org.testng.Assert.fail;
@@ -253,7 +252,7 @@ public void parse_rsa() {
 
     // Build a JSON Web Key from our own RSA key pair
     JSONWebKey expected = JSONWebKey.build(keyPair.publicKey);
-    expected.alg = RS256;
+    expected.alg = Algorithm.RS256;
 
     PublicKey publicKey = JSONWebKey.parse(expected);
     assertNotNull(publicKey);

From 54ef758edf5c134dc2b658372423b981d36be1f3 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Thu, 20 Nov 2025 09:31:32 -0700
Subject: [PATCH 27/29] Tests

---
 fusionauth-jwt.ipr                                  | 13 ++-----------
 .../java/io/fusionauth/jwks/JSONWebKeyBuilder.java  |  9 ++++-----
 .../io/fusionauth/jwks/JSONWebKeyParserTest.java    |  8 ++++----
 src/test/java/io/fusionauth/pem/PEMEncoderTest.java |  2 +-
 .../resources/jwk/ed_dsa_ed25519_certificate.json   |  3 +--
 .../resources/jwk/ed_dsa_ed25519_public_key.json    |  3 +--
 .../resources/jwk/ed_dsa_ed448_certificate.json     |  3 +--
 src/test/resources/jwk/ed_dsa_ed448_public_key.json |  3 +--
 8 files changed, 15 insertions(+), 29 deletions(-)

diff --git a/fusionauth-jwt.ipr b/fusionauth-jwt.ipr
index 03513f67..7a17aced 100644
--- a/fusionauth-jwt.ipr
+++ b/fusionauth-jwt.ipr
@@ -35,16 +35,7 @@
       <inspection_tool class="Duplicates" enabled="true" level="WARNING" enabled_by_default="true">
         <option name="minCloneLength" value="35" />
       </inspection_tool>
-      <inspection_tool class="ExtractMethodRecommender" enabled="true" level="WARNING" enabled_by_default="true">
-        <option name="minLength" value="550" />
-      </inspection_tool>
-      <inspection_tool class="SizeReplaceableByIsEmpty" enabled="true" level="WARNING" enabled_by_default="true">
-        <option name="ignoredTypes">
-          <set>
-            <option value="java.util.List" />
-          </set>
-        </option>
-      </inspection_tool>
+      <inspection_tool class="SizeReplaceableByIsEmpty" enabled="false" level="WARNING" enabled_by_default="false" />
     </profile>
     <version value="1.0" />
   </component>
@@ -781,4 +772,4 @@
       </state>
     </states>
   </component>
-</project>
\ No newline at end of file
+</project>
diff --git a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
index 5276bda9..2af47ca1 100644
--- a/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
+++ b/src/main/java/io/fusionauth/jwks/JSONWebKeyBuilder.java
@@ -38,7 +38,6 @@
 import java.security.interfaces.ECPrivateKey;
 import java.security.interfaces.ECPublicKey;
 import java.security.interfaces.EdECPrivateKey;
-import java.security.interfaces.EdECPublicKey;
 import java.security.interfaces.RSAPrivateCrtKey;
 import java.security.interfaces.RSAPrivateKey;
 import java.security.interfaces.RSAPublicKey;
@@ -185,11 +184,11 @@ public JSONWebKey build(PublicKey publicKey) {
     } else if (key.kty == KeyType.OKP) {
       key.crv = getCurveOID(publicKey);
       key.alg = Algorithm.fromName(key.crv);
-      int keyLength = KeyUtils.getKeyLength(publicKey);
-      if (publicKey instanceof EdECPublicKey edECPublicKey) {
-        key.y = base64EncodeUint(edECPublicKey.getPoint().getY(), keyLength);
-      }
 
+      // Intentionally not returning the y coordinate for an Ed25519 or Ed448 key.
+      // - The x coordinate contains the complete public key. This contains the y coordinate
+      //   and a single bit indicating the sign of the x coordinate.
+      int keyLength = KeyUtils.getKeyLength(publicKey);
       byte[] publicKeyBytes;
       try {
         var sequence = new DerInputStream(publicKey.getEncoded()).getSequence();
diff --git a/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java b/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
index 07af13d4..e4da7e63 100644
--- a/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
+++ b/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
@@ -214,15 +214,15 @@ public void parse_ec() {
     assertEquals(JSONWebKey.build(pem.publicKey).y, expected.y);
   }
 
-  @DataProvider(name = "EdDSA")
-  public Object[][] edDSA() {
+  @DataProvider(name = "EdDSACurves")
+  public Object[][] EdDSACurves() {
     return new Object[][]{
         {"Ed25519"},
         {"Ed448"},
     };
   }
 
-  @Test(dataProvider = "EdDSA", invocationCount = 1_000)
+  @Test(dataProvider = "EdDSACurves", invocationCount = 1_000)
   public void parse_eddsa(String curve) {
     KeyPair keyPair = curve.equals("Ed25519")
         ? JWTUtils.generate_ed25519_EdDSAKeyPair()
@@ -246,7 +246,7 @@ public void parse_eddsa(String curve) {
     assertEquals(JSONWebKey.build(pem.publicKey).y, expected.y);
   }
 
-  @Test(invocationCount = 1_000)
+  @Test(invocationCount = 100)
   public void parse_rsa() {
     KeyPair keyPair = JWTUtils.generate2048_RSAKeyPair();
 
diff --git a/src/test/java/io/fusionauth/pem/PEMEncoderTest.java b/src/test/java/io/fusionauth/pem/PEMEncoderTest.java
index 9df7458c..6c3a6c2b 100644
--- a/src/test/java/io/fusionauth/pem/PEMEncoderTest.java
+++ b/src/test/java/io/fusionauth/pem/PEMEncoderTest.java
@@ -156,7 +156,7 @@ public void ec_backAndForth() throws Exception {
     assertEquals(encodedPublicKey, expectedPublic);
   }
 
-  @Test(invocationCount = 250)
+  @Test(invocationCount = 100)
   public void rsa() throws Exception {
     KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance("RSA");
     keyPairGenerator.initialize(2048);
diff --git a/src/test/resources/jwk/ed_dsa_ed25519_certificate.json b/src/test/resources/jwk/ed_dsa_ed25519_certificate.json
index ea0ab935..6d6feeb0 100644
--- a/src/test/resources/jwk/ed_dsa_ed25519_certificate.json
+++ b/src/test/resources/jwk/ed_dsa_ed25519_certificate.json
@@ -8,6 +8,5 @@
     "MIIBRjCB+aADAgECAhRkaWbKP+7fMvU0YeWFaLNP4fTOrDAFBgMrZXAwGTEXMBUGA1UEAwwOWW91ckNvbW1vbk5hbWUwHhcNMjUxMTE5MTgzNzExWhcNMzUxMTE3MTgzNzExWjAZMRcwFQYDVQQDDA5Zb3VyQ29tbW9uTmFtZTAqMAUGAytlcAMhAJt4YOrKZL0N9aJoVxx//7seQcJXkpbnzlxHzpVFjpd9o1MwUTAdBgNVHQ4EFgQU0EsYYr79uEtDvXm5BC7S2cP/l3wwHwYDVR0jBBgwFoAU0EsYYr79uEtDvXm5BC7S2cP/l3wwDwYDVR0TAQH/BAUwAwEB/zAFBgMrZXADQQCng75PlxDw8C/6YsU0xmR1CCIrysnodQUc/Y+SidnkIdUOuX02nkUwmUacmiZqoiPazywA1mS9TiHyh9tIBYIO"
   ],
   "x5t": "JPLrwBHnDr6gxvCHibgDjW6yJCk",
-  "x5t#S256": "aSQLmuU9GKdPVWLRAnUB9dD3Kgm_RlPuFGDR7VoL_yE",
-  "y": "fZeORZXOR1zO55aSV8JBHrv_fxxXaKL1Db1kyupgeJs"
+  "x5t#S256": "aSQLmuU9GKdPVWLRAnUB9dD3Kgm_RlPuFGDR7VoL_yE"
 }
diff --git a/src/test/resources/jwk/ed_dsa_ed25519_public_key.json b/src/test/resources/jwk/ed_dsa_ed25519_public_key.json
index 8bedf1ff..e828294c 100644
--- a/src/test/resources/jwk/ed_dsa_ed25519_public_key.json
+++ b/src/test/resources/jwk/ed_dsa_ed25519_public_key.json
@@ -3,6 +3,5 @@
   "crv": "Ed25519",
   "kty": "OKP",
   "use": "sig",
-  "x": "m3hg6spkvQ31omhXHH__ux5BwleSlufOXEfOlUWOl30",
-  "y": "fZeORZXOR1zO55aSV8JBHrv_fxxXaKL1Db1kyupgeJs"
+  "x": "m3hg6spkvQ31omhXHH__ux5BwleSlufOXEfOlUWOl30"
 }
diff --git a/src/test/resources/jwk/ed_dsa_ed448_certificate.json b/src/test/resources/jwk/ed_dsa_ed448_certificate.json
index 6e786517..fa623751 100644
--- a/src/test/resources/jwk/ed_dsa_ed448_certificate.json
+++ b/src/test/resources/jwk/ed_dsa_ed448_certificate.json
@@ -8,6 +8,5 @@
     "MIIBkjCCARKgAwIBAgIUN0sbt0cpXo+mn5o2kU9Kp9F2e+kwBQYDK2VxMBkxFzAVBgNVBAMMDllvdXJDb21tb25OYW1lMB4XDTI1MTExOTE4Mzc1NVoXDTM1MTExNzE4Mzc1NVowGTEXMBUGA1UEAwwOWW91ckNvbW1vbk5hbWUwQzAFBgMrZXEDOgBrxOwIOB/g8RZoBmAoNYziyKnx7CVA0YG+b2D77k5k5rhIwXnZbDMybdEsy+bBHtApB5b5dcJT+gCjUzBRMB0GA1UdDgQWBBSQ6b0X7ezulZj6ELR0xIO+Jb+WBTAfBgNVHSMEGDAWgBSQ6b0X7ezulZj6ELR0xIO+Jb+WBTAPBgNVHRMBAf8EBTADAQH/MAUGAytlcQNzACin0AxBvCvWbsKKeToIXdmnvD+1OgAeuysO77Y/dyiNInkFxINrxtbNrbx+EDuLyGO5oHgal6usgJ/83RapwP2+Zfed+a4ZQ/HynSKNNzOo2LEWDC0mpu3/4ASaTIhpiM800u/QzXilSexuTUG8tZwYAA=="
   ],
   "x5t": "s6yEmdTmvYlE14xE62q9JgEa3sA",
-  "x5t#S256": "eZJkos1xtzK7wCH9ZcRX9e6LFpbSOKaATVphIFjj8v0",
-  "y": "APpTwnX5lgcp0B7B5sss0W0yM2zZecFIuOZkTu77YG--gdFAJezxqcjijDUoYAZoFvHgHzgI7MRr"
+  "x5t#S256": "eZJkos1xtzK7wCH9ZcRX9e6LFpbSOKaATVphIFjj8v0"
 }
diff --git a/src/test/resources/jwk/ed_dsa_ed448_public_key.json b/src/test/resources/jwk/ed_dsa_ed448_public_key.json
index 773cdf43..81a09889 100644
--- a/src/test/resources/jwk/ed_dsa_ed448_public_key.json
+++ b/src/test/resources/jwk/ed_dsa_ed448_public_key.json
@@ -3,6 +3,5 @@
   "crv": "Ed448",
   "kty": "OKP",
   "use": "sig",
-  "x": "gWl4sYkZhkljqw4C0GDCjDgU44Q3-Sxnd9XXZKcP-kcIoEMmcoSFW7aMWJXcWKa5BB6_eyuTE1IA",
-  "y": "AFITkyt7vx4EuaZY3JVYjLZbhYRyJkOgCEf6D6dk19V3Zyz5N4TjFDiMwmDQAg6rY0mGGYmxeGmB"
+  "x": "gWl4sYkZhkljqw4C0GDCjDgU44Q3-Sxnd9XXZKcP-kcIoEMmcoSFW7aMWJXcWKa5BB6_eyuTE1IA"
 }

From 22021eb2d89e9709082b138eaf22dbb1be4ab511 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Thu, 20 Nov 2025 14:20:57 -0700
Subject: [PATCH 28/29] Tests

---
 .../fusionauth/jwks/JSONWebKeyParserTest.java | 34 ++++++++++++++-----
 1 file changed, 25 insertions(+), 9 deletions(-)

diff --git a/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java b/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
index e4da7e63..b1025e87 100644
--- a/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
+++ b/src/test/java/io/fusionauth/jwks/JSONWebKeyParserTest.java
@@ -37,6 +37,7 @@
 import static io.fusionauth.jwks.JWKUtils.base64EncodeUint;
 import static org.testng.Assert.assertEquals;
 import static org.testng.Assert.assertNotNull;
+import static org.testng.Assert.assertNull;
 import static org.testng.Assert.fail;
 
 /**
@@ -229,21 +230,36 @@ public void parse_eddsa(String curve) {
         : JWTUtils.generate_ed448_EdDSAKeyPair();
 
     // Build a JSON Web Key from our own EdDSA key pair
-    JSONWebKey expected = JSONWebKey.build(keyPair.publicKey);
-    expected.alg = Algorithm.Ed25519;
+    JSONWebKey expectedPublicJWK = JSONWebKey.build(keyPair.publicKey);
+    expectedPublicJWK.alg = Algorithm.Ed25519;
+    expectedPublicJWK.kty = KeyType.OKP;
+    assertNotNull(expectedPublicJWK.x);
+    assertNull(expectedPublicJWK.y);
 
-    PublicKey publicKey = JSONWebKey.parse(expected);
+    PublicKey publicKey = JSONWebKey.parse(expectedPublicJWK);
     assertNotNull(publicKey);
 
     // Compare to the original expected key
-    String encodedPEM = PEM.encode(publicKey);
-    assertEquals(JSONWebKey.build(encodedPEM).x, expected.x);
-    assertEquals(JSONWebKey.build(encodedPEM).y, expected.y);
+    String encodedPublicPEM = PEM.encode(publicKey);
+    assertEquals(JSONWebKey.build(encodedPublicPEM).x, expectedPublicJWK.x);
 
     // Get the public key from the PEM, and assert against the expected values
-    PEM pem = PEM.decode(encodedPEM);
-    assertEquals(JSONWebKey.build(pem.publicKey).x, expected.x);
-    assertEquals(JSONWebKey.build(pem.publicKey).y, expected.y);
+    PEM pem = PEM.decode(encodedPublicPEM);
+    assertEquals(JSONWebKey.build(pem.publicKey).x, expectedPublicJWK.x);
+
+    // Build a JWK of the private key
+    JSONWebKey expectedPrivateJWK = JSONWebKey.build(keyPair.privateKey);
+    expectedPrivateJWK.alg = Algorithm.Ed25519;
+    expectedPrivateJWK.kty = KeyType.OKP;
+    assertNotNull(expectedPrivateJWK.d);
+    assertNotNull(expectedPrivateJWK.x);
+    assertNull(expectedPrivateJWK.e);
+    assertNull(expectedPrivateJWK.p);
+    assertNull(expectedPrivateJWK.q);
+    assertNull(expectedPrivateJWK.y);
+
+    // x should match between public and private
+    assertEquals(expectedPrivateJWK.x, expectedPublicJWK.x);
   }
 
   @Test(invocationCount = 100)

From 336bc8655f5fa6ec382e7f26b7b8b027b778fba8 Mon Sep 17 00:00:00 2001
From: Daniel DeGroff <daniel@fusionauth.io>
Date: Mon, 1 Dec 2025 12:23:24 -0700
Subject: [PATCH 29/29] Code comments

---
 .../java/io/fusionauth/jwt/OpenIDConnect.java |  3 +--
 .../java/io/fusionauth/jwt/ec/ECVerifier.java |  2 +-
 .../io/fusionauth/jwt/ed/EdDSAVerifier.java   |  2 +-
 .../java/io/fusionauth/pem/PEMEncoder.java    |  3 +--
 .../java/io/fusionauth/security/KeyUtils.java | 21 +++++++++++++++++++
 .../io/fusionauth/jwt/OpenIdConnectTest.java  |  9 ++------
 6 files changed, 27 insertions(+), 13 deletions(-)

diff --git a/src/main/java/io/fusionauth/jwt/OpenIDConnect.java b/src/main/java/io/fusionauth/jwt/OpenIDConnect.java
index f5572bb0..b4487abd 100644
--- a/src/main/java/io/fusionauth/jwt/OpenIDConnect.java
+++ b/src/main/java/io/fusionauth/jwt/OpenIDConnect.java
@@ -58,9 +58,8 @@ private static String generate_hash(String string, Algorithm algorithm) {
     Objects.requireNonNull(string);
     Objects.requireNonNull(algorithm);
 
-    int leftMostBits;
     MessageDigest messageDigest;
-    leftMostBits = switch (algorithm) {
+    int leftMostBits = switch (algorithm) {
       case ES256, HS256, RS256 -> {
         messageDigest = getDigest("SHA-256");
         yield 128; // 32 * 8 / 2 = 256
diff --git a/src/main/java/io/fusionauth/jwt/ec/ECVerifier.java b/src/main/java/io/fusionauth/jwt/ec/ECVerifier.java
index c58c3cb9..50da9d56 100644
--- a/src/main/java/io/fusionauth/jwt/ec/ECVerifier.java
+++ b/src/main/java/io/fusionauth/jwt/ec/ECVerifier.java
@@ -157,7 +157,7 @@ public void verify(Algorithm algorithm, byte[] message, byte[] signature) {
       verifier.update(message);
 
       byte[] derEncoded = new ECDSASignature(signature).derEncode();
-      if (!(verifier.verify(derEncoded))) {
+      if (!verifier.verify(derEncoded)) {
         throw new InvalidJWTSignatureException();
       }
     } catch (InvalidKeyException | IOException | NoSuchAlgorithmException | SignatureException | SecurityException e) {
diff --git a/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java b/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java
index c0ccb079..4b71396d 100644
--- a/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java
+++ b/src/main/java/io/fusionauth/jwt/ed/EdDSAVerifier.java
@@ -129,7 +129,7 @@ public void verify(Algorithm algorithm, byte[] message, byte[] signature) {
       verifier.initVerify(publicKey);
       verifier.update(message);
 
-      if (!(verifier.verify(signature))) {
+      if (!verifier.verify(signature)) {
         throw new InvalidJWTSignatureException();
       }
     } catch (InvalidKeyException | NoSuchAlgorithmException | SignatureException e) {
diff --git a/src/main/java/io/fusionauth/pem/PEMEncoder.java b/src/main/java/io/fusionauth/pem/PEMEncoder.java
index 28444d06..5efc5189 100644
--- a/src/main/java/io/fusionauth/pem/PEMEncoder.java
+++ b/src/main/java/io/fusionauth/pem/PEMEncoder.java
@@ -98,8 +98,7 @@ public String encode(PrivateKey privateKey, PublicKey publicKey) {
       throw new PEMEncoderException(new InvalidParameterException("At least one key must be provided, they may not both be null"));
     }
 
-    Key key;
-    key = Objects.requireNonNullElse(privateKey, publicKey);
+    Key key = Objects.requireNonNullElse(privateKey, publicKey);
     StringBuilder sb = new StringBuilder();
     addOpeningTag(key, sb);
     try {
diff --git a/src/main/java/io/fusionauth/security/KeyUtils.java b/src/main/java/io/fusionauth/security/KeyUtils.java
index d63ed07e..3146b064 100644
--- a/src/main/java/io/fusionauth/security/KeyUtils.java
+++ b/src/main/java/io/fusionauth/security/KeyUtils.java
@@ -98,8 +98,29 @@ public static ObjectIdentifier getCurveOID(Key key) throws IOException {
    */
   public static byte[] deriveEdDSAPublicKeyFromPrivate(byte[] privateKey, String curve) throws NoSuchAlgorithmException, InvalidAlgorithmParameterException {
     KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(curve);
+
+    // Ensure the curve is expected, and we can identify the expected key length.
+    String algorithm = keyPairGenerator.getAlgorithm();
+    int expectedByteLength = switch (algorithm) {
+      case "Ed25519" -> 32;
+      case "Ed448" -> 57;
+      default ->
+          throw new IllegalArgumentException("You specified an unsupported algorithm. The algorithm [" + algorithm + "]"
+              + " is not supported. You must use Ed25519 or Ed448.");
+    };
+
+    // Ensure the caller provided a key of the correct length.
+    if (privateKey.length != expectedByteLength) {
+      throw new IllegalArgumentException("The provided privateKey length is unexpected. Expected [" + expectedByteLength + "] but found [" + privateKey.length + "]");
+    }
+
     keyPairGenerator.initialize(new NamedParameterSpec(curve), new SecureRandom() {
       public void nextBytes(byte[] bytes) {
+        // Note that because we pass the curve to the NamedParameterSpec constructor, it would be unexpected that the provided
+        // byte array would not fit the expected key length. As a fail save, ensure it fits.
+        if (bytes.length != privateKey.length) {
+          throw new IllegalStateException("Provided bytes array is not large enough for the key. Expected [" + privateKey.length + "] but found [" + bytes.length + "]");
+        }
         System.arraycopy(privateKey, 0, bytes, 0, privateKey.length);
       }
     });
diff --git a/src/test/java/io/fusionauth/jwt/OpenIdConnectTest.java b/src/test/java/io/fusionauth/jwt/OpenIdConnectTest.java
index 95183573..172b48f1 100644
--- a/src/test/java/io/fusionauth/jwt/OpenIdConnectTest.java
+++ b/src/test/java/io/fusionauth/jwt/OpenIdConnectTest.java
@@ -88,13 +88,8 @@ public void test_c_hash() {
 
     // The JCA does not ship with SHAKE256 which will be used to calculate the hash for Ed448.
     // - Expect this to fail unless FIPS has been enabled.
-    try {
-      assertEquals(c_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.Ed448), "ACuRpk9jl5IEa3yqpBCNNOCpBEI7qjud6mc80cs6vWX2fcqpsk8RozYBKTUuSS6SqJhw302xFZeM");
-    } catch (Exception e) {
-      if (FipsEnabled) {
-        throw e;
-      }
-    }
+    requiresShake256(() ->
+        assertEquals(c_hash("dNZX1hEZ9wBCzNL40Upu646bdzQA", Algorithm.Ed448), "ACuRpk9jl5IEa3yqpBCNNOCpBEI7qjud6mc80cs6vWX2fcqpsk8RozYBKTUuSS6SqJhw302xFZeM"));
 
     // Controls
     assertEquals(c_hash("16fd899f-5f0c-3114-875e-2547b629cd05", Algorithm.HS256), "S5UOXRNNyYsI6Z0G3xxdpw");