FAPI not currently compliant with CNSA 2.0
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 3
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
Originally submitted by josephheenan (Joseph Heenan) on 2026-03-16
As mentioned at IETF OAuth WG call today
https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/0/CSI_CNSA_2.0_FAQ_.PDF disallows the use of SHA256 in favour of SHA-384 or SHA-512 which I believe may means FAPI can't be used in environments that have policies that require CNSA 2.0 compliance (e.g. PKCE requires SHA256).
https://datatracker.ietf.org/doc/draft-skokan-oauth-additional-hashes/ is part of the potential fix for that.
This is probably something we consider as part of general support for post-quantum?
Bitbucket status: open
Bitbucket origin: issue 856
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the CNSA 2.0 FAQ and the OAuth Additional Hashes draft linked in the issue, then trace how FAPI requirements reference PKCE and SHA-256. The issue names no files or tests; first establish the affected requirements and a concrete compliance criterion before implementation, with completion meaning the resulting FAPI guidance or requirements are validated against CNSA 2.0.
Written by the indexing model from the issue text.
Assessment
- Domain
- api, cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100