Mixing up Public and Private Keys in OpenID Connect deployments

I am developing a tool to check cryptographic public keys for known vulnerabilities called badkeys . During the Q&A session of a presentation about badkeys at the German OWASP Day , I was asked whether I had ever used badkeys to check cryptographic keys in OpenID Connect setups. I had not until then. OpenID Connect is a single sign-on protocol that allows web pages to offer logins via other…