Failure in Validating an EdDSA signed JWT when Key in Keystore has Private Part #1034
Unanswered
Unkn0wnCat
asked this question in
Q&A
Replies: 1 comment 1 reply
-
|
@Unkn0wnCat Hmmm, I think this can be fixed internally. Does this PoC patch work for you? diff --git a/internal/keyconv/keyconv.go b/internal/keyconv/keyconv.go
index 807da1d..907f8aa 100644
--- a/internal/keyconv/keyconv.go
+++ b/internal/keyconv/keyconv.go
@@ -145,6 +145,13 @@ func Ed25519PrivateKey(dst, src interface{}) error {
func Ed25519PublicKey(dst, src interface{}) error {
if jwkKey, ok := src.(jwk.Key); ok {
+ if okpPrivateKey, ok := jwkKey.(jwk.OKPPrivateKey); ok {
+ okpPublicKey, err := okpPrivateKey.PublicKey()
+ if err != nil {
+ return fmt.Errorf(`failed to convert jwk.OKPPrivateKey to jwk.OKPPublicKe: %w`, src, err)
+ }
+ jwkKey = okpPublicKey
+ }
var raw ed25519.PublicKey
if err := jwkKey.Raw(&raw); err != nil {
return fmt.Errorf(`failed to produce ed25519.PublicKey from %T: %w`, src, err) |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
For the record this (its equivalent) was released with v2.0.20 |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
-
Heyo,
I'm currently working on an auth server and I need to both generate and later validate JWTs. For this I'm using an Ed25519-key from a Keystore:
{ "keys": [ { "alg": "EdDSA", "crv": "Ed25519", "d": "coaeZE6dZkrtXbv4I4igYvt48K_24CLPfejP3dUWk5I", "kid": "3V0cnH2jLGOY/6wOlmGIwjEoJjsb7BCL5BX1d4xqXaXz/5i1L7PDMPCmxtNWVxLNGAVuPv5wLxGYvwzIAOAASw==", "kty": "OKP", "x": "aquIV-zMEoRL7K65jzwncCKQCfsaYdvjRFSVYjYyldk" } ] }(Don't worry, these are Dev keys and will be thrown away after this is all done 😛)
Then later I sign a key like this:
Which produces a token (
eyJhbGciOiJFZERTQSIsImtpZCI6IjNWMGNuSDJqTEdPWS82d09sbUdJd2pFb0pqc2I3QkNMNUJYMWQ0eHFYYVh6LzVpMUw3UERNUENteHROV1Z4TE5HQVZ1UHY1d0x4R1l2d3pJQU9BQVN3PT0iLCJ0eXAiOiJKV1QifQ.eyJhdWQiOlsiaHR0cDovL3Rlc3QubG9jYWwiXSwiaWF0IjoxNzAyOTMzMzMyLCJpc19mcm9udGVuZF90b2tlbiI6dHJ1ZSwiaXNzIjoiaHR0cDovL3Rlc3QubG9jYWwiLCJqdGkiOiI2NTgwYjM1NDFhMTBjNTQ1ZmEwZmUyZjgifQ.oMmzxCYH0s3N5ZalFE4vazw-t0IWTPQambrwFYenXKuIlnbWPGfBTYkMJqTAbZcPrPHPcxlnYo6PSIqBnJ4aBA) which I then want to validate:Unfortunately this is where the whole excercise takes a turn for the worse and my program dies:
This seems to be due to the key in the keystore containing a private part. When
dis removed from the keystore the validation succeeds.The actual question: Is there any good way on how to fix this without keeping two keystores?
I've tried looking through the docs, but couldn't find anything on this. Please excuse if I just overlooked something. 😄
Thanks in advance and have a nice day,
Kevin
EDIT When explicitly choosing a key and converting it to a public key it works:
This just kinda defeats the purpose of putting my
kidandalgin the JWT...Beta Was this translation helpful? Give feedback.
All reactions