Failure in Validating an EdDSA signed JWT when Key in Keystore has Private Part #1034
Unanswered
Unkn0wnCat
asked this question in
Q&A
Replies: 1 comment 1 reply
-
|
@Unkn0wnCat Hmmm, I think this can be fixed internally. Does this PoC patch work for you? diff --git a/internal/keyconv/keyconv.go b/internal/keyconv/keyconv.go
index 807da1d..907f8aa 100644
--- a/internal/keyconv/keyconv.go
+++ b/internal/keyconv/keyconv.go
@@ -145,6 +145,13 @@ func Ed25519PrivateKey(dst, src interface{}) error {
func Ed25519PublicKey(dst, src interface{}) error {
if jwkKey, ok := src.(jwk.Key); ok {
+ if okpPrivateKey, ok := jwkKey.(jwk.OKPPrivateKey); ok {
+ okpPublicKey, err := okpPrivateKey.PublicKey()
+ if err != nil {
+ return fmt.Errorf(`failed to convert jwk.OKPPrivateKey to jwk.OKPPublicKe: %w`, src, err)
+ }
+ jwkKey = okpPublicKey
+ }
var raw ed25519.PublicKey
if err := jwkKey.Raw(&raw); err != nil {
return fmt.Errorf(`failed to produce ed25519.PublicKey from %T: %w`, src, err) |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
For the record this (its equivalent) was released with v2.0.20 |
Beta Was this translation helpful? Give feedback.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Heyo,
I'm currently working on an auth server and I need to both generate and later validate JWTs. For this I'm using an Ed25519-key from a Keystore:
{ "keys": [ { "alg": "EdDSA", "crv": "Ed25519", "d": "coaeZE6dZkrtXbv4I4igYvt48K_24CLPfejP3dUWk5I", "kid": "3V0cnH2jLGOY/6wOlmGIwjEoJjsb7BCL5BX1d4xqXaXz/5i1L7PDMPCmxtNWVxLNGAVuPv5wLxGYvwzIAOAASw==", "kty": "OKP", "x": "aquIV-zMEoRL7K65jzwncCKQCfsaYdvjRFSVYjYyldk" } ] }(Don't worry, these are Dev keys and will be thrown away after this is all done 😛)
Then later I sign a key like this:
Which produces a token (
eyJhbGciOiJFZERTQSIsImtpZCI6IjNWMGNuSDJqTEdPWS82d09sbUdJd2pFb0pqc2I3QkNMNUJYMWQ0eHFYYVh6LzVpMUw3UERNUENteHROV1Z4TE5HQVZ1UHY1d0x4R1l2d3pJQU9BQVN3PT0iLCJ0eXAiOiJKV1QifQ.eyJhdWQiOlsiaHR0cDovL3Rlc3QubG9jYWwiXSwiaWF0IjoxNzAyOTMzMzMyLCJpc19mcm9udGVuZF90b2tlbiI6dHJ1ZSwiaXNzIjoiaHR0cDovL3Rlc3QubG9jYWwiLCJqdGkiOiI2NTgwYjM1NDFhMTBjNTQ1ZmEwZmUyZjgifQ.oMmzxCYH0s3N5ZalFE4vazw-t0IWTPQambrwFYenXKuIlnbWPGfBTYkMJqTAbZcPrPHPcxlnYo6PSIqBnJ4aBA) which I then want to validate:Unfortunately this is where the whole excercise takes a turn for the worse and my program dies:
This seems to be due to the key in the keystore containing a private part. When
dis removed from the keystore the validation succeeds.The actual question: Is there any good way on how to fix this without keeping two keystores?
I've tried looking through the docs, but couldn't find anything on this. Please excuse if I just overlooked something. 😄
Thanks in advance and have a nice day,
Kevin
EDIT When explicitly choosing a key and converting it to a public key it works:
This just kinda defeats the purpose of putting my
kidandalgin the JWT...Beta Was this translation helpful? Give feedback.
All reactions