SignFinal error

[m1n1b00]

I'm trying to generate a signature with jws.sign and I keep getting an error that seems to be coming from crypto.js.

My node code is as follows:

---

var jws = require('jws');

function getIdentityToken(userID, nonce) {
// Get Provider, Key ID, and private key from Heroku Environment Variables
        var layerProviderID = process.env.LAYER_PROVIDER_ID;  // looks something like ed47c64a-a74f-11e4-85ff-d2a153003309
        var layerKeyID = process.env.LAYER_KEY_ID;  // looks something like ed47c64a-a74f-11e4-85ff-d2a153003309
        var privateKey = process.env.LAYER_KEY;  MIICWwIBAAKBgQCP/pfcXdzD9f6kK/7cXE+LwvS1fd6JWXDLIxo5wjyjaL9+dMMo6yucGuQRAwORHQpePOtX2vGtRLlS2Cw23YPCpoYa8RLC9CWCOf8yXzj6kz7L5aBZeCZcaWAph0W+939nyprc4H4iAbydOkY1Ydjnnx+CcnXSpMl1GiV6OsbyiwIDAQABAoGARVZtPfocwmgENH3S/b2duEkqmPKBZFYjUE4Y5NM5a96Wx4fmKiAEIel5BRAUeZ4oTfS7xtRxJ+Q98TyTHeBQ/4LAipjs1srgPQUCgs3L1KmflmjdnnGl0KmxZomW9iUxKt6PEoG3sRxWMW3gd84gWJ3twZde1Hp0CYQ4LawzmECQQDPx+gnsLazEyNgZoCLM9zXWQxm2g9cRW0CVk64XQELowaV3Q3Bg94y4IwSyY6kms2gw6OLMHZs9rJ7jgtR0RLJAkEAsWkwfLZmM/AnnPA5ozqelx8VgDQvg13wPfYFz1/qxFA5/QJnmJBLfRnr7imS94Mgla/b4zHtq5iaOPSaFfhQswJAJfgZ7GbWfBLbPBp/EvD/Qjr7kS/37pyhNvQenoIgVsgLxAcJJHu8dv+hmS1L67h+KwqVMDJC8daC9yEV4HWcQQJAbP5J6qSIn6oQPCudzXlrCzjhq5iupcRSaTwbBxQiRi/AZ4CXFDYbAyefN+bCS+PsXXr7+4VK+lIzlYA41fyLXwJAcf30R3VqT757JDSQ8URSyI1IzA016dkxiR86h9p2mBiLMVo2E0V8pLI5KW1vpL8czlTGCzSNsc7Wu49QLej96g==

        if (!layerProviderID || !layerKeyID || !privateKey) {
            res.send(500, { status: 500, message: err.message });
        } 

        var header =  {
      typ: "JWS", 
      alg: "RS256", 
      cty: "layer-eit;v=1", 
      kid: layerKeyID,
    };

    var currentTimeInSeconds = Math.round(new Date() / 1000);
    var expirationTime = currentTimeInSeconds + 10000;

    var payload = JSON.stringify({
      iss: layerProviderID,
      prn: userID,
      iat: currentTimeInSeconds,
      exp: expirationTime,
      nce: nonce,
    });

    var signature = jws.sign({ 
      header: header, 
      payload: payload, 
      secret: privateKey.toString()
    });

    return signature;
};
exports.getIdentityToken = getIdentityToken;

---

The error I'm getting is:

40735208461056:error:0906D06C:PEM routines:PEM_read_bio:no start line:../deps/openssl/openssl/crypto/pem/pem_lib.c:703:Expecting: ANY PRIVATE KEY
Error: SignFinal error
    at Sign.sign (crypto.js:429:27)
    at Object.sign (/work/dif-api/node_modules/jws/node_modules/jwa/index.js:51:47)
    at Object.jwsSign [as sign] (/work/dif-api/node_modules/jws/index.js:34:26)
    at Object.getIdentityToken (/work/dif-api/lib/layerAuth.js:35:25)
    at /work/dif-api/routes/users.js:118:41
    at Layer.handle [as handle_request] (/work/dif-api/node_modules/express/lib/router/layer.js:82:5)
    at next (/work/dif-api/node_modules/express/lib/router/route.js:100:13)
    at Route.dispatch (/work/dif-api/node_modules/express/lib/router/route.js:81:3)
    at Layer.handle [as handle_request] (/work/dif-api/node_modules/express/lib/router/layer.js:82:5)
    at /work/dif-api/node_modules/express/lib/router/index.js:235:24

Do you see anything wrong with the call to jws.sign()? Or any clues as to why this error is being generated?

[brianloveswords]

The error is complaining about your key being invalid. I've highlighted the important bits of the error below:

40735208461056:error:0906D06C:PEM routines:PEM_read_bio:no start line:../deps/openssl/openssl/crypto/pem/pem_lib.c:703:Expecting: ANY PRIVATE KEY

OpenSSL is very particular about the key format and if its deviates at all it'll blow up. In this case it's complaining that it can't find "ANY PRIVATE KEY" because of "no start line". Your key should look like this:

-----BEGIN RSA PRIVATE KEY-----
MIIEowIBAAKCAQEAwi6L+3z3QeYqJ/9WTVTkIYuf9ESYwj5hGKVXvK5EjbbUYAsL
g44k9KqatiyPv75iEA1hK/tBudsaDhXIGAxebOo+RsJppQqWEBvCInoaiRI1a4FV
roxi4r5/rj1exjgCAjjFVUMOdu32jGsZfya3G4zWcbVdaJ4FHqdBgJd5hUVocckw
Vu4KpB/gZaeu7CQvMwau3ve2YzSjoaQdnckYAJaK/39hOGueUvBUhb5Z8k4aWSJn
moDjgADAPRPL6qFWoLDWg0y64JM8bnUh9kFyy8ZoYKf6rN5oUFsP7geRzuBmTqVN
cvf56k05RRningp/gNBxXBo1/w/JS/X9yrQWFQIDAQABAoIBAEkW9CGpG/h2BhAg
D//zoBrwTzjGSSl0CWAZfDjM74jX9IBiJ+dQraBaRvmjNEhcBNU99AF2BXtLeTcs
A7DplvEwCljf/JverDVL/Xq0syA89laMzA9zUBVA1xZiizXZBwiHDd/V6a/iShb4
iRRPIkUAcgdC2PHz6MFs+z7HxTngCfoBra9E3SYgo6JT/yLG4I0uFgUhPestekmF
LYAdaLODMCElffumbj7QDcCLlSx3l+n1GnKmvTcTDBEp0Ij/zCuO+uLv3V+75moS
sEzCrY8oCMk7yhYjbP8ZUWQVsWhQXUIXzYNCXbaByFm9JG70T8TRbj8kWMzkk/CV
O0j3A4ECgYEA7yrjkMVJwZkpuAnGJZcBgwKt0S4Oks766VeOcqUI8U9uD2UEwyIo
Cu5a/fZ1JvfgArUBhc1VF3TcT4wJELiYiEGgh4tJpMPv/yx16JQyrGoZOSxeHNIE
SbN88G/dWOxEKTTepN7xoeToD7FT1Y5Y89htcoBlNfRs3UwhvwRNn30CgYEAz9kl
DkUG6WlMUReZSqnMK4t6f5fYdhlbwHGGoVPhD6TJ9yMzRMjMtZXVV7c/V9b4scxC
YJ7066gCvfEdpIroFUd+ftpYLmZudMeG+563XqA3qqVGuASjYAzCDmrJ5owqW2Df
saMtepdFYGso/ci+OD/5MWm7T3szX1jbzTgIxHkCgYAu0jimuNjNm8x9CPzPkxZq
rXWVw+x6dSbN06RBcWmkxCYJwX8DLIamTS9nFH6u2Ev0e7cGmMIVy3zt3b5QlbLW
yfJBVtVd+jXbwLp8g7a/5i118eeiwMKyIv9Mmrm8lNRrNLx5jmPDi+qaV97PqgRk
CHS0u8oUm/tL/4GDwbXoiQKBgQCy6Jr4+XnFmJnUg5ezqQzRvrGm+rGclp9fu1jD
rUvhB1vBm08aOi3bcCm/40Bm/+f6Q3QvbyQrZOdXUCDP7bFv/6Zm0tNsvUb+xnDu
TeRRU2AXR0TkSTnIB7NSbaF1Ddm35l8mrOsMxwE0yYjzSsRR7t81JWnSNJ43yGkK
8Ny7IQKBgB1cJ42I+2Impirnf2DLGLrdHIctZrHh2o+NryDOBf1kEArkG/QI35JI
CuDAWYNcWmJLHNazNrqRiuj9oLUZTT/GBY3w2BVDOVaCUOpb2CHpT54nMDB/jZoF
LKK8ri78yWj9C6RyGIJDqmealJraSVrbULNZqYzfyBDvj4ItG2zQ
-----END RSA PRIVATE KEY-----

(note: that's a brand new RSA private key I generated with openssl genrsa 2048 for the purpose of this example)

The start line it's looking for is that -----BEGIN RSA PRIVATE KEY-----\n. In my testing the key parser is also sensitive enough that it requires those line breaks after every 64 characters or else you'll get a bad base64 decode error.

[brianloveswords]

I'm gonna close this for now, let me know if you need anymore help!

[m1n1b00]

Thank you so much for the clarification. I followed your instructions and it fixed the error immediately.

[groovecoder]

I may need some similar help. I'm adding VAPID to web-push and using jws to do it:

+         var header = { typ: "JWT", alg: "ES256" };
+         var now = Math.floor(Date.now() / 1000);
+         var payload = { aud: vapid.audience, exp: now + 86400, sub: vapid.subject};
+         var appKeys = crypto.createECDH('prime256v1');
+         appKeys.generateKeys();
+         var signature = jws.sign({
+           header: header,
+           payload: payload,
+           privateKey: appKeys.getPrivateKey()
+         });
+         auth = "Bearer " +
+           urlBase64.encode(JSON.stringify(header)) + "." +
+           urlBase64.encode(JSON.stringify(payload)) + "." +
+           JSON.stringify(signature);
+         options['Authorization'] = auth;
+         options['Crypto-Key'] = "p256ecdsa=" + urlBase64.encode(appKeys.getPublicKey())

But on the jws.sign I'm getting the same error:

Error: error:0906D06C:PEM routines:PEM_read_bio:no start line
    at Error (native)
    at Sign.sign (crypto.js:279:26)
    at sign (/Users/lcrouch/code/web-push/node_modules/jws/node_modules/jwa/index.js:54:47)
    at Object.sign (/Users/lcrouch/code/web-push/node_modules/jws/node_modules/jwa/index.js:74:27)
    at Object.jwsSign [as sign] (/Users/lcrouch/code/web-push/node_modules/jws/lib/sign-stream.js:23:26)
    at repl:1:5
    at REPLServer.defaultEval (repl.js:252:27)
    at bound (domain.js:287:14)
    at REPLServer.runBound [as eval] (domain.js:300:12)
    at REPLServer.<anonymous> (repl.js:417:12)

The appKeys.getPrivateKey() doesn't return anything like the RSA private key I'm used to seeing. 😢 ...

> var privateKey = appKeys.getPrivateKey()
undefined
> privateKey.toString()
'Q�K��\fۄ��-���]�\u0012������HB�\n^�a��'
> privateKey.toString('hex')
'51c84b9b920cdb8488922d95f8d95d811299abb6e7fdf84842bd0a5eef61f0fa'

So, (how?) can I use a private key generated by Node Crypto?

[joelwass]

Why does the sign.sign() method not allow single line keys? What is the reasoning behind this, and are there any options we can pass so that it allows single line keys without line breaks?

Trying to load the private key through an elastic beanstalk environmental variable.

[omsmith]

@joelwass No, it is an OpenSSL behaviour. Feel free to correctly format the key from your input source.