JWT Authentication with secp256k1 Private Key

[Atralupus]

We are currently discussing the introduction of JWT-based authentication for ArenaService in Discussion #33.
The proposed method involves players signing JWTs with their secp256k1 private keys to authenticate API requests.

To move the discussion forward, I’d like to provide a concrete example implementation demonstrating the following:

Key Points:

1. JWT Generation:

   • Clients generate JWTs signed with their private key.
   • The payload includes claims like aud (audience), sub (avatar address), pbk (public key), iat (issued at), and exp (expiry).

   Example payload:

   {
     "aud": "arena-service",
     "sub": "0xf392d97E~~",
     "pbk": "bfcab7e8e0abac276b~~",
     "iat": 1718561199,
     "exp": 1718564799
   }

2. Server-Side Validation:

   • Verify the JWT signature using the provided pbk.
   • Derive the avatar address from the pbk and ensure it matches the sub claim.

[Atralupus]

I am working on signing a JWT using a 9c private key generated with secp256k1. This involves deriving an ECDsa key for signing and verifying that the address derived from the public key included in the payload matches correctly.

[Atralupus]

I am working on signing a JWT using a 9c private key generated with secp256k1. This involves deriving an ECDsa key for signing and verifying that the address derived from the public key included in the payload matches correctly.

I lacked knowledge in cryptography, so I tried various approaches and eventually reached out to the Libplanet development team. They informed me that secp256k1 is not compatible with secp256r1, making it difficult to force compatibility.

Additionally, according to RFC 7519 Section 8, secp256k1 is not a supported algorithm by default, which further complicates the process of coercing it into signing.

Given this, it seems better to abandon the idea of using the ASP.NET Core authentication features and instead directly handle authentication by signing JWT JSON payloads with secp256k1 and validating the signature manually.