Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Creating RS256 signer from base64-encoded key #47

Closed
sidmani opened this issue Apr 16, 2017 · 11 comments
Closed

Creating RS256 signer from base64-encoded key #47

sidmani opened this issue Apr 16, 2017 · 11 comments

Comments

@sidmani
Copy link

sidmani commented Apr 16, 2017

I can't seem to get the library to create a JWT using the RS256 signer. I have some key that looks like this:
-----BEGIN PRIVATE KEY-----\nMIIEvA......a5efqA==\n-----END PRIVATE KEY-----\n
First, I removed the beginning and ending tags, and the \n's, so I have just the base64-key: MIIEvA...a5efqA==
as a string. I then used the .bytes method (that was used in the playground example) to convert it to the correct type, and initialized the signer like so:
let signer = try RS256(key: key.bytes)
However, this throws an error: "JWT error: Could not create key". Why is this? I tried using Data and Array to convert the string to [UInt8] as well, but that gave the same error. Is there a better way to create the signer object without doing the type conversion myself?
Thank you!

@vzsg
Copy link
Member

vzsg commented Apr 16, 2017

In the playground example, the HS256 algorithm was used where pretty much any byte array can be used as the secret.

In RSA however, you need to provide the key data correctly. In this case, since the key is not automatically Base64-decoded, you should use key.bytes.base64Decoded instead of key.bytes.

@sidmani
Copy link
Author

sidmani commented Apr 16, 2017

Yep, that fixed it. Thanks.

@sidmani sidmani closed this as completed Apr 16, 2017
@gaughyean
Copy link

In my case (ES256),
let url = URL.init(fileURLWithPath: "/Users/aamac/Desktop/HelloWorld/AuthKey_demoKey.p8")
let data = try Data.init(contentsOf: url)
I try let signer = ES256.init(key: data.makeBytes().base64Decoded) and let signer = ES256.init(key: data.makeBytes()) , but it didn't work. The token I create still don't work.. I got a http status code 500 from the response...
What's wrong with my codes? I can get the right token using a Python library, and get a http status code 200... @vzsg @sidmani @natebird Thank you !

@siemensikkema
Copy link
Member

siemensikkema commented Jun 13, 2017 via email

@gaughyean
Copy link

gaughyean commented Jun 14, 2017

@siemensikkema I try to do this in the terminal:
AAMacdeMac-mini:Desktop aamac$ openssl ecparam -name prime256v1 -genkey | openssl ec -in /Users/aamac/Desktop/HelloWorld/demoKey.p8 -noout -text
read EC key
Private-Key: (256 bit)
priv:
53:6d:3c:28:28:3f:76:8a:a2:4b:3b:15:17:9b:24:
9d:5b:58:4a:0b:7c:ff:7a:22:60:66:ef:af:22:11:
af:34
pub:
04:1f:ae:f0:d6:8b:31:27:58:0c:c1:d8:7c:76:af:
f3:72:bc:80:4e:e8:a1:81:0c:be:f0:91:9a:0a:9f:
3e:12:9b:8f:b5:3f:57:61:0f:d7:d5:12:16:ec:76:
8a:bd:44:a1:1f:f1:db:f3:4c:e6:4c:68:2f:e2:2e:
a6:45:29:23:7a
ASN1 OID: prime256v1
NIST CURVE: P-256

After that I copied the hex data(priv) and use the tools(http://tomeko.net/online_tools/hex_to_base64.php) to convert the key to base64 (U208KCg/doqiSzsVF5sknVtYSgt8/3oiYGbvryIRrzQ=), then I used the converted base64 string as a key to do this:let keyData = Data.init(base64Encoded:"U208KCg/doqiSzsVF5sknVtYSgt8/3oiYGbvryIRrzQ=")! let signer = ES256.init(key: keyData.makeBytes()) and then creatToken.
I really don't know too much about signature and encryption...
Thanks for your help! @siemensikkema
The token was created, but the request was still not successful..

@siemensikkema
Copy link
Member

siemensikkema commented Jun 14, 2017

Hmm, there must be some other difference then. Are the headers and payload exactly the same as the token you're creating with the Python library?
This goes beyond the scope of this issue. Why don't you join us on Slack and ask in #help.

@gaughyean
Copy link

thanks~

@rurza
Copy link

rurza commented Jul 18, 2017

@gaughyean Any progress? I have the same issue

@gaughyean
Copy link

gaughyean commented Jul 19, 2017 via email

@OleksiiKolosovskyi
Copy link

Is there any progress for support p8 + ES256?
I need this for Apple Music API.
Requirements from Apple docs "...encrypt the token using the Elliptic Curve Digital Signature Algorithm (ECDSA) with the P-256 curve and the SHA-256 hash algorithm..."

@vzsg
Copy link
Member

vzsg commented Sep 8, 2017

I'm not aware of anyone succeeding with calling the Apple Music API with Vapor's JWT library 😞

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

6 participants