最近,我一直致力于实现一个web服务,该服务对JWT进行签名和发布,并为JWT验证目的公开JWT端点。
根据IETF规范,JWT / JWK非常简单,但我注意到一些奇怪的东西,我还无法解释:
TL;DR:为什么EC P-256源密钥用于与RSA algo签署JWT?
说来话长:
我使用一个预先存在的私钥文件来对JWT进行签名,并将JWK导入到node-jose密钥存储库。
密钥库:
const jose = require('node-jose');
const fs = require('fs')
const PRIVATE_KEY_PATH = process.env.PRIVATE_KEY_PATH
const privateKey = fs.readFileSync(PRIVATE_KEY_PATH,"utf8");
console.log('Begin import of private key to the JWKS...')
let jwkJson = {}
const jwks = jose.JWK.createKeyStore();
jwks.add(privateKey, 'pem').then(function(jwk) {
console.log(`Imported JWK:\n${JSON.stringify(jwk, null, 2)}`)
jwkJson = jwks.toJSON(true)
});
const getPrivateKey = () => {
return privateKey;
}
const getJwks = () => {
return jwkJson
}
module.exports = {
getPrivateKey,
getJwks
}JWT:
const jwt = require('jsonwebtoken')
const keystore = require('../util/keystore')
const payload = {
cert_hash: 'whatever'
}
const signOptions = {
algorithm: "RS256",
expiresIn: Math.floor(Date.now() / 1000) + 1800,
issuer: 'whatever',
subject: 'whatever'
}
return jwt.sign(payload, keystore.getPrivateKey(), signOptions);看上去很标准,而且看起来很管用。
捕获在键文件类型中。它是Elliptic Curve (ES) P-256或者在JWT中- ES256是通过openssl创建的
openssl ecparam -genkey -name P-256 -noout -out api-gw.key示例密钥:
-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDNkiJxzt3uGhxh
OzlG1Zs4HRx0rn1caAcyrzGiIK3LxD4ewcUPqjco8ONbrMSxhurMZbbZyasUyDs5
2guveFhGVYQzfgMmJLK77eAkEB6zHcAP76tpv6LYFuDNTep9pUc+5tQIyNDY5hKe
UMkxrgzckTVyLpzcH2tsugjUUT4A7ad4brXR1/3hqusA53DNucI4Sv7CJTAGMenN
8SwifbIwxvlORFQ8QvYCBdW8HZ1TvoBz3E6vk7gypNUvRNAVMquQapb6LS0VkmSg
bk5cSaopcvyn2Oq+cxnSh7glgZcfeopZ80j4bFmsZnK2UDJnAGm+RC7Q1SvMDhhb
7F/1x97fAgMBAAECggEAPMLj8XWuvVD0cHzb2icLARQBtC9bGHQbJI0KA5zbIe54
Wgj2IUIzmaNR4Gf5n2t8fTvXRxpHuhXRA7GCYLQWi3t9XubxMVYJimiuJpqpKFIz
0cIKjXA6RtrESYqtM8Qlgd8ibxJEQMgIWskQHuIOJSe6f2xtqtaSnwmB0JfO1uDg
RnZoUEd+oZMqu2vqz0cL0e1Q6UR9WYpSH68uS05KgYlZOzOsHMadkXfwW6BEqYd6
2gh9I1GkrY0ZsuCOVhCAc7rtuUQRMnpACNuWci/qPKQLcvSJBojS/W9xEVrVBXkQ
AZyZltjw1B5CJ9/2lbFVRTM4D/JSS84BsQEwsZm2MQKBgQDrL9kIlKCTXNl4lTYk
G8JTKV85/MUY2seWmg2K18EL8ovovY15TjKF5N6g518phmiMUPg+QxkFiAY3gZ4A
+aXsdkxo2XeTEOxFQ3ysbI4H0L0+GMCCAvqCGJr4c1kGSB1kFnGDlo7bSXBUxwlZ
4tTnVQEX0H+mfTJ7yOxv7A/lWQKBgQDfw1XtbnykCEbWXNsmgzzrmk3vvZKlNfc8
CR6PD6fCCa/yYwCv0ItJMVcF14z0vIlsaw6TmsotQIpn6tzv+ttA9KxIKPVtUNFi
O5RTgTFQUq4NO0uUje6Wj1M6uRJRo9yHUted+wcCHoQ4k1xGg7jCMiw/8O7K3Diy
Kxz9Ve2G9wKBgQDbsPd4t3WEElCm/iLz+eY9TsFAZqkqfXvBZ6hM0RvocCpXP3G/
Jde2EUQRY/AV1xMkN6KcbosaCqVcBj01Rf7DcwIPU00KWN2MGe2FF2ZZUJjmP7Lb
/7JIAnoIqZ84afbifsCMngBWQTSoTMCkcWpVqab6uu3y9LJKxTZvmkCDCQKBgGNb
LNBceuOq+Sk92eFj7K0AuxJ0rqTFLZ5uvi7v2KGEA6gw5aErjG1XhziE2YXiIXMO
pk5MMPGe8tXpp2i3jpttCQKRjUiY1iA0LExX1TnBPJ+LcKfpzcL0qRQuEUBG7ij4
U91GFXqPak5kwFhfLK6t8JADv0Q8PMB//ENQ4ENJAoGAf8fdXSYwWEhdcQcxA3JV
MHDKSOblhapT52oXnNN6VW63ccv0mRD0gRQL5nOUQdGghvtFixBoasIMz0K2i8tH
kRz56CTLpLFop+gMz+j1PPL+hjRJOGpqoPjnHkWbvK6iGadTE4nT8iqGq4p11yuc
K+HDZxjTgVXEEbOuIpbAd/8=
-----END PRIVATE KEY-----当我明确声明在JWT中使用RS256作为algo时,导入键时的node-jose本身将推断出它的RSA类型:
{
"keys": [
{
"kty": "RSA",
"kid": "gxGP1sgIVSrKTUlfBKKqdKk97UQEhEDFSMRY2vstxQk",
"n": "zZIicc7d7hocYTs5RtWbOB0cdK59XGgHMq8xoiCty8Q-HsHFD6o3KPDjW6zEsYbqzGW22cmrFMg7OdoLr3hYRlWEM34DJiSyu-3gJBAesx3AD--rab-i2BbgzU3qfaVHPubUCMjQ2OYSnlDJMa4M3JE1ci6c3B9rbLoI1FE-AO2neG610df94arrAOdwzbnCOEr-wiUwBjHpzfEsIn2yMMb5TkRUPEL2AgXVvB2dU76Ac9xOr5O4MqTVL0TQFTKrkGqW-i0tFZJkoG5OXEmqKXL8p9jqvnMZ0oe4JYGXH3qKWfNI-GxZrGZytlAyZwBpvkQu0NUrzA4YW-xf9cfe3w",
"e": "AQAB"
}
]
}有人能解释一下这一切有什么意义吗?我的理解是,底层密钥类型必须与签名algo匹配。
更新:加密输出:
const keystore = require('./util/keystore')
const key = require('crypto').createPrivateKey(
{
key: keystore.getPrivateKey(),
format: 'pem',
encoding: 'utf8'
}
)
console.log(`key.asymmetricKeyType: ${key.asymmetricKeyType}`) // rsa
console.log(`key.asymmetricKeyDetails: ${key.asymmetricKeyDetails}`) // undefined发布于 2021-08-24 13:21:30
显然,问题不在于JWT / JWK依赖关系,而在于在密钥和X509生成过程中涉及的一系列openssl命令。
其中一个命令-- openssl req --错误地包含了param -keyout (而不是-key),它隐式地生成了一个RSA密钥,而没有提到其源中的密钥类型,并且重写了原始的EC密钥。
不幸的是,我找不到一个简单的openssl命令来验证键类型--在发布这个问题之前我尝试过这样做--但是我的一般建议是在密钥源文件中查找键类型。它看起来要么被显式声明,要么被隐式地假定为RSA。
https://stackoverflow.com/questions/68905819
复制相似问题