Add ECDsa support in X509SecurityKey and JsonWebKeyConverter.ConvertFromX509SecurityKey

src/Microsoft.IdentityModel.Tokens/JsonWebKeyConverter.cs

@@ -34,7 +34,7 @@ public static JsonWebKey ConvertFromSecurityKey(SecurityKey key)
                 return ConvertFromSymmetricSecurityKey(symmetricKey);
             else if (key is X509SecurityKey x509Key)
                 return ConvertFromX509SecurityKey(x509Key);
-#if NET472 || NETSTANDARD2_0 || NET6_0_OR_GREATER
+#if NET472_OR_GREATER || NETSTANDARD2_0 || NET
             else if (key is ECDsaSecurityKey ecdsaSecurityKey)
                 return ConvertFromECDsaSecurityKey(ecdsaSecurityKey);
 #endif
@@ -97,9 +97,16 @@ public static JsonWebKey ConvertFromX509SecurityKey(X509SecurityKey key)
             if (key == null)
                 throw LogHelper.LogArgumentNullException(nameof(key));
 
+            var kty = key.PublicKey switch
+            {
+                RSA => JsonWebAlgorithmsKeyTypes.RSA,
+                ECDsa => JsonWebAlgorithmsKeyTypes.EllipticCurve,
+                _ => throw LogHelper.LogExceptionMessage(new NotSupportedException(LogHelper.FormatInvariant(LogMessages.IDX10674, LogHelper.MarkAsNonPII(key.GetType().FullName))))
+            };
+
             var jsonWebKey = new JsonWebKey
             {
-                Kty = JsonWebAlgorithmsKeyTypes.RSA,
+                Kty = kty,
                 Kid = key.KeyId,
                 X5t = key.X5t,
                 ConvertedSecurityKey = key
@@ -116,26 +123,44 @@ public static JsonWebKey ConvertFromX509SecurityKey(X509SecurityKey key)
         /// </summary>
         /// <param name="key">a <see cref="X509SecurityKey"/> to convert.</param>
         /// <param name="representAsRsaKey">
-        /// <c>true</c> to represent the <paramref name="key"/> as an <see cref="RsaSecurityKey"/>, 
+        /// <c>true</c> to represent the <paramref name="key"/> as an <see cref="RsaSecurityKey"/>,
         /// <c>false</c> to represent the <paramref name="key"/> as an <see cref="X509SecurityKey"/>, using the "x5c" parameter.
         /// </param>
         /// <returns>a <see cref="JsonWebKey"/>.</returns>
         /// <exception cref="ArgumentNullException">if <paramref name="key"/>is null.</exception>
         public static JsonWebKey ConvertFromX509SecurityKey(X509SecurityKey key, bool representAsRsaKey)
         {
-            if (!representAsRsaKey)
-                return ConvertFromX509SecurityKey(key);
-
             if (key == null)
                 throw LogHelper.LogArgumentNullException(nameof(key));
 
-            RSA rsaKey;
+            if (!representAsRsaKey)
+                return ConvertFromX509SecurityKey(key);
+
             if (key.PrivateKeyStatus == PrivateKeyStatus.Exists)
-                rsaKey = key.PrivateKey as RSA;
-            else
-                rsaKey = key.PublicKey as RSA;
+            {
+                if (key.PrivateKey is RSA rsaPrivateKey)
+                {
+                    return ConvertFromRSASecurityKey(new RsaSecurityKey(rsaPrivateKey) { KeyId = key.KeyId });
+                }
+#if NET472_OR_GREATER || NETSTANDARD2_0 || NET
+                else if (key.PrivateKey is ECDsa ecdsaPrivateKey)
+                {
+                    return ConvertFromECDsaSecurityKey(new ECDsaSecurityKey(ecdsaPrivateKey) { KeyId = key.KeyId });
+                }
+#endif
+            }
+            else if (key.PublicKey is RSA rsaPublicKey)
+            {
+                return ConvertFromRSASecurityKey(new RsaSecurityKey(rsaPublicKey) { KeyId = key.KeyId });
+            }
+#if NET472_OR_GREATER || NETSTANDARD2_0 || NET
+            else if (key.PublicKey is ECDsa ecdsaPublicKey)
+            {
+                return ConvertFromECDsaSecurityKey(new ECDsaSecurityKey(ecdsaPublicKey) { KeyId = key.KeyId });
+            }
+#endif
 
-            return ConvertFromRSASecurityKey(new RsaSecurityKey(rsaKey) { KeyId = key.KeyId });
+            throw LogHelper.LogExceptionMessage(new NotSupportedException(LogHelper.FormatInvariant(LogMessages.IDX10674, LogHelper.MarkAsNonPII(key.GetType().FullName))));
         }
 
         /// <summary>
@@ -158,7 +183,7 @@ public static JsonWebKey ConvertFromSymmetricSecurityKey(SymmetricSecurityKey ke
             };
         }
 
-#if NET472 || NETSTANDARD2_0 || NET6_0_OR_GREATER
+#if NET472_OR_GREATER || NETSTANDARD2_0 || NET
         /// <summary>
         /// Converts a <see cref="ECDsaSecurityKey"/> into a <see cref="JsonWebKey"/>
         /// </summary>
@@ -167,15 +192,15 @@ public static JsonWebKey ConvertFromSymmetricSecurityKey(SymmetricSecurityKey ke
         /// <exception cref="ArgumentNullException">if <paramref name="key"/>is null.</exception>
         public static JsonWebKey ConvertFromECDsaSecurityKey(ECDsaSecurityKey key)
         {
-            if (!ECDsaAdapter.SupportsECParameters())
-                throw LogHelper.LogExceptionMessage(new PlatformNotSupportedException(LogMessages.IDX10695));
-
             if (key == null)
                 throw LogHelper.LogArgumentNullException(nameof(key));
 
             if (key.ECDsa == null)
                 throw LogHelper.LogArgumentNullException(nameof(key.ECDsa));
 
+            if (!ECDsaAdapter.SupportsECParameters())
+                throw LogHelper.LogExceptionMessage(new PlatformNotSupportedException(LogMessages.IDX10695));
+
             ECParameters parameters;
             try
             {

src/Microsoft.IdentityModel.Tokens/X509SecurityKey.cs

@@ -16,8 +16,15 @@ namespace Microsoft.IdentityModel.Tokens
     /// </summary>
     public class X509SecurityKey : AsymmetricSecurityKey
     {
+        // OID for RSA encryption
+        // <see href="https://www.ietf.org/rfc/rfc3447"/> and <see href="https://www.ietf.org/rfc/rfc5698"/>
+        const string RSAOid = "1.2.840.113549.1.1.1";
+
+        // OID for ECDSA
+        // <see href="https://datatracker.ietf.org/doc/html/rfc3279#section-2.3.5"/> and <see href="https://datatracker.ietf.org/doc/html/rfc5480"/>
+        const string ECDsaOid = "1.2.840.10045.2.1";
+
         AsymmetricAlgorithm _privateKey;
-        bool _privateKeyAvailabilityDetermined;
         AsymmetricAlgorithm _publicKey;
 #if NET9_0_OR_GREATER
         Lock _thisLock = new();
@@ -48,7 +55,7 @@ public X509SecurityKey(X509Certificate2 certificate)
         /// Instantiates a <see cref="X509SecurityKey"/> using a <see cref="X509Certificate2"/>.
         /// </summary>
         /// <param name="certificate">The <see cref="X509Certificate2"/> to use.</param>
-        /// <param name="keyId">The value to set for the KeyId</param>
+        /// <param name="keyId">The value to set for the KeyId.</param>
         /// <exception cref="ArgumentNullException">if <paramref name="certificate"/> is null.</exception>
         /// <exception cref="ArgumentNullException">if <paramref name="keyId"/> is null or empty.</exception>
         public X509SecurityKey(X509Certificate2 certificate, string keyId)
@@ -78,15 +85,25 @@ public AsymmetricAlgorithm PrivateKey
         {
             get
             {
-                if (!_privateKeyAvailabilityDetermined)
+                if (_privateKey == null)
                 {
                     lock (ThisLock)
                     {
-                        if (!_privateKeyAvailabilityDetermined)
+                        if (_privateKey == null)
                         {
-                            _privateKey = RSACertificateExtensions.GetRSAPrivateKey(Certificate);
-
-                            _privateKeyAvailabilityDetermined = true;
+                            switch (Certificate.PublicKey.Oid.Value)
+                            {
+                                case RSAOid:
+                                    {
+                                        _privateKey = Certificate.GetRSAPrivateKey();
+                                        break;
+                                    }
+                                case ECDsaOid:
+                                    {
+                                        _privateKey = Certificate.GetECDsaPrivateKey();
+                                        break;
+                                    }
+                            }
                         }
                     }
                 }
@@ -108,7 +125,19 @@ public AsymmetricAlgorithm PublicKey
                     {
                         if (_publicKey == null)
                         {
-                            _publicKey = RSACertificateExtensions.GetRSAPublicKey(Certificate);
+                            switch (Certificate.PublicKey.Oid.Value)
+                            {
+                                case RSAOid:
+                                    {
+                                        _publicKey = Certificate.GetRSAPublicKey();
+                                        break;
+                                    }
+                                case ECDsaOid:
+                                    {
+                                        _publicKey = Certificate.GetECDsaPublicKey();
+                                        break;
+                                    }
+                            }
                         }
                     }
                 }
@@ -128,10 +157,10 @@ object ThisLock
         /// Gets a bool indicating if a private key exists.
         /// </summary>
         /// <return>true if it has a private key; otherwise, false.</return>
-        [System.Obsolete("HasPrivateKey method is deprecated, please use PrivateKeyStatus.")]
+        [Obsolete("HasPrivateKey method is deprecated, please use PrivateKeyStatus.")]
         public override bool HasPrivateKey
         {
-            get { return (PrivateKey != null); }
+            get { return PrivateKey != null; }
         }
 
         /// <summary>
@@ -161,20 +190,20 @@ public X509Certificate2 Certificate
         /// Determines whether the <see cref="X509SecurityKey"/> can compute a JWK thumbprint.
         /// </summary>
         /// <returns><c>true</c> if JWK thumbprint can be computed; otherwise, <c>false</c>.</returns>
-        /// <remarks>https://datatracker.ietf.org/doc/html/rfc7638</remarks>
+        /// <remarks>See: <see href="https://datatracker.ietf.org/doc/html/rfc7638"/></remarks>
         public override bool CanComputeJwkThumbprint()
         {
-            return (PublicKey as RSA) != null ? true : false;
+            return PublicKey is RSA || PublicKey is ECDsa;
         }
 
         /// <summary>
         /// Computes a sha256 hash over the <see cref="X509SecurityKey"/>.
         /// </summary>
         /// <returns>A JWK thumbprint.</returns>
-        /// <remarks>https://datatracker.ietf.org/doc/html/rfc7638</remarks>
+        /// <remarks>See: <see href="https://datatracker.ietf.org/doc/html/rfc7638"/></remarks>
         public override byte[] ComputeJwkThumbprint()
         {
-            return new RsaSecurityKey(PublicKey as RSA).ComputeJwkThumbprint();
+            return PublicKey is RSA ? new RsaSecurityKey(PublicKey as RSA).ComputeJwkThumbprint() : new ECDsaSecurityKey(PublicKey as ECDsa).ComputeJwkThumbprint();
         }
 
         /// <summary>