Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

jwk.construct() does not support reading a private RSA key #50

Open
michou opened this issue May 2, 2017 · 6 comments
Open

jwk.construct() does not support reading a private RSA key #50

michou opened this issue May 2, 2017 · 6 comments

Comments

@michou
Copy link

michou commented May 2, 2017

Attempting to sign a JWT token with a private RSA key throws:

JWKError: Private key not available in this object

The problem seems to come from RSAKey._process_jwk() in jwk.py:

def _process_jwk(self, jwk_dict):
    if not jwk_dict.get('kty') == 'RSA':
        raise JWKError("Incorrect key type.  Expected: 'RSA', Recieved: %s" % jwk_dict.get('kty'))

    e = base64_to_long(jwk_dict.get('e', 256))
    n = base64_to_long(jwk_dict.get('n'))

    self.prepared_key = RSA.construct((n, e))
    return self.prepared_key

Note that the d, p, q fields in the JWK representation are ignored, but given the description in RSA.py (from pycrypto), these are the very values that are needed to construct a private key.

@michou
Copy link
Author

michou commented May 2, 2017

I guess I could try to construct my own RSAKey and try to pass this as a key data, but it really takes away a lot of the convenience of using python-jose in the first place 😿

@zejn
Copy link
Collaborator

zejn commented May 3, 2017

Currently python-jose only parses public keys via jwk spec, eg. by passing in a dictionary. You should pass in PEM string and a private key will be constructed.

@michou
Copy link
Author

michou commented May 3, 2017

Yeah, but when I have the key set already in JWK format, it requires a lot of jumping through hoops to get the PEM string. It was easier in my case to just construct a new RSAKey based on the full tuple (n, e, d, p, q)

@michou
Copy link
Author

michou commented May 3, 2017

I could try whipping up a quick PR if this is something that you think python-jose should be doing

@mpdavis
Copy link
Owner

mpdavis commented May 3, 2017

I definitely think that python-jose should be able to handle private keys in the JWK format, that work just hasn't been an issue up to this point.

I would welcome a PR that included that work.

@ckong316
Copy link

+1 this feature, running into this issue as well @mpdavis

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants