Allow PKCS8 encoded EC private keys (#3288)

Fixes #3283

Signed-off-by: Andre Håland <andre.haland@gmail.com>

bundle/keys_test.go

@@ -5,6 +5,7 @@
 package bundle
 
 import (
+	"crypto/ecdsa"
 	"crypto/rsa"
 	"fmt"
 	"path/filepath"
@@ -191,11 +192,25 @@ HdZaQEvVwuOfmykc6fRJg3TTW2FyTZkr89Pt7gkffwKBgHGeJkFc6LFeHIwa3SbS
 qAVebnCAfNo9hHxz3xYA0PaCF3Kr1X9z4X2tF2Za7nWfVbfWViAncLrJgjnHRdrs
 f10hbJEuLFhD1c2dNjwqflANV5OanG1syqYqil5TgWm1AaRFj+PbRPk0FRfF9y+e
 tKaHBn4eyNlKjQaEn16ZxKJm
+-----END PRIVATE KEY-----`
+
+	pkcs1ecPrivateKey := `-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEINMW3Ro+oSlbPebDGzeu9w4Eug5ZS/TdjnfnqBP0tMVaoAoGCCqGSM49
+AwEHoUQDQgAEkla2v5uQDXr/WoXdCyD3OfAn21K+suzymtp9qAWqRTXWK0a09/cW
+Go/Uf1QsCMvmJJ5n9QZb15mhdReiCy4bNw==
+-----END EC PRIVATE KEY-----`
+
+	pkcs8ecPrivateKey := `-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgZAUy0S0Dow25efPX
+SXNNy1EFGSxFEjEQMWSo5/PoL16hRANCAAS1MkJ0tCo++7BktJcmXusp55WyB6n1
+qnby6ICFV1o3cV2WFc5PVToBVoPEyUZQ7KFz/3znYQ44fbclemgU/5mf
 -----END PRIVATE KEY-----`
 
 	files := map[string]string{
 		"private.pem": privateKey,
 		"pkcs8.pem":   pkcs8privateKey,
+		"pkcs1ec.pem": pkcs1ecPrivateKey,
+		"pkcs8ec.pem": pkcs8ecPrivateKey,
 	}
 
 	test.WithTempFS(files, func(rootDir string) {
@@ -224,6 +239,28 @@ tKaHBn4eyNlKjQaEn16ZxKJm
 			t.Fatalf("Expected key type *rsa.PrivateKey but got %T", result)
 		}
 
+		sc = NewSigningConfig(filepath.Join(rootDir, "pkcs1ec.pem"), "ES256", "")
+		result, err = sc.GetPrivateKey()
+		if err != nil {
+			t.Fatalf("Unexpected error %v", err)
+		}
+
+		_, ok = result.(*ecdsa.PrivateKey)
+		if !ok {
+			t.Fatalf("Expected key type *ecdsa.PrivateKey but got %T", result)
+		}
+
+		sc = NewSigningConfig(filepath.Join(rootDir, "pkcs8ec.pem"), "ES256", "")
+		result, err = sc.GetPrivateKey()
+		if err != nil {
+			t.Fatalf("Unexpected error %v", err)
+		}
+
+		_, ok = result.(*ecdsa.PrivateKey)
+		if !ok {
+			t.Fatalf("Expected key type *ecdsa.PrivateKey but got %T", result)
+		}
+
 		// key file does not exist, check that error generated with RS56 as the signing algorithm
 		sc = NewSigningConfig("private.pem", "", "")
 		_, err = sc.GetPrivateKey()

internal/jwx/jws/sign/sign.go

@@ -52,7 +52,11 @@ func GetSigningKey(key string, alg jwa.SignatureAlgorithm) (interface{}, error)
 
 		priv, err := x509.ParseECPrivateKey(block.Bytes)
 		if err != nil {
-			return nil, err
+			pkcs8priv, err2 := x509.ParsePKCS8PrivateKey(block.Bytes)
+			if err2 != nil {
+				return nil, fmt.Errorf("error parsing private key (%v), (%v)", err, err2)
+			}
+			return pkcs8priv, nil
 		}
 		return priv, nil
 	case jwa.HS256, jwa.HS384, jwa.HS512: