diff --git a/bundle/keys_test.go b/bundle/keys_test.go index b24cbbc52c..2b830b7361 100644 --- a/bundle/keys_test.go +++ b/bundle/keys_test.go @@ -5,6 +5,7 @@ package bundle import ( + "crypto/ecdsa" "crypto/rsa" "fmt" "path/filepath" @@ -191,11 +192,25 @@ HdZaQEvVwuOfmykc6fRJg3TTW2FyTZkr89Pt7gkffwKBgHGeJkFc6LFeHIwa3SbS qAVebnCAfNo9hHxz3xYA0PaCF3Kr1X9z4X2tF2Za7nWfVbfWViAncLrJgjnHRdrs f10hbJEuLFhD1c2dNjwqflANV5OanG1syqYqil5TgWm1AaRFj+PbRPk0FRfF9y+e tKaHBn4eyNlKjQaEn16ZxKJm +-----END PRIVATE KEY-----` + + pkcs1ecPrivateKey := `-----BEGIN EC PRIVATE KEY----- +MHcCAQEEINMW3Ro+oSlbPebDGzeu9w4Eug5ZS/TdjnfnqBP0tMVaoAoGCCqGSM49 +AwEHoUQDQgAEkla2v5uQDXr/WoXdCyD3OfAn21K+suzymtp9qAWqRTXWK0a09/cW +Go/Uf1QsCMvmJJ5n9QZb15mhdReiCy4bNw== +-----END EC PRIVATE KEY-----` + + pkcs8ecPrivateKey := `-----BEGIN PRIVATE KEY----- +MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgZAUy0S0Dow25efPX +SXNNy1EFGSxFEjEQMWSo5/PoL16hRANCAAS1MkJ0tCo++7BktJcmXusp55WyB6n1 +qnby6ICFV1o3cV2WFc5PVToBVoPEyUZQ7KFz/3znYQ44fbclemgU/5mf -----END PRIVATE KEY-----` files := map[string]string{ "private.pem": privateKey, "pkcs8.pem": pkcs8privateKey, + "pkcs1ec.pem": pkcs1ecPrivateKey, + "pkcs8ec.pem": pkcs8ecPrivateKey, } test.WithTempFS(files, func(rootDir string) { @@ -224,6 +239,28 @@ tKaHBn4eyNlKjQaEn16ZxKJm t.Fatalf("Expected key type *rsa.PrivateKey but got %T", result) } + sc = NewSigningConfig(filepath.Join(rootDir, "pkcs1ec.pem"), "ES256", "") + result, err = sc.GetPrivateKey() + if err != nil { + t.Fatalf("Unexpected error %v", err) + } + + _, ok = result.(*ecdsa.PrivateKey) + if !ok { + t.Fatalf("Expected key type *ecdsa.PrivateKey but got %T", result) + } + + sc = NewSigningConfig(filepath.Join(rootDir, "pkcs8ec.pem"), "ES256", "") + result, err = sc.GetPrivateKey() + if err != nil { + t.Fatalf("Unexpected error %v", err) + } + + _, ok = result.(*ecdsa.PrivateKey) + if !ok { + t.Fatalf("Expected key type *ecdsa.PrivateKey but got %T", result) + } + // key file does not exist, check that error generated with RS56 as the signing algorithm sc = NewSigningConfig("private.pem", "", "") _, err = sc.GetPrivateKey() diff --git a/internal/jwx/jws/sign/sign.go b/internal/jwx/jws/sign/sign.go index 5b834c7582..ec88060681 100644 --- a/internal/jwx/jws/sign/sign.go +++ b/internal/jwx/jws/sign/sign.go @@ -52,7 +52,11 @@ func GetSigningKey(key string, alg jwa.SignatureAlgorithm) (interface{}, error) priv, err := x509.ParseECPrivateKey(block.Bytes) if err != nil { - return nil, err + pkcs8priv, err2 := x509.ParsePKCS8PrivateKey(block.Bytes) + if err2 != nil { + return nil, fmt.Errorf("error parsing private key (%v), (%v)", err, err2) + } + return pkcs8priv, nil } return priv, nil case jwa.HS256, jwa.HS384, jwa.HS512: