Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Repair EC x/y coordinates when importing JWK #585

Merged
merged 8 commits into from Jan 29, 2024

Conversation

julik
Copy link
Contributor

@julik julik commented Jan 28, 2024

Description

Some encoders on some platform omit a single 0-byte at the start of either Y or X coordinate of the elliptic curve point. This leads to an encoding error when data is passed to OpenSSL BN. It is known to have happened to exported JWKs on a Java application and on a Flutter/Dart application (both iOS and Android). All that is needed to fix the problem is adding a leading 0-byte. We know the required byte is 0 because with any other byte the point is no longer on the curve - and OpenSSL will actually communicate this via another exception. The indication of a stripped byte will be the fact that the coordinates - once decoded into bytes - should always be an even bytesize. For example, with a P-521 curve, both x and y must be 66 bytes. With a P-256 curve, both x and y must be 32 and so on. The simplest way to check for this truncation is thus to check whether the number of bytes is odd, and restore the leading 0-byte if it is.

Closes #412 and (by extension) #542

Checklist

Before the PR can be merged be sure the following are checked:

  • There are tests for the fix or feature added/changed
  • A description of the changes and a reference to the PR has been added to CHANGELOG.md. More details in the CONTRIBUTING.md

@julik julik changed the title Zero-prefix EC coordinates when needed Repair EC x/y coordinates when importing JWK Jan 28, 2024
lib/jwt/jwk/ec.rb Outdated Show resolved Hide resolved
CHANGELOG.md Outdated Show resolved Hide resolved
@anakinj
Copy link
Member

anakinj commented Jan 29, 2024

You can ignore the failure on ruby head. Thats the missing base64 dependency. Gonna merge #582 soonish to address that.

@julik julik requested a review from anakinj January 29, 2024 10:02
@anakinj
Copy link
Member

anakinj commented Jan 29, 2024

Really appreciated, thank you for your thorough investigations. I'll merge this even if the base64 dependency problem is making the CI unhappy.

@anakinj anakinj merged commit 9090e78 into jwt:main Jan 29, 2024
33 of 34 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

OpenSSL::PKey::EC::Point::Error: EC_POINT_bn2point: invalid encoding when importing a JWK
2 participants