Problem while verifying the token and PubKey

[engharb]

I have the following problem "It was not possible to parse your key, reason: error:0906D06C:PEM routines:PEM_read_bio:no start line".
Here is my code:
$signer = new Sha256();
dump($token->verify($signer, $pubKey));

I have updated openssl in VM which hosts my Web-services, but I still get the same error.

My key alg is RS256 but when I use aws.cognito idToken to generate PubKey, the resulted PubKey is 384 length not 256. Does that make sense?

I used https://npm.runkit.com/jwk-to-pem, and it verifies correctly my token with generated pub_key, but not with lcobucci/jwt.

I need your help.

Regards,

[lcobucci]

@engharb that's weird, can you send that pub key (both jwk and pem)?

[lcobucci]

It would be awesome to know your PHP and OpenSSL versions =)

[lcobucci]

Ahh another thing 😄 would be good to have a token issued with that key as well =)

[engharb]

@lcobucci Thank you for replaying.
PHP 7
openssl (on VM): OpenSSL 1.1.0g (newest v)

keys
alg	"RS256"
e	"AAAA"
kid	"BBVBBBLD/5oNT23mYB1BBtBfBgB++BgBB+BBBbbbbbB="
kty	"RSA"
n	"a long test"
use	"sig"

I used that key to generate the public key (by the way is it possible to generate pubKey from JWK in PHP?).

[lcobucci]

I used that key to generate the public key (by the way is it possible to generate pubKey from JWK in PHP?).

@engharb we do have libraries that do that, I didn't get to implement it in this yet (#32)

[engharb]

@lcobucci this means there is no way to convert JWK to PEM (PubKey) using i.e PHP API.!

[lcobucci]

I've converted that JWK using spomky-labs/jose and this is the PEM I get back:

-----BEGIN PUBLIC KEY-----
MB8wDQYJKoZIhvcNAQEBBQADDgAwCwIGalongtesAgEA
-----END PUBLIC KEY-----

And everything seems to work regarding OpenSSL integration with that content:

$key = openssl_get_publickey('-----BEGIN PUBLIC KEY-----
MB8wDQYJKoZIhvcNAQEBBQADDgAwCwIGalongtesAgEA
-----END PUBLIC KEY-----');
$details = openssl_pkey_get_details($key);

var_dump($details, $details['type'] === \OPENSSL_KEYTYPE_RSA);

/*
Outputs:

array(4) {
  ["bits"]=>
  int(47)
  ["key"]=>
  string(97) "-----BEGIN PUBLIC KEY-----
MB8wDQYJKoZIhvcNAQEBBQADDgAwCwIGalongtesAgEA
-----END PUBLIC KEY-----
"
  ["rsa"]=>
  array(2) {
    ["n"]=>
    string(6) "jZ'?׬"
    ["e"]=>
    string(0) ""
  }
  ["type"]=>
  int(0)
}
bool(true)
*/

[lcobucci]

@lcobucci this means there is no way to convert JWK to PEM (PubKey) using i.e PHP API.!

@engharb you mean using bare openssl or extensions?

[lcobucci]

You can also see that converting the JWK using that node lib outputs a different pem:

-----BEGIN RSA PUBLIC KEY-----
MAsCBmpaJ4LXrAIBAA==
-----END RSA PUBLIC KEY-----

instead of:

-----BEGIN PUBLIC KEY-----
MB8wDQYJKoZIhvcNAQEBBQADDgAwCwIGalongtesAgEA
-----END PUBLIC KEY-----

[engharb]

@lcobucci I am sorry for redundantly asking simple questions but I still struggling with this new theme for me (very kind of you).

Yes I have used jwk-to-pem lib and I got such resulted key

-----BEGIN RSA PUBLIC KEY-----
MAsCBmpaJ4LXrAIBAAASDSSDFD
-----END RSA PUBLIC KEY-----

But I need a generating such key from PHP server side (i.e PHP library).

[lcobucci]

You can use that lib I linked till I get all my stuff sorted out and implement this here 😂

This is the script I used:

equire 'vendor/autoload.php';

use Jose\KeyConverter\RSAKey;

$key = new RSAKey(
    [
        'alg'=> 'RS256',
        'kid'=> 'BBVBBBLD/5oNT23mYB1BBtBfBgB++BgBB+BBBbbbbbB=',
        'kty'=> 'RSA',
        'use'=> 'sig',
        'e'=> 'AAAA',
        'n'=> 'a long test',
    ]
);

echo (string) $key; // this is the PEM

Of course that I completely understand if you switch completely to spomky-labs/jose which is a quite nice JWT implementation and has support for JWK. That's what you get when you have way too many projects to maintain 💔

[engharb]

@lcobucci Thank you a lot that what I was looking for.

[engharb]

@lcobucci I have one more question. after verifying the Signature process is succeeded I want to i.e unhash/decode the signature in order to be able to read the encoded data(data) from it. From there I will be sure that the data is from the authentic server side (reading that from payload means may I read modified data by a hacker or untrusted third-party), Do you have any Idea?

regards,