Error: "alg" parameter "ES256" requires curve "prime256v1"
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Documentation
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- javascript, node.js
- Domain
- cryptography, security
Research direction
Start with the Changelog, Migration guide, and the source code for the validation that rejects the ES256 curve. Investigate the implications of using secp256k1 instead of prime256v1 and determine what guidance is missing. Done means the project documentation clearly explains the curve requirement, the security implications, and when bypassing the check is appropriate.
Written by the indexing model from the issue text.
Description
Not a bug report, but a question.
My code started to fail with version 9 because of this error.
I've read the Changelog, Migration guide and source code that does this validation and see where it comes from.
I also can see that I can bypass this check with allowInvalidAsymmetricKeyTypes.
What I cannot find information about is what is the implication that I have used "wrong curve" when generating the keys?
In particular, I have used this command before: openssl ecparam -name secp256k1 -genkey -noout -out key.pem.
"Correct" command with the "correct" curve looks like this: openssl ecparam -name prime256v1 -genkey -noout -out key.pem.
Are my tokens vulnerable to some attack or something, because I have used the "wrong curve" when generating the keys?
- Dominant language
- JavaScript
- Stars
- 18.2k
- Forks
- 1.3k
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from auth0/node-jsonwebtoken
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
auth0/node-jsonwebtoken#1042 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
auth0/node-jsonwebtoken#1000 · 2 comments · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 65/100
auth0/node-jsonwebtoken#1046 ·
-
Difficulty 5/5 Over a week Newbie friendliness 10/100
auth0/node-jsonwebtoken#1034 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
auth0/node-jsonwebtoken#1032 ·
All issues in auth0/node-jsonwebtoken
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
antfu-collective/icones#398 ·
-
ECmail.com Open
Difficulty 1/5 Under an hour Newbie friendliness 90/100
wesbos/burner-email-providers#554 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
radiantearth/stac-browser#1023 ·
-
HMR stops working Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
components-web-app/docs#92 ·