JWK: support the registered secp256k1 curve name for EC keys
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
调研方向
Start with lib/jwt/jwk/ec.rb, especially to_openssl_curve and keypair_components, then read the existing EC JWK tests and the changelog conventions. Reproduce the reported import and export behavior for secp256k1; done means registered-name JWKS keys work through verification, verify_key, private?, and set export, with the intended export name and compatibility note covered.
由索引模型根据 Issue 内容生成。
描述
Problem
RFC 8812, section 3.1 registers the JWK crv value for the secp256k1 curve as "secp256k1". JWT::JWK::EC only recognises "P-256K", a name from earlier drafts, in lib/jwt/jwk/ec.rb:
to_openssl_curvemaps'P-256K'to'secp256k1'and raisesJWT::JWKError, 'Invalid curve provided'for anything else.keypair_componentsexports secp256k1 keys withcrv: 'P-256K'.
As a result, ES256K tokens can't be verified against a JWKS that uses the registered name, and keys exported by ruby-jwt aren't readable by implementations that only accept "secp256k1".
Reproduction (jwt 3.3.0)
key = OpenSSL::PKey::EC.generate("secp256k1")
jwk = JWT::JWK.new(key)
jwk.export[:crv] # => "P-256K"
token = JWT.encode({ sub: "1" }, key, "ES256K", kid: jwk.kid)
standard = jwk.export.merge(crv: "secp256k1")
JWT.decode(token, nil, true, algorithms: ["ES256K"], jwks: { keys: [standard] })
# => JWT::JWKError: Invalid curve provided
JWT.decode(token, nil, true, algorithms: ["ES256K"], jwks: { keys: [jwk.export] })
# => works with "P-256K"
This also shows up with real JWKS. The Connect2id demo JWKS publishes an EC key with crv: "secp256k1". Importing it works because the key is built lazily, but verify_key, private? and export raise, so JWT::JWK::Set#export fails for the whole set. Looking up other keys by kid isn't affected.
Suggested fix
- Accept both
"secp256k1"and"P-256K"into_openssl_curve. This is backwards compatible and could go into a patch release. - Export secp256k1 keys with
crv: "secp256k1". This changes exported JWKs and their thumbprints for existing secp256k1 keys, so it might fit better in a minor or major release, with a CHANGELOG note.
Posted by Claude on behalf of @anakinj.
- 主要语言
- Ruby
- 星标
- 3.7k
- 派生
- 381
- 平均合并
- 14 小时 13 分钟
- 30 天内合并 PR
- 13
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
jwt/ruby-jwt 的其他 Issue
-
难度 4/5 3-5 天 新手友好度 15/100
维护者通常 1 天内回复
-
难度 3/5 1-2 天 新手友好度 68/100
维护者通常 1 天内回复
-
难度 5/5 一周以上 新手友好度 25/100
维护者通常 1 天内回复
-
feature
难度 5/5 一周以上 新手友好度 35/100
jwt/ruby-jwt#428 · 7 条评论 · 1 个 reaction ·
维护者通常 1 天内回复
-
enhancement feature help wanted up for grabs
难度 5/5 一周以上 新手友好度 25/100
jwt/ruby-jwt#80 · 11 条评论 · 8 个 reaction ·
维护者通常 1 天内回复
相似的 Issue
-
bug javascript
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 88/100
yegor256/netbout.rb#69 ·
-
难度 2/5 1-3 小时 新手友好度 84/100
yegor256/iccq.github.io#161 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
palladius/rails8-app-on-gcp#198 ·
-
bug
难度 1/5 1 小时以内 新手友好度 95/100
WikiEducationFoundation/WikiEduDashboard#7258 ·
维护者通常 1 天内回复