python-jose icon indicating copy to clipboard operation
python-jose copied to clipboard

jwk.construct() does not support reading a private RSA key

Open michou opened this issue 7 years ago • 6 comments

Attempting to sign a JWT token with a private RSA key throws:

JWKError: Private key not available in this object

The problem seems to come from RSAKey._process_jwk() in jwk.py:

def _process_jwk(self, jwk_dict):
    if not jwk_dict.get('kty') == 'RSA':
        raise JWKError("Incorrect key type.  Expected: 'RSA', Recieved: %s" % jwk_dict.get('kty'))

    e = base64_to_long(jwk_dict.get('e', 256))
    n = base64_to_long(jwk_dict.get('n'))

    self.prepared_key = RSA.construct((n, e))
    return self.prepared_key

Note that the d, p, q fields in the JWK representation are ignored, but given the description in RSA.py (from pycrypto), these are the very values that are needed to construct a private key.

michou avatar May 02 '17 23:05 michou

I guess I could try to construct my own RSAKey and try to pass this as a key data, but it really takes away a lot of the convenience of using python-jose in the first place 😿

michou avatar May 02 '17 23:05 michou

Currently python-jose only parses public keys via jwk spec, eg. by passing in a dictionary. You should pass in PEM string and a private key will be constructed.

zejn avatar May 03 '17 08:05 zejn

Yeah, but when I have the key set already in JWK format, it requires a lot of jumping through hoops to get the PEM string. It was easier in my case to just construct a new RSAKey based on the full tuple (n, e, d, p, q)

michou avatar May 03 '17 10:05 michou

I could try whipping up a quick PR if this is something that you think python-jose should be doing

michou avatar May 03 '17 10:05 michou

I definitely think that python-jose should be able to handle private keys in the JWK format, that work just hasn't been an issue up to this point.

I would welcome a PR that included that work.

mpdavis avatar May 03 '17 14:05 mpdavis

+1 this feature, running into this issue as well @mpdavis

ckong316 avatar May 16 '17 15:05 ckong316