Migrating from Java to Go

[servlette]

Hi,
I have a JWK key like the following:

json := `{
 "keys": [
   {
           "alg": "RS256",
           "d": "UjgqAa9D****",
           "e": "AQAB",
           "n": "lPZXYxEyZ***",
           "kty": "RSA",
           "kid": "myKey123"
   }
 ]
}
`

I am into migrating an app functionality from Java to Golang and I can't just go ahead and update the JWK JSON to include p in it or create a new JWK for Golang as the existing one has to work against both Java and Golang.

Even though the value p is missing in the JSON as shown above, it worked in Java as the 3rd party library Nimbus Jose returned an instance of RSAPrivateKey by using d and n.

Please refer to it here:

https://github.com/felx/nimbus-jose-jwt/blob/47d66f2775c392964788aa6389a46fac84f976cd/src/main/java/com/nimbusds/jose/jwk/RSAKey.java#L1790

When p is null, then it is using n and d to get the modulus and private exponent to initialize the RSAPrivateKey instance:

                BigInteger modulus = n.decodeToBigInteger();
		BigInteger privateExponent = d.decodeToBigInteger();		
		RSAPrivateKeySpec spec;
		if (p == null) {
			// Use 1st representation
			spec = new RSAPrivateKeySpec(modulus, privateExponent);

		}

              try {
			KeyFactory factory = KeyFactory.getInstance("RSA");

			return (RSAPrivateKey) factory.generatePrivate(spec);

		} catch (InvalidKeySpecException | NoSuchAlgorithmException e) {

			throw new JOSEException(e.getMessage(), e);
		}

Once it gets the RSA private key, then it is used to sign a JWT as shown below:

JWK key = getKeyById("myKey123"); //Custom code to get `JWK` from JSON.
		try {
			if (KeyType.RSA.equals(key.getKeyType())) {
				RSAPrivateKey privateKey = ((RSAKey) key).toRSAPrivateKey();
				RSASSASigner signer = new RSASSASigner(privateKey);
				JWSHeader.Builder headerBuilder = new JWSHeader.Builder(new JWSAlgorithm(key.getAlgorithm().getName()));
				headerBuilder.keyID(key.getKeyID());
				headerBuilder.build();
				JWSHeader header = headerBuilder.build();

				SignedJWT jwt = new SignedJWT(header, claims);

				jwt.sign(signer);
				return jwt.serialize();
			} 
		} catch (JOSEException e) {
			e.printStackTrace();
		}

As we are into migrating the existing functionality to sign a JWT to Golang, we are stuck with the following issue.

import (
	"github.com/lestrrat-go/jwx/jwk"
)

func main() {

      json := `{
 "keys": [
   {
           "alg": "RS256",
           "d": "UjgqAa9D****",
           "e": "AQAB",
           "n": "lPZXYxEyZ***",
           "kty": "RSA",
           "kid": "myKey123"
   }
 ]
}`
    	_, err := jwk.ParseString(json)
	if err != nil {
		panic(err)
	}
}

It panics with the following error:

panic: failed to unmarshal JWK set: failed to decode key #0 in "keys": failed to unmarshal JSON into key (*jwk.rsaPrivateKey): required field p is missing

In Java, I see the comment // Use 1st representation when p is null. I am not sure what it means to use 1st representation as it may be something to do with getting an RSA private key when the field p is not present.

Wondering if there is a way to get an RSA private key when p is missing using this go library.

[lestrrat]

@servlette Thanks for reporting. This sounds like a bug. Looking into it

[lestrrat]

@servlette please see #669

[servlette]

Thanks @lestrrat Let me look into it and get back to you soon.