random verification failure when using ECDSA with secp521r1 about jwt-cpp HOT 5 CLOSED

Please take a look at the above bugfix.
It should fix your issue.
Turns out the padding of ecdsa signatures was wrong all along and no one noticed.
It only happened randomly as an ECDSA signature is not identical every time you generate it.
So the bug was not in verification but instead in generating.

from jwt-cpp.

Thanks for the quick fix.
The case I provided works now as long as I use the correct algorithm (jwt::algorithm::es512).

A few comments:
#1 After the fix, the correct algorithm must to be called depending on the type of key passed by argument. Unless is can be addressed, There is now a case to be more specific in the arguments documentation.
In jwt.h:
* \param public_key ECDSA public key in PEM format
* \param private_key ECDSA private key or empty string if not available. If empty, signing will always fail.

"ECDSA with P-256 (or P-384 or, P-521)" (after https://tools.ietf.org/html/rfc7518#section-3.1)

Currently, using es256 with a P-521 key will result in an exception. It is possible to use es512 with a P-256 key ?

#2 In TokenTest.cpp, it may be worth testing jwt::algorithm::es512. Additionally, you could test that using es256 with a P-521 key result in an exception.

#3 Out of curiosity, it is there an explanation of the padding algorithm you are using somewhere ? It is somewhat puzzling that OpenSSL does not provide a function for this.

from jwt-cpp.

@adesitter Regarding 1: It was never a feature that es256 worked with a 512bit key, just a coincident. In fact it probably was pure luck if the tokens were standard compliant.
No you can not (should not) use es512 with a 256 bit key.

Regarding 2: Yes testcases will come once I have time to write some. After they are done I will also add a new release.

Regarding 3: JWS uses a fixed signature length for ecdsa which consists of concatenating r and s of the signature. Therefore each of them needs to be half the size of that length. I basically prepend zeros until the size matches. Not sure why OpenSSL does not provide it, might do in the future but they also might ignore it as its really simple to implement and I could not find any other applications of this specific method.

from jwt-cpp.

Thanks.
std::logic_error("bignum size exceeded expected length") could be replaced by std::invalid_argument("Incorrect key type").

from jwt-cpp.

I mean, you basically discussed this here already. I just added some details in #53 before crawling through the entire thread here :)

from jwt-cpp.