Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

jwk.construct() Unable to parse an RSA_JWK from _RSAPrivateKey object #282

Open
DataGhost opened this issue Nov 24, 2021 · 0 comments · May be fixed by #295
Open

jwk.construct() Unable to parse an RSA_JWK from _RSAPrivateKey object #282

DataGhost opened this issue Nov 24, 2021 · 0 comments · May be fixed by #295

Comments

@DataGhost
Copy link

This is probably related to #50 but I'm not using a dict to construct my JWK, rather an instantiated private key. Also looking at the code I get the idea that #50 has been fixed long ago.

I cannot call jwk.construct with an already-instantiated private key (_RSAPrivateKey object). The error thrown is:
jose.exceptions.JWKError: Unable to parse an RSA_JWK from key: <cryptography.hazmat.backends.openssl.rsa._RSAPrivateKey object at 0x7f6c480a4e20>
I've loaded it using cryptography.hazmat.primitives.serialization.load_pem_private_key. The current constructor in python-jose seems to check for public keys only, which are directly assigned into self.prepared_key. My current workaround is serializing the _RSAPrivateKey object back into PEM/pkcs8 and calling jwk.construct on the resulting string, after which it does a call to load_pem_private_key anyway

self.prepared_key = load_pem_private_key(key, password=None, backend=self.cryptography_backend())
to get an identical result, the resulting jwkinstance.prepared_key is again an _RSAPrivateKey object. To me it seems an easy fix, just assign it similarly to:
if hasattr(key, "public_bytes") and hasattr(key, "public_numbers"):
self.prepared_key = key
return

after checking that it conforms to the private key interface.

My use case is having an encrypted private key so I need to decrypt it before constructing the JWK, as there is no way for me to pass the password into the constructor and letting it handle that. Reserialization seems like an unnecessary extra step.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant