问题
I have JWT as
var signedJwt = "eyJhbGciOiJFUzI1NiIsImtpZCI6IjZjNTUxNmUxLTkyZGMtNDc5ZS1hOGZmLTVhNTE5OTJlMDAwMSIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE1OTY3MzA4ODMsInJlcXVlc3RfYm9keV9zaGEyNTYiOiI4NDMyODhkMWMxYmM0NzhlMTBhOTM2NWQ1YjIzY2U5ZWZlY2E2ZjdkYjA3NDQ3Y2JmNjU4YTg3ZjEzZjI1ZjJmIn0.3yQY6gtNq0lQlx6eNLO_3coGqf2VkX2CBRWam9Lz0dcVvr8h4LkYfuZMwQf1fzZ_XXHEV_o17LciyBC-O72UUw"
then I got a public key as:
{
"alg": "ES256",
"created_at": 1560466143,
"crv": "P-256",
"expired_at": null,
"kid": "6c5516e1-92dc-479e-a8ff-5a51992e0001",
"kty": "EC",
"use": "sig",
"x": "35lvC8uz2QrWpQJ3TUH8t9o9DURMp7ydU518RKDl20k",
"y": "I8BuXB2bvxelzJAd7OKhd-ZwjCst05Fx47Mb_0ugros"
}
I am trying to decode with Jose library in C#
var claims = Jose.JWT.Decode(signedJwt, publicKey, JwsAlgorithm.ES256);
Everytime I get an error:
EcdsaUsingSha algorithm expects key to be of either CngKey or ECDsa types.
I assume the way I am using key is not correct, but I could not find any way to convert json key to pem or anything valid.
回答1:
You can create a key of type EccKey from the JWK like this:
using Jose;
using Microsoft.AspNetCore.WebUtilities;
using Security.Cryptography;
using System;
using System.Text.Json;
namespace josejwttest
{
public class JWK
{
public string alg { get; set; }
public int? created_at { get; set; }
public string crv { get; set; }
public int? expired_at { get; set; }
public string kid { get; set; }
public string kty { get; set; }
public string use { get; set; }
public string x { get; set; }
public string y { get; set; }
}
class Program
{
static void Main(string[] args)
{
var signedJwt = "eyJhbGciOiJFUzI1NiIsImtpZCI6IjZjNTUxNmUxLTkyZGMtNDc5ZS1hOGZmLTVhNTE5OTJlMDAwMSIsInR5cCI6IkpXVCJ9.eyJpYXQiOjE1OTY3MzA4ODMsInJlcXVlc3RfYm9keV9zaGEyNTYiOiI4NDMyODhkMWMxYmM0NzhlMTBhOTM2NWQ1YjIzY2U5ZWZlY2E2ZjdkYjA3NDQ3Y2JmNjU4YTg3ZjEzZjI1ZjJmIn0.3yQY6gtNq0lQlx6eNLO_3coGqf2VkX2CBRWam9Lz0dcVvr8h4LkYfuZMwQf1fzZ_XXHEV_o17LciyBC-O72UUw";
var jwkJson = "{\"alg\": \"ES256\",\"created_at\": 1560466143, \"crv\": \"P -256\", \"expired_at\": null, \"kid\": \"6c5516e1-92dc-479e-a8ff-5a51992e0001\", \"kty\": \"EC\", \"use\": \"sig\", \"x\": \"35lvC8uz2QrWpQJ3TUH8t9o9DURMp7ydU518RKDl20k\", \"y\": \"I8BuXB2bvxelzJAd7OKhd-ZwjCst05Fx47Mb_0ugros\"}";
var jwk = JsonSerializer.Deserialize<JWK> (jwkJson);
var publicECCKey = EccKey.New(WebEncoders.Base64UrlDecode(jwk.x), WebEncoders.Base64UrlDecode(jwk.y)) ;
var claims = Jose.JWT.Decode(signedJwt, publicECCKey, JwsAlgorithm.ES256);
}
}
}
x
and y
are Base64Url encoded in the jwk
, so you need to use a Base64Url Decoder to transform it to byte[]
. I used Base64UrlDecode for it, but you can of course use any other solution.
来源:https://stackoverflow.com/questions/63299849/how-to-validate-jwt-using-jwk-for-es256-alg