Skip to content

jwk.construct() Unable to parse an RSA_JWK from _RSAPrivateKey object #282

Closed
@DataGhost

Description

@DataGhost

This is probably related to #50 but I'm not using a dict to construct my JWK, rather an instantiated private key. Also looking at the code I get the idea that #50 has been fixed long ago.

I cannot call jwk.construct with an already-instantiated private key (_RSAPrivateKey object). The error thrown is:
jose.exceptions.JWKError: Unable to parse an RSA_JWK from key: <cryptography.hazmat.backends.openssl.rsa._RSAPrivateKey object at 0x7f6c480a4e20>
I've loaded it using cryptography.hazmat.primitives.serialization.load_pem_private_key. The current constructor in python-jose seems to check for public keys only, which are directly assigned into self.prepared_key. My current workaround is serializing the _RSAPrivateKey object back into PEM/pkcs8 and calling jwk.construct on the resulting string, after which it does a call to load_pem_private_key anyway

self.prepared_key = load_pem_private_key(key, password=None, backend=self.cryptography_backend())
to get an identical result, the resulting jwkinstance.prepared_key is again an _RSAPrivateKey object. To me it seems an easy fix, just assign it similarly to:
if hasattr(key, "public_bytes") and hasattr(key, "public_numbers"):
self.prepared_key = key
return

after checking that it conforms to the private key interface.

My use case is having an encrypted private key so I need to decrypt it before constructing the JWK, as there is no way for me to pass the password into the constructor and letting it handle that. Reserialization seems like an unnecessary extra step.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions