{"action":"created","issue":{"url":"https://api.github.com/repos/lestrrat-go/jwx/issues/48","repository_url":"https://api.github.com/repos/lestrrat-go/jwx","labels_url":"https://api.github.com/repos/lestrrat-go/jwx/issues/48/labels{/name}","comments_url":"https://api.github.com/repos/lestrrat-go/jwx/issues/48/comments","events_url":"https://api.github.com/repos/lestrrat-go/jwx/issues/48/events","html_url":"https://github.com/lestrrat-go/jwx/issues/48","id":301401382,"number":48,"title":"Issue with verifying JWT's with ES256","user":{"login":"zamicol","id":5232965,"avatar_url":"https://avatars2.githubusercontent.com/u/5232965?v=4","gravatar_id":"","url":"https://api.github.com/users/zamicol","html_url":"https://github.com/zamicol","followers_url":"https://api.github.com/users/zamicol/followers","following_url":"https://api.github.com/users/zamicol/following{/other_user}","gists_url":"https://api.github.com/users/zamicol/gists{/gist_id}","starred_url":"https://api.github.com/users/zamicol/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zamicol/subscriptions","organizations_url":"https://api.github.com/users/zamicol/orgs","repos_url":"https://api.github.com/users/zamicol/repos","events_url":"https://api.github.com/users/zamicol/events{/privacy}","received_events_url":"https://api.github.com/users/zamicol/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-03-01T13:19:27Z","updated_at":"2018-03-02T00:05:56Z","closed_at":null,"author_association":"NONE","body":"Verifying with RS256 succeeds while ES256 fails, returning an \"empty buffer\" error.  \r\n\r\nYou can copy and paste the below into jwt_test.go.  I haven't gotten to the bottom of the issue yet.  \r\n\r\n```\r\nfunc TestVerifyWithRS(t *testing.T) {\r\n\talg := jwa.RS256\r\n\tkey, err := rsa.GenerateKey(rand.Reader, 2048)\r\n\tif err != nil {\r\n\t\treturn\r\n\t}\r\n\r\n\tt1 := jwt.New()\r\n\tt1.Set(\"example\", \"RS256\")\r\n\tsigned, err := t1.Sign(alg, key)\r\n\r\n\t_, err = jwt.ParseVerify(bytes.NewReader(signed), alg, &key.PublicKey)\r\n\tif !assert.NoError(t, err, `jwt.ParseVerify should succeed`) {\r\n\t\treturn\r\n\t}\r\n}\r\n\r\nfunc TestVerifyWithES(t *testing.T) {\r\n\talg := jwa.ES256\r\n\tkey, err := rsa.GenerateKey(rand.Reader, 2048)\r\n\tif err != nil {\r\n\t\treturn\r\n\t}\r\n\r\n\tt1 := jwt.New()\r\n\tt1.Set(\"example\", \"ES256\")\r\n\tsigned, err := t1.Sign(alg, key)\r\n\r\n\t_, err = jwt.ParseVerify(bytes.NewReader(signed), alg, &key.PublicKey)\r\n\tif !assert.NoError(t, err, `jwt.ParseVerify should succeed`) {\r\n\t\treturn\r\n\t}\r\n}\r\n```"},"comment":{"url":"https://api.github.com/repos/lestrrat-go/jwx/issues/comments/369774979","html_url":"https://github.com/lestrrat-go/jwx/issues/48#issuecomment-369774979","issue_url":"https://api.github.com/repos/lestrrat-go/jwx/issues/48","id":369774979,"user":{"login":"lestrrat","id":49281,"avatar_url":"https://avatars1.githubusercontent.com/u/49281?v=4","gravatar_id":"","url":"https://api.github.com/users/lestrrat","html_url":"https://github.com/lestrrat","followers_url":"https://api.github.com/users/lestrrat/followers","following_url":"https://api.github.com/users/lestrrat/following{/other_user}","gists_url":"https://api.github.com/users/lestrrat/gists{/gist_id}","starred_url":"https://api.github.com/users/lestrrat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lestrrat/subscriptions","organizations_url":"https://api.github.com/users/lestrrat/orgs","repos_url":"https://api.github.com/users/lestrrat/repos","events_url":"https://api.github.com/users/lestrrat/events{/privacy}","received_events_url":"https://api.github.com/users/lestrrat/received_events","type":"User","site_admin":false},"created_at":"2018-03-02T00:05:56Z","updated_at":"2018-03-02T00:05:56Z","author_association":"COLLABORATOR","body":"@zamicol there are two problems:\r\n\r\nFirst, you're not checking the result of `t1.Sign`. Had you checked for it, you would have seen that `t1.Sign` for ES256 was failing with `\r\n\r\n```\r\nError:  \tReceived unexpected error \"failed to sign payload: failed to sign payload: invalid key type *rsa.PrivateKey. *ecdsa.PrivateKey is required\"\r\n```\r\n\r\nAnd second, which is the root cause of your problem, is that ES256 requires an elliptic curve based key, which you cannot get from using `\"crypto/rsa\".GenerateKey`. You need to use `\"crypto/ecdsa\".GenerateKey`"}}
{"actor":{"display_login":"lestrrat"}}