Using Delphi JOSE & JWT library, how do you sign a JWT using RS256

Question

All their examples use HS*** with none in RS*** and trying to change the examples to suite dont seem to be working.

My problem seems to be getting the private key loaded for signing. I'm using a PEM in a string, setting up the claims, using this

Procedure RunTest2b;
var
  LToken: TJWT;
  LSigner: TJWS;
  LKey: TJWK;
  LAlg: TJOSEAlgorithmId;
  s: String;
begin
  LToken := TJWT.Create;
  try
    LToken.Claims.Subject := 'Paolo Rossi';
    LToken.Claims.Issuer := 'Delphi JOSE Library';
    LToken.Claims.IssuedAt := Now;
    LToken.Claims.Expiration := Now + 1;
    // Signing algorithm
    LAlg := TJOSEAlgorithmId.RS256;
    LSigner := TJWS.Create(LToken);
    LKey := TJWK.Create(gPrivateKey);
    try
      // With this option you can have keys < algorithm length
      LSigner.SkipKeyValidation := True;
      LSigner.Sign(LKey, LAlg);
      s := 'Header: ' + LSigner.Header + #13#10 +
           'Payload: ' + LSigner.Payload + #13#10 +
           'Signature: ' + LSigner.Signature + #13#10 +
           'Compact Token: ' + LSigner.CompactToken;
      if s = '' then;
    finally
      LKey.Free;
      LSigner.Free;
    end;
  finally
    LToken.Free;
  end;
end;

This fails in the sign method saying "Unable to load private key:" and a bunch of weird characters which makes it look like maybe I have a wide string when I should have an ansistring, but changing it doesn't seem to help.

I have also tried using the TBase64.Decode and TBase64.UrlDecode to transform the key before I pass it into the sign method without success.

Can anyone see where I'm making a mistake ?

score 2 · Answer 1 · answered Jan 27 '21 at 20:15

I recently jump thru a few hoops to do some JWT testing using JOSE. I didn't sign anything, but did have to use the PEM to verify the JWT which was using RS. While doing so I made the mistake of concatenating the PEM string into a single line of characters without preserving the line feeds. I wonder if you made the same mistake with your keys?

i.e. bad PEM format
myPem := '-----BEGIN PUBLIC KEY-----'
+ 'A23BBjhasdfbewisudvnacwerf823rdsvcp2'
+ 'bDenDfsub893rghvsaefawerd'
+ '-----END PUBLIC KEY-----';

i.e. good PEM format
myPem := '-----BEGIN PUBLIC KEY-----'
+ #13#10 + 'A23BBjhasdfbewisudvnacwerf823rdsvcp2'
+ #13#10 + 'bDenDfsub893rghvsaefawerd'
+ #13#10 + '-----END PUBLIC KEY-----';

Using Delphi JOSE & JWT library, how do you sign a JWT using RS256

1 Answers1