0

I am attempting to sign a JWT token and am receiving the following error

io.jsonwebtoken.security.InvalidKeyException: JWT standard signing algorithms require either 1) a SecretKey for HMAC-SHA algorithms or 2) a private RSAKey for RSA algorithms or 3) a private ECKey for Elliptic Curve algorithms.  The specified key is of type sun.security.pkcs11.P11Key$P11PrivateKey

The code where this error occurs

    public static String createJwtToken(Key privKey, String iss, String[] roles) {
        long nowMs = System.currentTimeMillis();
        long ttl = 60*60*1000; // 1 hour
        Date now = new Date(nowMs);
        Date exp = new Date(nowMs+ttl);
        return "Bearer " + Jwts.builder()
                .setHeaderParam("typ", "JWT")
                .claim("roles", roles)
                .setIssuer(iss).setAudience("DRF")
                .setIssuedAt(now)
                .setExpiration(exp)
                .signWith(privKey)
                .compact();
    }

My private key is an ECDSA key. The bytes are read from a file and then used to create a PrivateKey object with this code

     KeyFactory kf = KeyFactory.getInstance("EC");
     EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(keyBytes);
     PrivateKey privateKey = kf.generatePrivate(keySpec);

There was no issue on RHEL 7 using Java 8. I have upgraded to RHEL 8 (with no other changes) and now see the problem. I've tried using Java 11 as well with no change. I'm using openjdk.

jnasworld223
  • 77
  • 6

1 Answers1

0

Still not sure what is causing this, but it seems isolated to the builds of Java in the RHEL 8 repositories. Using other openjdk builds works as expected.

jnasworld223
  • 77
  • 6
  • 1
    This might be related to RH8's new system-wide crypto policy, especially if the FIPS option is used, since OpenJDK providers are not FIPS and thus Java must instead use via PKCS11 a validated library (maybe NSS?) – dave_thompson_085 May 18 '23 at 23:31
  • @dave_thompson_085 That sounds promising. Do you know if this can be disabled? – jnasworld223 May 19 '23 at 22:28
  • 1
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening says `fips-mode-setup` "enables or disables FIPS mode" but they give an example only of enabling. Try the man page; I don't have an actual system to test. – dave_thompson_085 May 20 '23 at 03:06
  • This fixed the problem, thanks. You can disable FIPS with `fips-mode-setup --disable`. If you post that as an answer, I'll accept it. – jnasworld223 May 22 '23 at 19:43