Having trouble formatting private key for RSA signature

[scottmacdonaldclearobject]

the error I get:

Caught: java.lang.IllegalArgumentException: Key bytes may only be specified for HMAC signatures.  If using RSA or Elliptic Curve, use the signWith(SignatureAlgorithm, Key) method instead.
java.lang.IllegalArgumentException: Key bytes may only be specified for HMAC signatures.  If using RSA or Elliptic Curve, use the signWith(SignatureAlgorithm, Key) method instead.
        at io.jsonwebtoken.lang.Assert.isTrue(Assert.java:41)
        at io.jsonwebtoken.impl.DefaultJwtBuilder.signWith(DefaultJwtBuilder.java:264)
        at token.run(token.groovy:79)

This doesn't make sense to me, as I believe I am using the signWith(SignatureAlgorithm, Key) method. I suspect there is some minor mistake in my code that I have missed. I am having trouble finding the documentation in the readme, and in google web searches for where I am going wrong. I tried some of the signing key format changes shown in The Docs, but I could not find the dependencies for the classes used.

The code I am running (Please note, this is groovyscript, so some syntax may not be correct for pure java):

// ^^^Grapes config^^^ 

import io.jsonwebtoken.*
import java.security.PrivateKey
import java.util.Base64
import java.util.Base64.Decoder
import java.nio.charset.StandardCharsets
import java.security.interfaces.ECPrivateKey
import java.security.KeyFactory
import java.security.NoSuchAlgorithmException
import java.security.spec.PKCS8EncodedKeySpec
import java.security.Key;

// Generating Tokens for API Requests
// https://developers.google.com/identity/protocols/oauth2/service-account#httprest

iss = "[email protected]" // svc account email 
scope = "https://www.googleapis.com/auth/service/priv" // A space-delimited list of the permissions that the application requests.
aud = "https://oauth2.googleapis.com/token" // ALWAYS

def exp = (System.currentTimeMillis() / 1000 + 1200).trunc()
//20 minutes from now // The expiration time of the assertion, specified as seconds since 00:00:00 UTC, January 1, 1970. This value has a maximum of 1 hour after the issued time.
def iat = (System.currentTimeMillis() / 1000).trunc()
//  The time the assertion was issued, specified as seconds since 00:00:00 UTC, January 1, 1970.

//JWT Payload 
String jsonString = """{"typ":${iss},
                        "scope":${scope},
                        "aud":${aud},
                        exp":${exp},
                        "iat":${iat}}""";

// Private key // need to vault in future 
def key = "nM... ...PwWB+B9+g" // from gcp service account info, ==padding removed, "begin signature" "end signature" removed

byte[] privateKeyBytes = Base64.getDecoder().decode(key)

String jwtToken = Jwts.builder()
		//JWT Header
	.setHeaderParam("typ","JWT")
	.setHeaderParam("alg","RS256")
    .setPayload(jsonString)
	.signWith(SignatureAlgorithm.RS256, privateKeyBytes)
	.compact();

print(jwtToken)

This seems to work fine for generating a token when using HS256, however I need RS256 for the service I am trying to interact with.

[scottmacdonaldclearobject]

Was able to figure this out with help from: Stack overflow, and switching to import org.apache.commons.codec.binary.Base64 for the decoder.

// Formatting key
StringBuilder pkcs8Lines = new StringBuilder();
BufferedReader rdr = new BufferedReader(new StringReader(BASEKEY));
String line;
while ((line = rdr.readLine()) != null) {
    pkcs8Lines.append(line);
}
// Cleaning key 
String pkcs8Pem = pkcs8Lines.toString();
pkcs8Pem = pkcs8Pem.replace("-----BEGIN PRIVATE KEY-----", "");
pkcs8Pem = pkcs8Pem.replace("-----END PRIVATE KEY-----", "");
pkcs8Pem = pkcs8Pem.replaceAll("\\s+","");
// Decoding key
byte[] valueDecoded = Base64.decodeBase64(pkcs8Pem);
PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(valueDecoded);
KeyFactory rsaFact = KeyFactory.getInstance("RSA");
RSAPrivateKey key = (RSAPrivateKey) rsaFact.generatePrivate(keySpec);

[lhazlewood]

Glad you found that!

Also, i'm not sure which version of JJWT you're using, but later versions have a .signWith(Key, SignatureAlgorithm) method (key is 1st argument). It looks like you may be using an older version, but I can't tell.

The byte array argument variant of .signWith was deprecated specifically due to confusion on how to reconstitute keys from bytes, for example: #783 (comment)

[lhazlewood]

P.S. you don't need to import commons-codec for Base64.

If you're using JDK 8 or later, you can use java.util.Base64.getDecoder(). If you're using Android or JDK 7, you can use JJWT's Decoders.BASE64 constant.

[lhazlewood]

Also see #827

[scottmacdonaldclearobject]

@lhazlewood Thanks for the replies.I am using v12.6, and it seems to be working fine now, even with the key listed second , which is something I double checked since I found conflicting info on how to pass in the key and alg.

The reasons I switched to commons codec was because I couldn't get either of the decoders you mentioned to accept the input value I was inputting, likely because of some misunderstanding on my part - similar to that mentioned in #738 😆. I can't remember the exact error code I was getting but the apache library was recommended for it. Nonetheless, getting a better understanding of the concepts discussed in 783 is on my to-do list, so I really appreciate you bringing it up, as well as the content in 729.

All that aside, I am happy to now be generating working JWTs.

[lhazlewood]

@scottmacdonaldclearobject .signWith(alg, Key) has been deprecated - it should not be used in new code as that method will be removed in the future. The reason for this is that the SignatureAlgorithm enum was not customizable (no custom SignatureAlgorithms could be created), so a new SignatureAlgorithm interface was created to replace it. The method signature that accepts a Key as the second argument relies on the old (deprecated) enum, and will be removed in the future.

It's important to pay attention to @Deprecated annotations and JavaDoc to ensure that new code doesn't used scheduled-to-be-deleted methods. Additionally, our README docs no longer reference that old method anywhere for the same reason. This is challenging when using Groovy because it often hides these type-safety issues, unless you're using an IDE that identifies these issues as you type (e.g. IntelliJ). I hope that helps!

Anyway, it's good to hear you're generating JWTs now!