cpp-jwt: ES256/384 signature verification fails

Starting from this test, I’m trying to get my stuff working. However, I failed at verifying the signature from the tests as a starting example. Something is wrong. I need ECC because it’s more efficient than RSA. In this test that I got from the code:

TEST (ESAlgo, ES384EncodingDecodingTest)
{
  using namespace jwt::params;

  std::string key = read_from_file(EC384_PRIV_KEY);
  ASSERT_TRUE (key.length());

  jwt::jwt_object obj{algorithm("ES384"), secret(key)};

  obj.add_claim("iss", "arun.muralidharan")
     .add_claim("aud", "all")
     .add_claim("exp", 1513862371)
     ;

  auto enc_str = obj.signature();

  key = read_from_file(EC384_PUB_KEY);
  ASSERT_TRUE (key.length());

  auto dec_obj = jwt::decode(enc_str, algorithms({"es384"}), verify(false), secret(key));

  EXPECT_EQ (dec_obj.header().algo(), jwt::algorithm::ES384);

  std::cout << enc_str << std::endl;

}

I added that cout statement, then went to jwt.io, and it fails at verifying the signature. Something is wrong there.

I also tried using my own key that I generated in OpenSSL using:

CURVE=secp384r1
openssl ecparam -name ${CURVE} -out curve.pem
openssl ecparam -name ${CURVE} -genkey -noout -out privkey.pem
openssl ec -in privkey.pem -pubout -out pubkey.pem

But my key fails too. Also 256 bit fail the same.

Unfortunately the library is not usable in this state. Can you please take a look and see why this is happening?

About this issue

  • Original URL
  • State: closed
  • Created 6 years ago
  • Comments: 19 (17 by maintainers)

Commits related to this issue

Most upvoted comments

Thank you. When I added the new line. It worked perfectly.

Keep in mind that they may not respond (depending on how cooperative they may be willing to be and how much they care). Good luck!