cpp-jwt: ES256/384 signature verification fails
Starting from this test, I’m trying to get my stuff working. However, I failed at verifying the signature from the tests as a starting example. Something is wrong. I need ECC because it’s more efficient than RSA. In this test that I got from the code:
TEST (ESAlgo, ES384EncodingDecodingTest)
{
using namespace jwt::params;
std::string key = read_from_file(EC384_PRIV_KEY);
ASSERT_TRUE (key.length());
jwt::jwt_object obj{algorithm("ES384"), secret(key)};
obj.add_claim("iss", "arun.muralidharan")
.add_claim("aud", "all")
.add_claim("exp", 1513862371)
;
auto enc_str = obj.signature();
key = read_from_file(EC384_PUB_KEY);
ASSERT_TRUE (key.length());
auto dec_obj = jwt::decode(enc_str, algorithms({"es384"}), verify(false), secret(key));
EXPECT_EQ (dec_obj.header().algo(), jwt::algorithm::ES384);
std::cout << enc_str << std::endl;
}
I added that cout statement, then went to jwt.io, and it fails at verifying the signature. Something is wrong there.
I also tried using my own key that I generated in OpenSSL using:
CURVE=secp384r1
openssl ecparam -name ${CURVE} -out curve.pem
openssl ecparam -name ${CURVE} -genkey -noout -out privkey.pem
openssl ec -in privkey.pem -pubout -out pubkey.pem
But my key fails too. Also 256 bit fail the same.
Unfortunately the library is not usable in this state. Can you please take a look and see why this is happening?
About this issue
- Original URL
- State: closed
- Created 6 years ago
- Comments: 19 (17 by maintainers)
Commits related to this issue
- ES256/384 signature verification fails #20 — committed to arun11299/cpp-jwt by arun11299 6 years ago
- ES256/384 signature verification fails #20 — committed to interfector18/cpp-jwt by arun11299 6 years ago
Thank you. When I added the new line. It worked perfectly.
Keep in mind that they may not respond (depending on how cooperative they may be willing to be and how much they care). Good luck!