Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-21380

[GSS](7.3.z) Elytron JWK implementation is not RFC#7517 compliant

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Duplicate
    • Icon: Major Major
    • None
    • 7.3.6.GA
    • None
    • None
    • False
    • False
    • Undefined

      The JwkManager class, on source code lines 177-178 loads the RSA public key value "n" with: Base64.getDecoder()decode(n1).

      This is not RFC (https://tools.ietf.org/html/rfc7517) compliant. The BigInts of the RSA key are Base64URL encoded. So that code should load "n" using Base64.getUrlDecoder().decode(n1).

      (Note this also applies to the other key exponents such as "e" etc)

      Also the creation of the BigInteger from n1/e1 is currently wrong as it is mandatory to use:

      new BigInteger(1,b,0,b.length); //where b=byte[] = Base64.getUrlDecoder().decode(n1).

      As per spec it is a Base64urlUInt (https://tools.ietf.org/html/rfc7518#section-6.3)!

            rhn-support-igueye Issa Gueye
            rhn-support-igueye Issa Gueye
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: