How to add alg to generated JWK?

[elirankon]

Hi,

I've used the samples in the documentation to generate a RSA JWKS. However, I see that alg is not set

privateKey, err := rsa.GenerateKey(rand.Reader, keySize)
	if err != nil {
		return nil, err
	}
privateJWK := jwk.NewRSAPrivateKey()
err = privateJWK.FromRaw(privateKey)
	if err != nil {
		return nil, err
	}

publicJWK := jwk.NewRSAPublicKey()
	err = publicJWK.FromRaw(&privateKey.PublicKey)
	if err != nil {
		return nil, err
	}

fmt.Println(publicJWK.Algorithm()) // ""

How should I set the alg field? I feel like using Set("alg","RS256") is a bit brute-force, no?

Thanks for the help!

[lestrrat]

The answer is to use Set(). You could use jwk.AlgorithmKey and jwa.RS256 as constants, but that's about it.
What's making it feel like it "brute-force"? I'd like to know what seems to be the problem.

[gestrada-kr]

I can definitely try it! getting the algorithm for the key is a one time only operation every time the service starts or the keys are rotated, so I can definitely allow it. I will look into that one thanks!

[gestrada-kr]

@lestrrat what would the process to match the algorithm to the key would be like? For example, if I create a key with rsa.GenerateKey(rand.Reader, 2048) the output of jws.AlgorithmForKey() (after FromRaw()) is: [RS256 RS384 RS512 PS256 PS384 PS512]

From there, how do I match it to the specific one?

[lestrrat]

brute force and try each one of them! :D There's just no other way.

---

As an aside, I guess my AlgorithmsForKey doesn't look at the actual Go key type (sorry, it has been a while)?
You might be able to patch AlgorithmsForKey to look at the actual key type to make slightly smarter guesses.

[gestrada-kr]

Thanks @lestrrat, I guess that if AlgorithmForKeys() is not used anywhere in the code for actual type determination, I might as well patch it, make it so that it can actually determine the algorithm and submit a PR. Does that sound good?

[lestrrat]

AlgorithmForKeys() is being used within jws.WithKeySet() https://github.com/lestrrat-go/jwx/blob/develop/v2/jws/key_provider.go#L128

If you are filing a PR, please make sure to provide tests so we know exactly how you intend to use the new features.

[lestrrat]

Also, it is in the docs ;)

https://github.com/lestrrat-go/jwx/blob/develop/v2/docs/01-jwt.md#parse-and-verify-a-jwt-with-a-key-set-matching-kid
https://github.com/lestrrat-go/jwx/blob/develop/v2/docs/02-jws.md#verification-using-a-jwks
https://github.com/lestrrat-go/jwx/blob/develop/v2/docs/03-jwe.md#decrypting-using-a-jwks

[elirankon]

I guess I need to brush up on my JOSE practices 🙏