JWK key signing is broken in OpenSSL 3.0

[deepfryed]

https://github.com/potatosalad/ruby-jose/blob/master/lib/jose/jwk/kty_ec.rb#L20

does not work with OpenSSL 3.0 and fails with error "pkeys are immutable on OpenSSL 3.0"

Potential fix is to use ASN1 sequences as done in https://github.com/googleapis/google-auth-library-ruby/pull/397/files#diff-fda73a61a26353211e861c4b1519bd86ec9abd1bfa2a044601bae498679ea7e5R160-R165

[globewalldesk]

Are there any plans to update this gem? It's the only one I could find for JOSE signing.

[deepfryed]

@potatosalad if you're not planning to maintain this library, could you please add a note on the README ? OpenSSL 1.1 will not be receiving security updates beyond 2023, so making it work with OpenSSL 3.x is quite important or people will need to switch to a different library.

thanks

[enriquez]

This is thrown together and seems to work for our use https://github.com/enriquez/ruby-jose/tree/convert-to-asn1

[deepfryed]

thanks @enriquez - we're moving away from using this gem as it seems to be unmaintained.

[enriquez]

@deepfryed can you recommend alternatives?

[deepfryed]

we're trying out https://rubygems.org/gems/jwt

[globewalldesk]

We're using jwt too. Works fine.

[theDogOfPavlov]

This is still failing after the commit:

terminated with exception (report_on_exception is true):
/root/.rbenv/versions/3.2.1/lib/ruby/gems/3.2.0/gems/jose-1.1.3/lib/jose/jwk/kty_ec.rb:20:in `public_key=': pkeys are immutable on OpenSSL 3.0 (OpenSSL::PKey::PKeyError)
        from /root/.rbenv/versions/3.2.1/lib/ruby/gems/3.2.0/gems/jose-1.1.3/lib/jose/jwk/kty_ec.rb:20:in `from_map'
        from /root/.rbenv/versions/3.2.1/lib/ruby/gems/3.2.0/gems/jose-1.1.3/lib/jose/jwk.rb:1059:in `from_fields'
        from /root/.rbenv/versions/3.2.1/lib/ruby/gems/3.2.0/gems/jose-1.1.3/lib/jose/jwk.rb:123:in `from_map'
        from /root/.rbenv/versions/3.2.1/lib/ruby/gems/3.2.0/gems/jose-1.1.3/lib/jose/jwk.rb:76:in `from_binary'
        ```

[pean]

we're trying out https://rubygems.org/gems/jwt

Thanks for that tip. Looked pretty promising until I realized it does not support RSA-OAEP-256. This seems to be the only gem that I found that does.

[Physium]

Are there alternatives for JWE encrypt/decrypt? seems like jose is the only one that support an algo of ECDH-ES+A256KW