How to validate ES384 JWT signature with x and y coordinate in python

Question

I have a JWT that is as follows:

Authorization: Bearer eyJhbGciOiJFUzM4NCIsInR5cCI6IkpXVCIsImtpZCI6IjQ0ODIzZjNkLTBiMDEtNGE2Yy1hODBlLWI5ZDNlOGE3MjI2ZiIsImprdSI6Imh0dHBzOi8vc2FuZGJveC5jZHMtaG9va3Mub3JnLy53ZWxsLWtub3duL2p3a3MuanNvbiJ9.eyJpc3MiOiJodHRwczovL3NhbmRib3guY2RzLWhvb2tzLm9yZyIsImF1ZCI6Imh0dHA6Ly8xMjcuMC4wLjE6ODAwMC9jZHMtc2VydmljZXMiLCJleHAiOjE1OTQyMzA5MDAsImlhdCI6MTU5NDIzMDYwMCwianRpIjoiZWZiMzc3M2QtM2EyOC00M2UyLTlmYmMtYjkzNmE5YWUzODhiIn0.Cbey3n5NkDRoCLHZ2WMFc1z_RY8Rlq5oGxdAYfbrBPMiJXLCwjbYoU0av2CQj-Olhbnpe7Vs8vzJ5oHP5gc2-0ooc5J49t4Uz9iYKpiM9KLUrqaJe0umc_klM2-ynHAI

I've been struggling since python libraries like PyJWT require a PEM format public key for Elliptical curve algorithms, and I'm having to decode the base64 to get the header which has the "jku" (https://sandbox.cds-hooks.org/.well-known/jwks.json) which only has the x and y coordinates and not a public key.

I feel like I'm going completely into the wrong direction for what I imagine should be a simple and automated process for validating a JWT with the ES384 alg.

If anyone can help to explain how to validate this with a library/python code it would be a life saver!

jps jps · Accepted Answer · 2020-07-09T20:35:01

You can use the Jose-JWT library for that:

pip install python-jose

With Jose-JWT you can either construct a key from the given JWK or use the JWK (JSON Web Key) directly in the decodecall, as shown in the following short example:

from jose import jwk, jwt

es384_key = {
    "kty": "EC",
    "crv": "P-384",
    "kid": "44823f3d-0b01-4a6c-a80e-b9d3e8a7226f",
    "use": "sig",
    "alg": "ES384",
    "x": "dw_JGR8nB2I6XveNxUOl2qk699ZPLM2nYI5STSdiEl9avAkrm3CkfYMbrrjr8laB",
    "y": "Sm3mLE-n1zYNla_aiE3cb3nZsL51RbC7ysw3q8aJLxGm-hx79RPMYpITDjp7kgzy"
}

allowed_aud = "http://127.0.0.1:8000/cds-services"
token = "eyJhbGciOiJFUzM4NCIsInR5cCI6IkpXVCIsImtpZCI6IjQ0ODIzZjNkLTBiMDEtNGE2Yy1hODBlLWI5ZDNlOGE3MjI2ZiIsImprdSI6Imh0dHBzOi8vc2FuZGJveC5jZHMtaG9va3Mub3JnLy53ZWxsLWtub3duL2p3a3MuanNvbiJ9.eyJpc3MiOiJodHRwczovL3NhbmRib3guY2RzLWhvb2tzLm9yZyIsImF1ZCI6Imh0dHA6Ly8xMjcuMC4wLjE6ODAwMC9jZHMtc2VydmljZXMiLCJleHAiOjE1OTQyMzA5MDAsImlhdCI6MTU5NDIzMDYwMCwianRpIjoiZWZiMzc3M2QtM2EyOC00M2UyLTlmYmMtYjkzNmE5YWUzODhiIn0.Cbey3n5NkDRoCLHZ2WMFc1z_RY8Rlq5oGxdAYfbrBPMiJXLCwjbYoU0av2CQj-Olhbnpe7Vs8vzJ5oHP5gc2-0ooc5J49t4Uz9iYKpiM9KLUrqaJe0umc_klM2-ynHAI"

payload = jwt.decode(
                token,
                es384_key,
                audience = allowed_aud,
                options = {'verify_exp':False})

print (payload)

Even though it's called decode, the function in fact verifies the signature.

Note: I added options = {'verify_exp':False} to avoid an error, because your token already expired yesterday.

Output:

{'iss': 'https://sandbox.cds-hooks.org', 'aud': 'http://127.0.0.1:8000/cds-services', 'exp': 1594230900, 'iat': 1594230600, 'jti': 'efb3773d-3a28-43e2-9fbc-b936a9ae388b'}

How to validate ES384 JWT signature with x and y coordinate in python

1 Answers