auth0 / node-jsonwebtoken

JsonWebToken implementation for node.js http://self-issued.info/docs/draft-ietf-oauth-json-web-token.html
MIT License
17.73k stars 1.23k forks source link

Signature generation fails for SM2 private keys with ES256 algorithm for node 18 version #957

Closed balnenikhil closed 10 months ago

balnenikhil commented 10 months ago

Description

jwt.sign(<payload>, <utf8 encoded SM2 private key>, { algorithm: 'ES256' }) fails with "error":{"code":"ERR_OSSL_INVALID_DIGEST","library":"Provider routines","reason":"invalid digest"} when using node 18.17.0.

The above command works fine with node version 16 but fails with node versions 18 and 20.

Environment

panva commented 10 months ago

There is no registered JWS algorithm for SM2 keys^iana and ES256 requires the use of an EC key using the P-256 curve. Furthermore Node.js does not fully support SM2 keys.^node

Bottom line use of SM2 keys with JOSE is unsupported and out of scope.