Sign payload with ECDSA P-256 SHA-256

[slashmili]

Hey,

I was checking the code and noticed that in this library secp256k1 is used as opposed to secp256r1.

Is there any reason for that?

Looks like P-256 is secp256r1.

• https://github.com/auth0/node-jsonwebtoken/issues/97#issuecomment-119029416

The JWA spec defines ES256 as ECDSA using P-256 and SHA-256 where P-256 is another name for secp256r1

• https://www.ietf.org/rfc/rfc5480.txt

-- Note that [FIPS186-3] refers to secp192r1 as P-192, secp224r1 as -- P-224, secp256r1 as P-256, secp384r1 as P-384, and secp521r1 as -- P-521.

The reason that I'm asking is I have problem verifying a JWT with key pair that generated with secp256r1.

{public_key, private_key} = :crypto.generate_key(:ecdh, :secp256r1)
jwt = JsonWebToken.sign(%{foo: "bar"}, %{alg: "ES256", key: private_key})
iex(98)> JsonWebToken.verify(jwt, %{alg: "ES256", key: public_key})
{:error, "invalid"}

[slashmili]

Just checked erlang-jose and it's also using :secp256r1

[garyf]

addressed by 3d0cd3c

[slashmili]

Thanks ❤️