Re: [jose] JWK Generator

[Richard Barnes <[e-mail]>]

We've got some similar tools in PolyCrypt, our WebCrypto polyfill [1].  One
of the demos is a self-signed certificate generator, which outputs private
key as a pseudo-JWK [2].

I was going to put a code snippet here to demonstrate how to generate an
RSA JWK with PolyCrypt.  Instead I just threw up a new demo page that will
do it for you [3].  Sample output:
{"n":"a9_H5i8T7Zg65CUYPGRd4R-Lw7UFiH7guIJ5gQgjJUdnlo6edyVSCux_xV43T-Qe2-SGkRbUirZczdCegfAVjAegVMtnrsgOe_EqhN1CFlmPJ8wwC5Ooyc6u1_FBdu4FL3Kl7jWpII-ikOhZm05xUnj_M7CMMJo6w4PvAAzn-is=","e":"AQAB","d":"ETm1sPL5iqoRVVb7DMG2H_mqlsC0NnyUI8Jp5onHGu_RAcCaW0oxVJ85M-n8iRxTNSfDuS1dGR1PqmnStcsBlZnkwc99vl9gtUW2zAs0J-W3YP88Tk3hNM-6vS2So9-LRMashcWruHBPmLudN-UxGzanvS3G58jkK1BLQCW6xVE=","p":"w8ZngvLVkE3reWvra6vDd3KLJqDHIK602h8yl40vLqX0u5UmXojIqL7k9WpmEn5gvVPsp-XDtkV-50ON9NZD8w==","q":"jQ8KzZ3gHPz-yISa0EbRdI_cmeI03Kq1aAj7bSHDcyr4OjnkI4K6lTVNTGUazf10BrJZ5_2Yj5zOfujV803W6Q==","dp":"m4-Mco3YStjPceTh5OVP5RrcHO6GK58Gz4cYoTmrMwrlYyRJn7Zak1NUBPntb2aCIg6MroCwuaWRB9wy8UhMJw==","dq":"CgIpOBGdlzD0OvH9sg10SxryAhEkwwtxt6H7hPDCV2eTGT6GS2a5KmEPzP3Xewois17wNh-uNXJgzGxk0dCSEQ==","qi":"kZ9MFAYRZKPloUprijuKsJxqfsAVJNINFqqrWr5ycqHLtpmhk6l58wkxFpcU94TJPgf1CaJOj2pGRTyijPa3-w=="}

If you want to use PolyCrypt and need EC, let me know, and I can probably
get it implemented pretty quickly.

Hope this helps,
--Richard


[1] <http://polycrypt.net>
[2] <http://demo.polycrypt.net/x509/>
[3] <http://demo.polycrypt.net/jwk/>




On Tue, Mar 26, 2013 at 10:35 AM, Justin Richer <[e-mail]> wrote:

>  Thanks, that's exactly what I was looking for. I keep forgetting to check
> the unit tests of jsoncrypto for things like this.
>
> Once I have the actual java.security objects in hand, I can construct the
> JWKs fairly easily.
>
> I'll get this added and released soon!
>
>  -- Justin
>
>
> On 03/25/2013 05:05 PM, [e-mail] wrote:
>
>  EC key generation can be found in http://jsoncrypto.org/****
>
> ** **
>
> ES512****
>
>
> https://code.google.com/p/jsoncrypto/source/browse/trunk/testsrc/org/jsoncrypto/JcBaseTest.java#2726
> ****
>
> ** **
>
> ES384****
>
>
> https://code.google.com/p/jsoncrypto/source/browse/trunk/testsrc/org/jsoncrypto/JcBaseTest.java#2685
> ****
>
> ** **
>
> ES256****
>
>
> https://code.google.com/p/jsoncrypto/source/browse/trunk/testsrc/org/jsoncrypto/JcBaseTest.java#2642
> ****
>
> ** **
>
> I guess that the println lines can be converted into JWKs.****
>
> ** **
>
> -Axel****
>
> ** **
>
> *From:* [e-mail] [mailto:[e-mail]<[e-mail]>]
> *On Behalf Of *Justin Richer
> *Sent:* Monday, March 25, 2013 9:36 PM
> *To:* [e-mail]
> *Subject:* [jose] JWK Generator****
>
> ** **
>
> A while ago, several folks complained that there was no toolchain for
> creating bare keys in the JWK/JPSK format. Indeed, my team's been using
> Java's keytool program and making self-signed dummy certs and pulling them
> out of there. That was a bit of a pain, to be honest.
>
> So now I've just written a utility program to generate JWK formatted keys
> from whole cloth given a set of parameters. It's a Java app built using the
> NimbusDS JWT-JOSE library, and at the moment it supports both RSA and oct
> keytypes, with an option to extract the public-only portion of the RSA as
> well. This is all based on the current JPSK format, which we plan to track
> with the aforementioned Nimbus library.
>
> You can get the code here:
>
>   https://github.com/mitreid-connect/json-web-key-generator
>
> It's open sourced under an Apache 2.0 license, so feel free to pull it
> down and use it to your heart's content. It's a Java Maven project, so you
> build it with:
>
>   mvn package
>
> This will create a couple of .jar files in the target/ directory, one of
> which is an executable fat jar, usble from the commandline:****
>
> usage: java -jar json-web-key-generator.jar -t <keyType> -s <keySize> [-u****
>
>             <keyUsage> -a <algorithm> -i <keyId> -p]****
>
>  -a <arg>   Algorithm.****
>
>  -i <arg>   Key ID (optional)****
>
>  -p         Display public key separately****
>
>  -s <arg>   Key Size in bits, must be an integer, generally divisible by 8****
>
>  -t <arg>   Key Type, one of: RSA, oct****
>
>  -u <arg>   Usage, one of: enc, sig. Defaults to sig****
>
>
> For instance, to generate a 1024-bit RSA key with the algorithm of RS256,
> no key id, and display the public key separately, you would run (after
> doing a mvn package):
>
>   java -jar
> target/json-web-key-generator-0.1-SNAPSHOT-jar-with-dependencies.jar -a
> RS256 -t RSA -s 1024 -p
>
> This prints out (for example, your keys should vary):****
>
> Full key:****
>
> {****
>
>   "alg": "RS256",****
>
>   "d": "IXhRb4mXMOLlX1nEcv--CRX5WjGZdUTHzI2qIg-iX5QXY-noSZqit-BeWO0CTwBtryCU4DgNIjV4cvYHpWqkr8ES-FoH7DHDgt41lH5_YDv-MeeCU3hRSPbACLuWEbWQfjgLPgIL1cmh1q-eFOEpXWUtKy7DCFymMves7ojPxY0",****
>
>   "e": "AQAB",****
>
>   "n": "kWkuetDiodUI-0jZ2KpmwOMJ7jsnO8qG8ChMs7ax3xXKIr5g5K0axWtXm1HwA5OJRE-OyVHfJkda6xVgTFaV1AhWP8Zp7KL_Oq-moKRe5-BtahHpFJe7HZ1P6hxXAdhaygXen1lR0NAMNi4K4H5pn1KDCeRpuxAhJZsQnq5dxp0",****
>
>   "kty": "RSA",****
>
>   "use": "sig"****
>
> }****
>
> ** **
>
> Public key:****
>
> {****
>
>   "alg": "RS256",****
>
>   "e": "AQAB",****
>
>   "n": "kWkuetDiodUI-0jZ2KpmwOMJ7jsnO8qG8ChMs7ax3xXKIr5g5K0axWtXm1HwA5OJRE-OyVHfJkda6xVgTFaV1AhWP8Zp7KL_Oq-moKRe5-BtahHpFJe7HZ1P6hxXAdhaygXen1lR0NAMNi4K4H5pn1KDCeRpuxAhJZsQnq5dxp0",****
>
>   "kty": "RSA",****
>
>   "use": "sig"****
>
> }****
>
>
> To create a 256-bit symmetric key with algorithm HS256 and key id of
> "myKey", you'd do:
>
>   java -jar
> target/json-web-key-generator-0.1-SNAPSHOT-jar-with-dependencies.jar -t oct
> -s 256
>
> Which outputs something like:****
>
> Full key:****
>
> {****
>
>   "kty": "oct",****
>
>   "use": "sig",****
>
>   "k": "CsoV5LeX6S3RRlLr-hk0_VyIuTOWyovMPbU2UmbphME"****
>
> }****
>
>
> It doesn't do EC keys yet because I don't know the Java Magic needed to
> make such a thing happen, but I'd be happy to have someone help out with
> that with a pull request.
>
> Hopefully people find this utility useful. I've got a few features I'm
> planning to add (write output to files, Java GUI with dropdowns for
> options), but this is a minimally-useful set of functionality.
>
>  -- Justin****
>
>
>
> _______________________________________________
> jose mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/jose
>
>