Skip to content

fix: raise InvalidKeyError for unparseable EC and OKP keys - #1230

Open
HardMax71 wants to merge 2 commits into
jpadilla:masterfrom
HardMax71:fix/ec-okp-invalid-key-error
Open

HardMax71 wants to merge 2 commits into
jpadilla:masterfrom
HardMax71:fix/ec-okp-invalid-key-error

Conversation

@HardMax71

Copy link
Copy Markdown

Fixes #1229

ECAlgorithm.prepare_key and OKPAlgorithm.prepare_key let cryptography's ValueError (or UnsupportedAlgorithm) through when a PEM or SSH key can't be parsed. RSAAlgorithm raises InvalidKeyError for the same input since #952, so code that catches PyJWTError around decode() only breaks for EC and Ed25519 keys.

  • EC: wrap the fallback load_pem_private_key, the same way RSA wraps its fallback.
  • OKP: wrap the decode and the three loaders. Non-UTF-8 bytes raise UnicodeDecodeError, which is a ValueError too, so that case is covered as well.
  • check_crypto_key_type: join the class names, so the message reads Expected one of EllipticCurvePrivateKey, EllipticCurvePublicKey, got: RSAPublicKey instead of printing a generator object.

Both new errors say "Could not parse the provided key." because EC and OKP try both public and private keys.

Tests: parametrized cases for EC (3 inputs) and OKP (4 inputs), plus a match on the existing EC wrong-key test for the message. All of them fail on master. The full suite passes with and without cryptography, and mypy and the pre-commit hooks pass. Changelog entry added under Unreleased.

#1199 also rewrites OKPAlgorithm.prepare_key, so whichever lands second needs a small rebase there.

ECAlgorithm and OKPAlgorithm let cryptography's ValueError through when a PEM
or SSH key can't be parsed, while RSAAlgorithm raises InvalidKeyError since
jpadilla#952. Also list the expected key classes by name in the key type error instead
of printing a generator object.
@HardMax71
HardMax71 force-pushed the fix/ec-okp-invalid-key-error branch from fad019d to d886fcc Compare October 15, 2026 16:33
@HardMax71

Copy link
Copy Markdown
Author

@jpadilla could you review this when you have time? It raises InvalidKeyError for EC and OKP keys that can't be parsed.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ECAlgorithm and OKPAlgorithm raise ValueError for an unparseable key, not InvalidKeyError

1 participant