RS256 消息对于 RSA 公钥大小太长 - 错误签名 JWT

Question

我正在使用https://github.com/dgrijalva/jwt-go使用 256 位 PEM 私钥构建 JWT。我SigningMethodRS256用来签署 JWT：

signBytes, _ := ioutil.ReadFile(privKeyPath)

signKey, err := jwt.ParseRSAPrivateKeyFromPEM(signBytes)

token := jwt.NewWithClaims(jwt.SigningMethodRS256, middleware.CognitoAccessTokenClaim{

    CustomArray:  []string{"testString"},

    StandardClaims: jwt.StandardClaims{

    ExpiresAt: 1500,

    },

})

jwtString, err := token.SignedString(signKey)

在最后一行，签署 jwt: 时出现错误crypto/rsa: message too long for RSA public key size。有谁知道这是什么原因？pem 文件的大小似乎是正确的。

Answer 1

您需要将消息拆分为块func EncryptOAEP(hash hash.Hash, random io.Reader, public *rsa.PublicKey, msg []byte, label []byte) ([]byte, error) {&nbsp; &nbsp; msgLen := len(msg)&nbsp; &nbsp; step := public.Size() - 2*hash.Size() - 2&nbsp; &nbsp; var encryptedBytes []byte&nbsp; &nbsp; for start := 0; start < msgLen; start += step {&nbsp; &nbsp; &nbsp; &nbsp; finish := start + step&nbsp; &nbsp; &nbsp; &nbsp; if finish > msgLen {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; finish = msgLen&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; encryptedBlockBytes, err := rsa.EncryptOAEP(hash, random, public, msg[start:finish], label)&nbsp; &nbsp; &nbsp; &nbsp; if err != nil {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return nil, err&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; encryptedBytes = append(encryptedBytes, encryptedBlockBytes...)&nbsp; &nbsp; }&nbsp; &nbsp; return encryptedBytes, nil}func DecryptOAEP(hash hash.Hash, random io.Reader, private *rsa.PrivateKey, msg []byte, label []byte) ([]byte, error) {&nbsp; &nbsp; msgLen := len(msg)&nbsp; &nbsp; step := private.PublicKey.Size()&nbsp; &nbsp; var decryptedBytes []byte&nbsp; &nbsp; for start := 0; start < msgLen; start += step {&nbsp; &nbsp; &nbsp; &nbsp; finish := start + step&nbsp; &nbsp; &nbsp; &nbsp; if finish > msgLen {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; finish = msgLen&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; decryptedBlockBytes, err := rsa.DecryptOAEP(hash, random, private, msg[start:finish], label)&nbsp; &nbsp; &nbsp; &nbsp; if err != nil {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return nil, err&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; decryptedBytes = append(decryptedBytes, decryptedBlockBytes...)&nbsp; &nbsp; }&nbsp; &nbsp; return decryptedBytes, nil}

Answer 2

也许您生成私钥的方式不正确。我通过参考here解决了同样的问题生成密钥的步骤ssh-keygen -t rsa -b 4096 -m PEM -f jwtRS256.key# Don't add passphraseopenssl rsa -in jwtRS256.key -pubout -outform PEM -out jwtRS256.key.pubcat jwtRS256.keycat jwtRS256.key.pub使用 jwt-go 使用它的步骤package mainimport (&nbsp; &nbsp; "fmt"&nbsp; &nbsp; "github.com/dgrijalva/jwt-go"&nbsp; &nbsp; "io/ioutil"&nbsp; &nbsp; "time")func panicOnError(err error) {&nbsp; &nbsp; if err != nil {&nbsp; &nbsp; &nbsp; &nbsp; panic(err)&nbsp; &nbsp; }}func main() {&nbsp; &nbsp; signBytes, err := ioutil.ReadFile("./jwtRS256.key")&nbsp; &nbsp; panicOnError(err)&nbsp; &nbsp; signKey, err := jwt.ParseRSAPrivateKeyFromPEM(signBytes)&nbsp; &nbsp; panicOnError(err)&nbsp; &nbsp; verifyBytes, err := ioutil.ReadFile("./jwtRS256.key.pub")&nbsp; &nbsp; panicOnError(err)&nbsp; &nbsp; verifyKey, err := jwt.ParseRSAPublicKeyFromPEM(verifyBytes)&nbsp; &nbsp; panicOnError(err)&nbsp; &nbsp; claims := jwt.MapClaims{&nbsp; &nbsp; &nbsp; &nbsp; "exp": time.Now().Add(time.Minute).Unix(),&nbsp; &nbsp; }&nbsp; &nbsp; fmt.Println(claims)&nbsp; &nbsp; t := jwt.NewWithClaims(jwt.SigningMethodRS256, claims)&nbsp; &nbsp; tokenString, err := t.SignedString(signKey)&nbsp; &nbsp; panicOnError(err)&nbsp; &nbsp; fmt.Println(tokenString)&nbsp; &nbsp; token, err := jwt.Parse(tokenString, func(token *jwt.Token) (interface{}, error) {&nbsp; &nbsp; &nbsp; &nbsp; return verifyKey, nil&nbsp; &nbsp; })&nbsp; &nbsp; panicOnError(err)&nbsp; &nbsp; fmt.Println(token.Claims)}