[CXF-8402] JwkUtils::fromECPublicKey returns key coordinates without leading zero

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.4.3
• Estimated Complexity: Unknown
• Assignee: Colm O hEigeartaigh
• Reporter: Dimitri Witkowski
• Created: 06/Jan/21 13:22
• Updated: 22/Dec/21 20:43
• Resolved: 12/Jan/21 08:35

Description

Hi!

JwkUtils::fromECPublicKey returns key coordinates without leading zeroes because it's using BigInteger.toByteArray(), which returns only necessary bytes to encode a big integer value, here: https://github.com/apache/cxf/blob/master/rt/rs/security/jose-parent/jose/src/main/java/org/apache/cxf/rs/security/jose/jwk/JwkUtils.java#L378

This causes issues in different libraries, almost everywhere leading zeroes are expected to be present so that coordinate length is not changed depending on data.

Issue Links

• links to: GitHub Pull Request #739