Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

[BUG] Failure importing EC-HSM Keypair into a HSM Keyvault

See original GitHub issue

Describe the bug Some inconsistency in the SDK leads to the impossibility to import an existing SECP256K1 Keypair in a HSM-enabled Azure Keyvault, due to :

an EC-HSM JsonWebKey can not hold a private key (code proving it is next)
inconsistency when checking the validity of a JsonWebKey – the isValid() method returns true but the call to the HSM results in a 400 error code, key must be valid.

Exception or Stack Trace Add the exception log and stack trace if available 1

JSON WEB KEY:is valid? false

JSON WEB KEY:is valid? true
com.microsoft.azure.keyvault.models.KeyVaultErrorException: Status code 400, {"error":{"code":"BadParameter","message":"The property \"key\" must be a valid JsonWebKey object."}}`

To Reproduce Use the following :

<dependency>
			<groupId>com.microsoft.azure</groupId>
			<artifactId>azure-keyvault</artifactId>
			<version>1.2.1</version>
		</dependency>
		<dependency>
			<groupId>com.microsoft.azure</groupId>
			<artifactId>azure-keyvault-cryptography</artifactId>
			<version>1.2.1</version>
		</dependency>
		<dependency>
			<groupId>com.microsoft.azure</groupId>
			<artifactId>azure-keyvault-extensions</artifactId>
			<version>1.2.1</version>
		</dependency>
		<dependency>
			<groupId>com.microsoft.azure</groupId>
			<artifactId>azure-keyvault-core</artifactId>
			<version>1.2.1</version>
		</dependency>
		<dependency>
			<groupId>com.microsoft.azure</groupId>
			<artifactId>azure-keyvault-webkey</artifactId>
			<version>1.2.1</version>
		</dependency>

Generate an Ethereum Keypair (secp256k1 curve) and try to add it to an HSM-enabled Keyvault as EC-HSM keys using this SDK.

Code Snippet 1.


Security.addProvider(new BouncyCastleProvider());
        ECNamedCurveParameterSpec spec = ECNamedCurveTable.getParameterSpec("secp256k1");
        ECDomainParameters domain = new ECDomainParameters(spec.getCurve(), spec.getG(), spec.getN());
        ECPublicKeyParameters publicKeyParams = new ECPublicKeyParameters(spec.getCurve().decodePoint(prefixedPubKey),
                domain);
        ECPrivateKeyParameters privateKeyParams = new ECPrivateKeyParameters(keypair.getPrivateKey(), domain);

JsonWebKey jwk = new JsonWebKey().withKty(JsonWebKeyType.EC_HSM).withCrv(new JsonWebKeyCurveName("SECP256K1"))
                .withX(publicKeyParams.getQ().getAffineXCoord().getEncoded())
                .withY(publicKeyParams.getQ().getAffineYCoord().getEncoded())
                .withD(privateKeyParams.getD().toByteArray()).withKeyOps(keyOps);

        LOG.debug("JSON WEB KEY:is valid? {}", jwk.isValid());

        if (!jwk.isValid()) {
            LOG.error("!! INVALID KEY !!");
            return null;
        }

I adapted the fromEC() method of the JsonWebKey class because I wanted to use EC-HSM as kty instead of EC. result shows !! INVALID KEY !! which is strange, how to import a Key that could sign without the private key? (and no way to recover the private key from the public key of course)

        Security.addProvider(new BouncyCastleProvider());
        ECNamedCurveParameterSpec spec = ECNamedCurveTable.getParameterSpec("secp256k1");
        ECDomainParameters domain = new ECDomainParameters(spec.getCurve(), spec.getG(), spec.getN());
        ECPublicKeyParameters publicKeyParams = new ECPublicKeyParameters(spec.getCurve().decodePoint(prefixedPubKey),
                domain);
        ECPrivateKeyParameters privateKeyParams = new ECPrivateKeyParameters(keypair.getPrivateKey(), domain);

        JsonWebKey jwk = new JsonWebKey().withKty(JsonWebKeyType.EC_HSM).withCrv(new JsonWebKeyCurveName("SECP256K1"))
                .withX(publicKeyParams.getQ().getAffineXCoord().getEncoded())
                .withY(publicKeyParams.getQ().getAffineYCoord().getEncoded())
                // .withD(privateKeyParams.getD().toByteArray())
                .withKeyOps(keyOps);

        LOG.debug("JSON WEB KEY:is valid? {}", jwk.isValid());

        if (!jwk.isValid()) {
            LOG.error("!! INVALID KEY !!");
            return null;
        }

        Builder builder = new Builder(URL_BASE, keyName, jwk).withHsm(true)
                .withAttributes(new KeyAttributes().withEnabled(true));

        this.client.importKey(builder.build());

Only the privateKey addition that is commented out. Strange that after that, the validity check passes but not when calling the Keyvault…

JSON WEB KEY:is valid? true
com.microsoft.azure.keyvault.models.KeyVaultErrorException: Status code 400, {"error":{"code":"BadParameter","message":"The property \"key\" must be a valid JsonWebKey object."}}`

Expected behavior I would have expected to be able to add the keypair (private + public) into the HSM.

Setup (please complete the following information):

OS: Ubuntu 16.04 LTS
IDE : Visual Studio Code
Version : 1.2.1

Additional context None

Information Checklist Kindly make sure that you have added all the following information above and checkoff the required fields otherwise we will treat the issuer as an incomplete report