Windows RSAPrivateKey (MSCAPI)

Hi,

im loading a RSAPrivateKey on Windows with the following code:

KeyStore ks = KeyStore.getInstance("Windows-MY");
ks.load(null, null);
RSAPrivateKey privateKey = ks.getKey("someKeyAlias", null);

But then i get the following exception:

Exception in thread "main" java.lang.IllegalArgumentException: RSA signatures must be computed using an RSAPrivateKey.  
The specified key of type sun.security.mscapi.RSAPrivateKey is not an RSAPrivateKey.
    at io.jsonwebtoken.impl.crypto.RsaSigner.<init>(RsaSigner.java:34)
    at io.jsonwebtoken.impl.crypto.DefaultSignerFactory.createSigner(DefaultSignerFactory.java:43)
    at io.jsonwebtoken.impl.crypto.DefaultJwtSigner.<init>(DefaultJwtSigner.java:37)
    at io.jsonwebtoken.impl.crypto.DefaultJwtSigner.<init>(DefaultJwtSigner.java:32)
    at io.jsonwebtoken.impl.DefaultJwtBuilder.createSigner(DefaultJwtBuilder.java:339)
    at io.jsonwebtoken.impl.DefaultJwtBuilder.compact(DefaultJwtBuilder.java:321)

Any idea why this is not compatible?

[oddbjornkvalsund]

For others coming here with the same problem, I solved this by subclassing io.jsonwebtoken.impl.DefaultJwtBuilder and supplying my own io.jsonwebtoken.impl.crypto.Signer:

final DefaultJwtBuilder jwtBuilder = new DefaultJwtBuilder() {
    @Override
    protected JwtSigner createSigner(SignatureAlgorithm alg, Key key) {
        final SignerFactory signerFactory = new DefaultSignerFactory() {
            @Override
            public Signer createSigner(SignatureAlgorithm alg, Key key) {
                return bytes -> {
                    try {
                        final Signature sig = Signature.getInstance(alg.getJcaName());
                        sig.initSign((PrivateKey) key);
                        sig.update(bytes);
                        logger.info("Signed data of length {} with key: {}", bytes.length, key);
                        return sig.sign();
                    } catch (Exception e) {
                        throw new RuntimeException("Unable to sign JWT!", e);
                    }
                };
            }
        };
        return new DefaultJwtSigner(signerFactory, alg, key);
    }
};

This instance of DefaultJwtBuilder can then be used instead of Jwts.builder(). The passed-in key in my case is an instance of sun.security.mscapi.RSAPrivateKey.

Example use:

final String signedJwt = jwtBuilder
                .setClaims(claims)
                .setIssuer(myIssuer)
                .setAudience(myAudience)
                .setExpiration(new Date(System.currentTimeMillis() + 60_000))
                .signWith(SignatureAlgorithm.RS256, mySunMSCAPIKey)
                .compact();

Works like a charm in my case, but YMMV.

[Ulterior]

Works like a charm in my case too. This needs to go to getting started section for externally stored keys - HSM