Which key algorithms are available?

[justinmchase]

Here the docs just have it as a string:
https://doc.deno.land/deno/stable/~/Algorithm

interface Algorithm {
  name: string;
}

But I can't seem to figure out what string goes there.

I'm trying to create a jwt for a github App following these docs:
https://docs.github.com/en/developers/apps/building-github-apps/authenticating-with-github-apps#generating-a-private-key

I have the private key github gave me locally and this is my code:

const keyAlgorithm = "???"
const key = await Deno.readFile('key')
const pk = await crypto.subtle.importKey(
  "raw",
  key,
  { name: keyAlgorithm, hash: "SHA-256" },
  true,
  ["sign", "verify"]
)

But I can't seem to figure out the right value for keyAlgorithm. It sure would be nice if this value in the type was perhaps an enum or enumerated the known valid strings at least, if thats possible?

[justinmchase]

I think its supposed to be { name: "RSA-PSS", hash: "SHA-256" } but I'm getting a Not imlemented error which seems unlikely to me.

[justinmchase]

If I do { name: "HMAC", hash: "SHA-256" } that seems to import the key but then later when I use it to create the jwt:

const jwt = await create(
  {
    alg: "RS256",
    typ: "JWT"
  },
  {
    // issued at time, 60 seconds in the past to allow for clock drift
    iat: now - 60,

    // JWT expiration time (1 year maximum)
    exp: now + (60 * 60 * 24 * 365),

    // GitHub App's identifier
    iss: "265"
  },
  pk
);

It throw an error Error: The jwt's alg 'RS256' does not match the key's algorithm.

If I try to use RS256 in the key algorithm name it throws Unrecognized algorithm name, if I use HMAC for both, it creates the JWT but the jwt is invalid.

[littledivy]

You're looking for https://doc.deno.land/deno/stable/~/RsaHashedImportParams

If you read Github docs carefully it's a PEM-encoded PKCS#1 RSAPrivateKey. First, You need to convert it to pkcs8:

openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in private-key.pem -out private-key-pkcs8.pem

Then extract the DER encoded material out of the PEM and pass it to WebCrypto:

const keyFile = await Deno.readTextFile('private-key-pkcs8.pem');

const pemHeader = "-----BEGIN PRIVATE KEY-----";
const pemFooter = "-----END PRIVATE KEY-----";
const pemContents = keyFile.substring(
  pemHeader.length,
  keyFile.length - pemFooter.length,
);
const binaryDerString = atob(pemContents);
const binaryDer = new Uint8Array(binaryDerString.length);
for (let i = 0; i < binaryDerString.length; i++) {
  binaryDer[i] = binaryDerString.charCodeAt(i);
 }
const pk = await crypto.subtle.importKey(
  "pkcs8",
  binaryDer,
  { name: "RSA-PSS", hash: "SHA-256" },
  true,
  ["sign", "verify"]
);

Related:

• https://github.com/octokit/auth-app.js/
• https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey/

[justinmchase]

I had to tweak it a bit and I think there's probably a way to use the TextDecoder instead of atob and charCodeAt but it did cut a JWT for me:

const file = await Deno.readTextFile("key.pem")
const lines = file.split('\n')
const content = lines.slice(1, lines.length - 2).join('')

const binaryDerString = atob(content);
const binaryDer = new Uint8Array(binaryDerString.length);
for (let i = 0; i < binaryDerString.length; i++) {
  binaryDer[i] = binaryDerString.charCodeAt(i);
}

const pk = await crypto.subtle.importKey(
  "pkcs8",
  binaryDer,
  { name: "RSA-PSS", hash: "SHA-256" },
  true,
  ["sign"]
)

const now = new Date().valueOf() / 1000
const jwt = await create(
  {
    alg: "PS256",
    typ: "JWT"
  },
  {
    // issued at time, 60 seconds in the past to allow for clock drift
    iat: now - 60,

    // JWT expiration time (1 year maximum)
    exp: now + (60 * 60 * 24 * 365),

    // GitHub App's identifier
    iss: "265"
  },
  pk
);

console.log(jwt)

Unfortunately its not working... its now giving me 400 instead of 401 errors for the same operation though, not sure if its configuration of the server itself though or not now. Very little information. Thank you though, I would have never figured out the openssl command.

[justinmchase]

Turns out its both simpler and harder than we thought!

Someone already has a solution:
https://deno.land/x/github_app_auth@v0.1.2

Its entirely possible the solution you provided works but it turns out that its only used to call the githubapi from which you can create then create a new access_token which you then can use to do the git operations... the github docs are defintely not clear on those points.