"ECDH with the provided key is not allowed or not supported by your javascript runtime"

[y3k00000]

Using Node.js v20.2.0

Generated the keys with

const { privateKey, publicKey } = await jose.generateKeyPair("ES256K", {
        crv: "secp256k1"
    });

And the Exception shows when Doing a "GeneralEncrypt"

    const generalEncypted = await new GeneralEncrypt(message)
    .setProtectedHeader({ enc: 'A256GCM' })
    .addRecipient(publicKey)
    .setUnprotectedHeader({ alg: 'ECDH-ES' })
    .encrypt();

I got the alg/enc list from OpenID Page

What may be missing to use ec-keys to do the general encrypt？I found that RSA works but EC is prefered for security requirement.

[panva]

secp256k1 was not registered by any specification to be used for ECDH. You can use secp256k1 for ECDSA using the ES256K JWS Algorithm Identifier but that's all you can do with this curve in JOSE.

I'd say it would be better to use X25519

const { privateKey, publicKey } = await jose.generateKeyPair("ECDH-ES", {
  crv: "X25519"
});

Or if you insist on EC, P-256, P-384, and P-521 curves are usable for ECDH too.

[y3k00000]

@panva Thanks, I'll be looking into it.

[y3k00000]

@panva I tried to use X25519 private in JWT signing.

    const { privateKey, publicKey } = await jose.generateKeyPair("ECDH-ES", {
        crv: "X25519",
        extractable: true,
    });

    const jwt = await new jose.SignJWT({
        sub: "1234567890",
        name: "John Doe",
        iat: now,
    }).setProtectedHeader({ alg: "Ed25519" })
        .setIssuedAt()
        .setExpirationTime(now + 600)
        .sign(privateKey);

I've tried many values on signing alg like "ECDSA", "ECDH-ES", "ES256", but it turns out no luck. How can I do the signature with a X25519 key or where can I get a reference for this? Thanks.

(Plus I've read This Post)

[panva]

You shouldn't and can't use the same key for ECDH and signing. X25519 is for ECDH and e.g. Ed25519 is for signing.

[y3k00000]

@panva I see.... So it seems I misunderstood the usage of these thing. Thanks again for the reply.