jwk.EncodePEM, jwk.DecodePEM not reciprocal for ECDSA private keys

[mheggeseth]

Describe the bug

It is currently not possible to take the output of jwk.EncodePEM() and give it to jwk.ParseKey(key, jwk.WithPEM(true)) when the input to jwk.EncodePEM is a *ecdsa.PrivateKey.

This is because EncodeX509 uses ECDSA PRIVATE KEY as its PEM armor

jwx/jwk/jwk.go

Line 272 in defd35c

return "ECDSA PRIVATE KEY", marshaled, nil

and DecodePEM expects EC PRIVATE KEY

jwx/jwk/jwk.go

Line 331 in defd35c

case "EC PRIVATE KEY":

To Reproduce / Expected behavior

func TestECDSAPEM(t *testing.T) {
	// go make an EC key at https://mkjwk.org/
	key, err := jwk.ParseKey([]byte(`{
		"kty": "EC",
		"d": "zqYPTs5gMEwtidOqjlFJSk6L4BQSfhCJX6FTgbuuiE0",
		"crv": "P-256",
		"x": "AYwhwiE1hXWdfwu-HlBSsY5Chxycu-LyE6WsZ_w2DO4",
		"y": "zumemGclMFkimMsKMXlLdKYWtLle58e4N9hDPcN7lig"
	}`))
	if err != nil {
		t.Fatal(err)
	}
	pem, err := jwk.EncodePEM(key)
	if err != nil {
		t.Fatal(err)
	}
	_, err = jwk.ParseKey(pem, jwk.WithPEM(true))
	if err != nil {
		t.Fatal(err)
	}
}

[lestrrat]

That sounds like a case of me just being silly. Thanks for the heads up

[lestrrat]

@mheggeseth please take a look at #876, and use it for the time being. A new release will have to wait a bit as (1) I'd like to add a few more minor cleanups before merging, and (2) we usually hold off releasing fixes after a merge for at least a few days to make sure we didn't accidentally mess something up.