JWKRSA -> JWKRSA.load is not RSA

[doka380]

Hi colleagues,

with the code below, while I'm expecting josepy.jwk.JWKRSA and key kty RSA, I'm getting

Generating new key ...
Key generated account_key=JWKRSA(key=<ComparableRSAKey(<cryptography.hazmat.bindings._rust.openssl.rsa.RSAPrivateKey object at 0x7e1790a5acb0>)>)

Loaded as: <class 'josepy.jwk.JWKOct'>
Key kty: oct

the code (Python 3.13.7, josepy==2.2.0)

import json
import josepy as jose
from cryptography.hazmat.primitives.asymmetric import rsa

print("Generating new key ...")
private_key = rsa.generate_private_key(
    public_exponent=65537,
    key_size=2048
)
account_key = jose.JWKRSA(key=private_key)
print(f"Key generated {account_key=}\n")

key_components = account_key.to_json()

restored_account_key = jose.JWKRSA.load(json.dumps(key_components).encode())
print(f"Loaded as: {type(restored_account_key)}")
print(f"Key kty: {restored_account_key.to_json().get('kty', 'unknown')}")

Is this bug or I'm missing / misinterpreting something?

Thank you

[doka380]

Small addition - the same result with from acme import jose (with acme==5.2.2)

Thank you

[ohemorange]

jose.JWKRSA.load() takes a "Public or private key serialized as PEM or DER." json.dumps(key_components).encode() does not encode as a PEM or DER, it's a JWK encoded string. The loader can't read this format, so it's defaulting to JWKOct.

If you would like to see an example of how to dump as a PEM, see: https://github.com/certbot/josepy/blob/main/examples/pem_conversion.py