How can I import an extractable JWK?

[treeder]

I can't do this for instance:

let publicKey2 = await jose.importJWK(clonedKey)
let publicKey3 = await jose.exportJWK(publicKey2)

[panva]

Please provide more substance to your question.

[panva]

An actual code that I can execute would be a great start.

[lonetis]

Stumbled upon the same issue. I guess it's because the importJWK function doesn't have an options parameter in which we can set PEMImportOptions that contains the extractable property which defaults to false. In the example, importX509 has the options parameter but importJWK not.

Related Code:

export interface PEMImportOptions {
    /**
     * (Only effective in Web Crypto API runtimes) The value to use as {@link !SubtleCrypto.importKey}
     * `extractable` argument. Default is false.
     */
    extractable?: boolean;
}

export declare function importX509<KeyLikeType extends KeyLike = KeyLike>(x509: string, alg: string, options?: PEMImportOptions): Promise<KeyLikeType>;

export declare function importJWK<KeyLikeType extends KeyLike = KeyLike>(jwk: JWK, alg?: string): Promise<KeyLikeType | Uint8Array>;

Poc:

import * as jose from 'jose';
const jwk = {
    "kty": "EC",
    "alg": "ES256",
    "crv": "P-256",
    "x": "mVAX_PXbDxWi9jvhuG5G5R5MyccUDNvlQ00C052VKIg",
    "y": "VM20umjb9m29NXJTmTAQ270kDuePulIv7ZYsQS2uQz4",
};
const key = await jose.importJWK(jwk)
console.log(key) // {type: 'public', extractable: false, algorithm: {…}, usages: Array(1)}
const key2 = await jose.exportJWK(key) // failure

[wparad]

Why does one need to export a JWK that they imported? What would that get you?

[lonetis]

For converting key formats. This library is using it to convert JWKs to PEM or COSE (but currently throws an error because of the exportable issue)

[lonetis]

I think it tries to import the JWK into jose and export it as PEM (but haven't looked into the code that deep)

[panva]

You can set the JWK's ext property to false. https://www.iana.org/assignments/jose/jose.xhtml#web-key-parameters

FWIW the next major version will default public key inputs to be true, and private ones to false when the explicit ext parameter is not present.

[lonetis]

Thanks! Didn't know about this one. I guess that answers this question.