JwkEC uses non-standard signature format

[andreblanke]

Environment Details

• Helidon Version: 4.0.0-ALPHA6
• Helidon SE
• JDK version: OpenJDK Runtime Environment Temurin-20+36 (build 20+36)
• OS: Linux

---

Problem Description

The JwkEC class produces signatures using the SHA256withECDSA, SHA384withECDSA, and SHA512withECDSA algorithms which encode signatures in the ASN.1 DER format. This appears to violate RFC 7518 - JSON Web Algorithms (JWA) which states that a raw concatenation of the pair (R, S) should be used as encoding for the signature. Tokens produced by the current implementation will fail verification (unless the token consumer accepts the non-standard ASN.1 DER format for the signature).

Possibly relevant:

• Support for verifying tokens whose signature uses the standard format was introduced in commit 40934aa using changeSignatureEncodingToDER.
• For compliance with RFC 7518 it should be sufficient to populate JwkEC.ALG_MAP with SHA256withECDSAinP1363Format, SHA384withECDSAinP1363Format, and SHA512withECDSAinP1363Format instead. The changeSignatureEncodingToDER method could then be removed. This change would cause signature validation to fail for tokens signed with the current implementation.

Steps to reproduce

1. Build a Jwt and sign it using JwkEC
2. Pass SignedJwt.tokenContent() to an other JWT implementation (e.g., JOSE4j) for signature verification
3. The verification fails