Keys from webpush-java not compatible

[Tree4Free]

The keys that I used with the https://github.com/web-push-libs/webpush-java library cannot be used to create a VapidKey object.

Exception in thread "main" java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: IOException: DerInputStream.getLength(): lengthTag=28, too big.
	at jdk.crypto.ec/sun.security.ec.ECKeyFactory.engineGeneratePublic(ECKeyFactory.java:158)
	at java.base/java.security.KeyFactory.generatePublic(KeyFactory.java:351)
	at com.interaso.webpush.CryptoKt.generatePublicKeyFromX509(Crypto.kt:81)
	at com.interaso.webpush.VapidKeys$Factory.create(VapidKeys.kt:58)
	at com.example.MainClazz.main(MainClazz.kt:47)
	at com.example.MainClazz.main(MainClazz.kt)
Caused by: java.security.InvalidKeyException: IOException: DerInputStream.getLength(): lengthTag=28, too big.
	at java.base/sun.security.x509.X509Key.decode(X509Key.java:397)
	at java.base/sun.security.x509.X509Key.decode(X509Key.java:402)
	at jdk.crypto.ec/sun.security.ec.ECPublicKeyImpl.<init>(ECPublicKeyImpl.java:74)
	at jdk.crypto.ec/sun.security.ec.ECKeyFactory.implGeneratePublic(ECKeyFactory.java:225)
	at jdk.crypto.ec/sun.security.ec.ECKeyFactory.engineGeneratePublic(ECKeyFactory.java:154)
	... 5 more

For reference I created a new key pair using the following page: https://www.attheminute.com/vapid-key-generator
I am not sure if my keys were originally created with such a page but the format and length of the keys looks similar to mine.

These are the example keys I tried:

val public = "BJwwFRoDoOx2vQPfvbeo-m1fZZHo6lIjtyTlWHjLNSCtHuWdGryZD5xt0LeawVQq7G60ioID1sC33fEoQT8jCzg"
val private = "P5GjTLppISlmUyNiZqZi0HNq7GXFniAdcBECNsKBxfI"

It would be great if there was a way to migrate to this library and keep using my keys like maybe converting them into a format that this library can use. Otherwise all users would have to re-enable the webpush subscription.

[morki]

Hi @Tree4Free, thanks for your feedback.

I analyzed your keys and code from webpush-java and added factory method to load keys in compatible format.

You can use it like this:

// Create from Base64 encoded strings of uncompressed bytes
val vapidKeys = VapidKeys.fromUncompressedBytes(
    publicKey = "BJwwFRoDoOx2vQPfvbeo-m1f...",
    privateKey = "P5GjTLppISlmUyNiZqZi..."
)

I also updated README with this example, updated test to use your testing keys and added a little tip into README:

Tip

For using same VAPID keys format when migrating from webpush-java library,
use VapidKeys.fromUncompressedBytes() factory function.

Please can you test with snapshot version? For using snapshots, please see README of this project.

If everything will be good for you, I can then release v1.1.0 with these changes into Maven Central.

[Tree4Free]

Hi thanks for the quick response!
I gave it a quick test run:

• Creating the VapidKeys object with the new factory method works without throwing an exception
• Sending a notification to a subscription that was created with the keys from the webpush-java library also works

So from my perspective everything works like a charm with the changes introduced in the snapshot version.
Thanks again for the quick help.

[boerpb]

This would be a very welcome addition, since I was just running into the exact same problem.
Will verify later today as well, since we are dealing with quite a unique Java stack on our end.

[morki]

I just released version v1.1.0 with this change into Maven Central, so I will close this as resolved now.

If any of you encounter any other issues, please leave a comment, and I will reopen and investigate.

[boerpb]

All seems to work fine on this end 🚀
Thank you for the quick addition of this feature!