fix(oidc): reject non-P-256 ECDSA keys instead of publishing a corrupt JWK

PublicJWK's doc comment claimed only P-256 keys are accepted, but the
code accepted any *ecdsa.PublicKey and unconditionally hardcoded
Crv: "P-256" / Alg: "ES256" in the output. A misconfigured wrong-curve
key (e.g. P-384) would be published through /.well-known/jwks.json as
a mislabeled P-256 JWK with actually-longer coordinates, and the real
failure would only surface later at the KMS signing call, far from
the misconfiguration's cause.

Check ecPub.Curve against elliptic.P256() and return an explicit error
immediately in PublicJWK, and in the AWS KMS / GCP KMS signers'
resolveOnce so a wrong-curve key fails fast with a clear message at
key resolution instead of producing a corrupt public JWKS. (Azure Key
Vault's resolveOnce already forces P-256 when parsing the raw point,
so it needed no change.)

Adds regression tests generating a P-384 key and asserting each path
returns an error; verified failing pre-fix and passing post-fix.

Author: cristim

internal/oidc/aws_signer.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto"
 	"crypto/ecdsa"
+	"crypto/elliptic"
 	"crypto/x509"
 	"fmt"
 	"sync"
@@ -99,6 +100,10 @@ func (s *AWSKMSSigner) resolveOnce(ctx context.Context) {
 			s.err = fmt.Errorf("oidc: kms key is not ECDSA (got %T); key must be ECC_NIST_P256", pub)
 			return
 		}
+		if ecPub.Curve != elliptic.P256() {
+			s.err = fmt.Errorf("oidc: kms key curve is %s; key must be ECC_NIST_P256 (ES256)", ecPub.Curve.Params().Name)
+			return
+		}
 		kid, err := ComputeKeyID(ecPub)
 		if err != nil {
 			s.err = err

internal/oidc/aws_signer_test.go

@@ -75,3 +75,21 @@ func TestAWSKMSSignerRoundTrip(t *testing.T) {
 	// convert it to the RFC 7518 raw R||S form before Mint encodes it.
 	assertRawES256JWS(t, jws, ecPub)
 }
+
+// TestAWSKMSSignerRejectsWrongCurve guards against a misconfigured KMS
+// key (e.g. ECC_NIST_P384 instead of the required ECC_NIST_P256) being
+// accepted silently. resolveOnce must fail fast with a clear error
+// instead of caching a wrong-curve public key that only breaks later
+// at JWKS-publish or signing time.
+func TestAWSKMSSignerRejectsWrongCurve(t *testing.T) {
+	ctx := context.Background()
+	key, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
+	if err != nil {
+		t.Fatalf("gen p384 key: %v", err)
+	}
+	signer := NewAWSKMSSignerFromClient(&fakeKMSClient{key: key}, "alias/wrong-curve")
+
+	if _, err := signer.PublicKey(ctx); err == nil {
+		t.Fatal("PublicKey accepted a P-384 KMS key; want an error rejecting the wrong curve")
+	}
+}

internal/oidc/backend_jws_test.go

@@ -72,6 +72,24 @@ func TestGCPKMSSignerEmitsRawES256(t *testing.T) {
 	assertRawES256JWS(t, jws, &key.PublicKey)
 }
 
+// TestGCPKMSSignerRejectsWrongCurve guards against a misconfigured KMS
+// key (e.g. EC_SIGN_P384_SHA384 instead of the required
+// EC_SIGN_P256_SHA256) being accepted silently. resolveOnce must fail
+// fast instead of caching a wrong-curve public key.
+func TestGCPKMSSignerRejectsWrongCurve(t *testing.T) {
+	ctx := context.Background()
+	key, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
+	if err != nil {
+		t.Fatalf("gen p384 key: %v", err)
+	}
+	signer := NewGCPKMSSignerFromClient(&fakeGCPKMSClient{key: key},
+		"projects/p/locations/global/keyRings/r/cryptoKeys/k/cryptoKeyVersions/1")
+
+	if _, err := signer.PublicKey(ctx); err == nil {
+		t.Fatal("PublicKey accepted a P-384 KMS key; want an error rejecting the wrong curve")
+	}
+}
+
 // --- Azure: raw R||S path ---
 
 type fakeAzureKVClient struct {

internal/oidc/gcp_signer.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto"
 	"crypto/ecdsa"
+	"crypto/elliptic"
 	"crypto/x509"
 	"encoding/pem"
 	"fmt"
@@ -125,6 +126,10 @@ func (s *GCPKMSSigner) resolveOnce(ctx context.Context) {
 			s.err = fmt.Errorf("oidc: gcp kms key is not ECDSA (got %T); key must be EC_SIGN_P256_SHA256", pub)
 			return
 		}
+		if ecPub.Curve != elliptic.P256() {
+			s.err = fmt.Errorf("oidc: gcp kms key curve is %s; key must be EC_SIGN_P256_SHA256 (ES256)", ecPub.Curve.Params().Name)
+			return
+		}
 		kid, err := ComputeKeyID(ecPub)
 		if err != nil {
 			s.err = err

internal/oidc/jwks.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"crypto"
 	"crypto/ecdsa"
+	"crypto/elliptic"
 	"encoding/base64"
 	"fmt"
 )
@@ -38,6 +39,14 @@ func PublicJWK(pub crypto.PublicKey, kid string) (JWK, error) {
 	if !ok || ecPub == nil {
 		return JWK{}, fmt.Errorf("oidc: PublicJWK requires *ecdsa.PublicKey, got %T", pub)
 	}
+	// Fail loud on a wrong-curve key instead of publishing a corrupt JWK:
+	// the Crv/Alg fields below are hardcoded to "P-256"/ES256, so a
+	// misconfigured P-384 (or other) key would otherwise be mislabeled
+	// as P-256 with coordinates of the wrong length, and only surface as
+	// a KMS signing failure far from the actual misconfiguration.
+	if ecPub.Curve != elliptic.P256() {
+		return JWK{}, fmt.Errorf("oidc: PublicJWK requires a P-256 key (ES256), got curve %s", ecPub.Curve.Params().Name)
+	}
 	byteLen := (ecPub.Curve.Params().BitSize + 7) / 8
 	// Derive the fixed-width, already left-padded coordinates from the
 	// uncompressed SEC 1 point (0x04 || X || Y) via crypto/ecdh, matching

internal/oidc/signer_test.go

@@ -3,6 +3,8 @@ package oidc
 import (
 	"context"
 	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/rand"
 	"crypto/sha256"
 	"encoding/base64"
 	"encoding/json"
@@ -157,6 +159,23 @@ func TestBuildJWKS(t *testing.T) {
 	// RSA fields are structurally absent from the EC JWK type.
 }
 
+// TestPublicJWKRejectsWrongCurve guards against a misconfigured
+// non-P-256 KMS/Key Vault key (e.g. P-384) silently producing a
+// corrupt JWK: pre-fix, PublicJWK hardcoded Crv/Alg to "P-256"/ES256
+// regardless of ecPub.Curve, so a P-384 key would be published as a
+// mislabeled P-256 JWK with 48-byte (not 32-byte) coordinates, and the
+// misconfiguration would only surface later as an opaque KMS signing
+// failure. Post-fix, PublicJWK must reject it immediately.
+func TestPublicJWKRejectsWrongCurve(t *testing.T) {
+	key, err := ecdsa.GenerateKey(elliptic.P384(), rand.Reader)
+	if err != nil {
+		t.Fatalf("gen p384 key: %v", err)
+	}
+	if _, err := PublicJWK(&key.PublicKey, "some-kid"); err == nil {
+		t.Fatal("PublicJWK accepted a P-384 key; want an error rejecting the wrong curve")
+	}
+}
+
 func TestBuildDiscovery(t *testing.T) {
 	d := BuildDiscovery("https://cudly.example.com")
 	if d.Issuer != "https://cudly.example.com" {