{"record":{"id":"2c2efd75b5c54ed1","repo":"eclipse-vertx/vert.x","slug":"jwk-doesn-t-contain-pubkey-material","errorCode":null,"errorMessage":"JWK doesn't contain pubKey material","messagePattern":"JWK doesn't contain pubKey material","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/internal/digest/DigitalSigningAlgorithm.java","lineNumber":125,"sourceCode":"      throw new IllegalStateException(\"JWK doesn't contain secKey material\");\n    }\n    Signature signature;\n    try {\n      signature = signatureFactory.call();\n    } catch (Exception e) {\n      throw new GeneralSecurityException(e);\n    }\n    return payload -> {\n      signature.initSign(privateKey);\n      signature.update(payload);\n      return signature.sign();\n    };\n  }\n\n  @Override\n  public Verifier verifier() throws GeneralSecurityException {\n    if (publicKey == null) {\n      throw new IllegalStateException(\"JWK doesn't contain pubKey material\");\n    }\n    Signature sig;\n    try {\n      sig = signatureFactory.call();\n    } catch (Exception e) {\n      throw new GeneralSecurityException(e);\n    }\n    return (signature, payload) -> {\n      sig.initVerify(publicKey);\n      sig.update(payload);\n      if (signature.length < length) {\n        // need to adapt the expectation to make the RSA? engine happy\n        byte[] normalized = new byte[length];\n        System.arraycopy(signature, 0, normalized, 0, signature.length);\n        return sig.verify(normalized);\n      } else {\n        return sig.verify(signature);\n      }","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/internal/digest/DigitalSigningAlgorithm.java#L107-L143","documentation":"DigitalSigningAlgorithm.verifier() throws IllegalStateException when the JWK lacks public key material (publicKey == null), since signature verification requires the public key. A private-key-only JWK cannot verify signatures.","triggerScenarios":"Creating a signing algorithm from a JWK with only private key material (or an oct/secret key used with an asymmetric algorithm) and calling verifier(); a JWK where the public fields (n/e, x/y) were never populated.","commonSituations":"Storing only private keys in config and expecting verification to work; constructing the JWK from a PrivateKey without deriving the public part; wrong key type for the algorithm (HMAC key used with RS256).","solutions":["Populate the JWK's public key (derive from the private key or load from JWKS/certificate)","Use signer() instead of verifier() if you meant to sign","For HMAC-style algorithms use a Mac-based signing algorithm, not the digital (asymmetric) one"],"exampleFix":"// before\nJWK jwk = JWK.fromPrivateKey(privKey); alg.verifier(); // fails\n// after\nPublicKey pub = derivePublicKey(privKey);\nJWK jwk = JWK.from(privKey, pub);\nVerifier v = alg.verifier();","handlingStrategy":"validation","validationCode":"if (jwk.publicKey() == null) throw new IllegalStateException(\"JWK must contain public key material to verify\");","typeGuard":null,"tryCatchPattern":"try { verifier = alg.verifier(); } catch (IllegalStateException e) { // public key missing: load JWKS }","preventionTips":["Load verification keys from the JWKS endpoint or derive the public part from private keys","Never rely on a private-key-only JWK for verification","Validate that key type matches the algorithm (asymmetric keys for RS/ES, secret for HS)"],"tags":["jwk","jwt","missing-key","illegal-state"],"backgroundTag":"missing-credentials","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}