{"record":{"id":"865c2e514ad6ccaa","repo":"jwtk/jjwt","slug":"rsassa-pss-keys-may-not-be-used-for-keytype-on","errorCode":null,"errorMessage":"RSASSA-PSS keys may not be used for ${keyType}, only digital signature algorithms.","messagePattern":"RSASSA-PSS keys may not be used for (.+?), only digital signature algorithms\\.","errorType":"exception","errorClass":"io.jsonwebtoken.security.InvalidKeyException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/DefaultRsaKeyAlgorithm.java","lineNumber":66,"sourceCode":"    public DefaultRsaKeyAlgorithm(String id, String jcaTransformationString, AlgorithmParameterSpec spec) {\n        super(id, jcaTransformationString);\n        this.SPEC = spec; //can be null\n    }\n\n    private static String keyType(boolean encryption) {\n        return encryption ? \"encryption\" : \"decryption\";\n    }\n\n    protected void validate(Key key, boolean encryption) { // true = encryption, false = decryption\n\n        if (!RsaSignatureAlgorithm.isRsaAlgorithmName(key)) {\n            throw new InvalidKeyException(\"Invalid RSA key algorithm name.\");\n        }\n\n        if (RsaSignatureAlgorithm.isPss(key)) {\n            String msg = \"RSASSA-PSS keys may not be used for \" + keyType(encryption) +\n                    \", only digital signature algorithms.\";\n            throw new InvalidKeyException(msg);\n        }\n\n        int size = KeysBridge.findBitLength(key);\n        if (size < 0) return; // can't validate size: material or length not available (e.g. PKCS11 or HSM)\n        if (size < MIN_KEY_BIT_LENGTH) {\n            String id = getId();\n            String section = id.startsWith(\"RSA1\") ? \"4.2\" : \"4.3\";\n            String msg = \"The RSA \" + keyType(encryption) + \" key size (aka modulus bit length) is \" + size +\n                    \" bits which is not secure enough for the \" + id + \" algorithm. \" +\n                    \"The JWT JWA Specification (RFC 7518, Section \" + section + \") states that RSA keys MUST \" +\n                    \"have a size >= \" + MIN_KEY_BIT_LENGTH + \" bits. See \" +\n                    \"https://www.rfc-editor.org/rfc/rfc7518.html#section-\" + section + \" for more information.\";\n            throw new WeakKeyException(msg);\n        }\n    }\n\n    @Override\n    public KeyResult getEncryptionKey(final KeyRequest<PublicKey> request) throws SecurityException {","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/DefaultRsaKeyAlgorithm.java#L48-L84","documentation":"RSASSA-PSS keys (algorithm name 'RSASSA-PSS' / 'PSS') may only be used for digital signature algorithms, not for key-management (encryption) algorithms. DefaultRsaKeyAlgorithm.validate explicitly rejects them when used with RSA-OAEP or RSA1_5 because JWA forbids PSS keys in key-encryption roles.","triggerScenarios":"Calling encryptWith(pssKeyPair.getPublic(), Jwts.KEY.RSA_OAEP) or the corresponding decryption with a PSS private key; keyType in the message is 'encryption' or 'decryption' depending on direction.","commonSituations":"Reusing the same RSA key pair for both JWS signing (PS256) and JWE encryption; keys generated with algorithm 'RSASSA-PSS' rather than 'RSA'.","solutions":["Use a key pair generated with KeyPairGenerator.getInstance(\"RSA\") for encryption/decryption, not \"RSASSA-PSS\".","Keep separate key pairs: a PSS pair for PS256 signatures and an RSA pair for JWE key management.","Switch the JWE algorithm to a signature-appropriate flow if you actually intended signing."],"exampleFix":"// before\nKeyPairGenerator kg = KeyPairGenerator.getInstance(\"RSASSA-PSS\");\nJwts.builder().encryptWith(kp.getPublic(), Jwts.KEY.RSA_OAEP)...\n// after\nKeyPairGenerator kg = KeyPairGenerator.getInstance(\"RSA\");\nkg.initialize(2048);\nKeyPair kp = kg.generateKeyPair();\nJwts.builder().encryptWith(kp.getPublic(), Jwts.KEY.RSA_OAEP)...","handlingStrategy":"validation","validationCode":"if (\"RSASSA-PSS\".equalsIgnoreCase(key.getAlgorithm()) || \"PSS\".equalsIgnoreCase(key.getAlgorithm())) {\n    throw new IllegalArgumentException(\"PSS keys are signature-only; use a plain RSA key for JWE encryption\");\n}","typeGuard":"boolean isPlainRsa(Key k) { return k instanceof java.security.interfaces.RSAKey && \"RSA\".equalsIgnoreCase(k.getAlgorithm()); }","tryCatchPattern":"try {\n    jwt = Jwts.builder().encryptWith(pub, Jwts.KEY.RSA_OAEP)...compact();\n} catch (io.jsonwebtoken.security.InvalidKeyException e) {\n    // fall back to a plain-RSA key pair\n}","preventionTips":["Generate JWE key pairs with KeyPairGenerator.getInstance(\"RSA\") not \"RSASSA-PSS\"","Maintain distinct PSS signing and RSA encryption key pairs"],"tags":["java","jjwt","rsa-pss","jwe","invalid-key"],"backgroundTag":"invalid-key-algorithm","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}