{"record":{"id":"a2b9a26ccb8e9f84","repo":"lcobucci/jwt","slug":"invalid-signature-length","errorCode":null,"errorMessage":"Invalid signature length.","messagePattern":"Invalid signature length\\.","errorType":"exception","errorClass":"Lcobucci\\JWT\\Signer\\Ecdsa\\ConversionFailed","httpStatus":null,"severity":"error","filePath":"src/Signer/Ecdsa/MultibyteStringConverter.php","lineNumber":49,"sourceCode":" *\n * @internal\n */\nfinal readonly class MultibyteStringConverter implements SignatureConverter\n{\n    private const string ASN1_SEQUENCE          = '30';\n    private const string ASN1_INTEGER           = '02';\n    private const int ASN1_MAX_SINGLE_BYTE      = 128;\n    private const string ASN1_LENGTH_2BYTES     = '81';\n    private const string ASN1_BIG_INTEGER_LIMIT = '7f';\n    private const string ASN1_NEGATIVE_INTEGER  = '00';\n    private const int BYTE_SIZE                 = 2;\n\n    public function toAsn1(string $points, int $length): string\n    {\n        $points = bin2hex($points);\n\n        if (self::octetLength($points) !== $length) {\n            throw ConversionFailed::invalidLength();\n        }\n\n        $pointR = self::preparePositiveInteger(substr($points, 0, $length));\n        $pointS = self::preparePositiveInteger(substr($points, $length, null));\n\n        $lengthR = self::octetLength($pointR);\n        $lengthS = self::octetLength($pointS);\n\n        $totalLength  = $lengthR + $lengthS + self::BYTE_SIZE + self::BYTE_SIZE;\n        $lengthPrefix = $totalLength > self::ASN1_MAX_SINGLE_BYTE ? self::ASN1_LENGTH_2BYTES : '';\n\n        $asn1 = hex2bin(\n            self::ASN1_SEQUENCE\n            . $lengthPrefix . dechex($totalLength)\n            . self::ASN1_INTEGER . dechex($lengthR) . $pointR\n            . self::ASN1_INTEGER . dechex($lengthS) . $pointS,\n        );\n        assert(is_string($asn1));","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Signer/Ecdsa/MultibyteStringConverter.php#L31-L67","documentation":"Thrown by MultibyteStringConverter::toAsn1 when the concatenated ECDSA signature points (R and S) do not have exactly the expected byte length for the curve (e.g. 32 bytes for P-256, 48 for P-384). The library requires a fixed-width pair of hex-encoded points before wrapping them in an ASN.1 DER sequence; any shorter or longer input is rejected to avoid producing a malformed signature.","triggerScenarios":"Calling toAsn1() with a $points string whose octet length differs from the $length argument, typically because the raw signature was produced on a different curve or the binary signature was re-encoded (e.g. hex/base64 round trip mishandled, leading zero bytes stripped or padding added).","commonSituations":"Migrating between curve sizes (P-256 vs P-384), decoding a signature with base64_decode returning padded/corrupted data, or passing a hex string instead of raw binary bytes.","solutions":["Verify the raw $points string is exactly 2x the curve's coordinate length in bytes before calling toAsn1","Ensure you are using the same curve for signing and for ASN.1 conversion","Confirm the input is raw binary, not hex or base64 encoded","Regenerate the signature if it was produced with a mismatched key/curve"],"exampleFix":"// before\n$asn1 = $converter->toAsn1($base64Signature, 32);\n// after\n$raw = base64_decode($base64Signature, true);\nassert(strlen($raw) === 64);\n$asn1 = $converter->toAsn1($raw, 32);","handlingStrategy":"validation","validationCode":"if (strlen($points) !== 2 * $length) { throw new InvalidArgumentException('Signature must be ' . (2 * $length) . ' bytes'); }","typeGuard":null,"tryCatchPattern":"try { $asn1 = $converter->toAsn1($points, 32); } catch (\\Jose\\Component\\Signature\\Exception\\ConversionFailed $e) { /* handle bad signature length */ }","preventionTips":["Always carry signatures as raw binary; decode base64 once, exactly","Pin the curve and compute lengths from it, never hardcode per call site","Add a length assertion before ASN.1 conversion"],"tags":["ecdsa","signature","asn1","encoding"],"backgroundTag":"invalid-argument-format","analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}