{"record":{"id":"eceb3ea947bf6d33","repo":"jwtk/jjwt","slug":"the-specified-eckey-curve-does-not-match-a-jwa-sta","errorCode":null,"errorMessage":"The specified ECKey curve does not match a JWA standard curve id.","messagePattern":"The specified ECKey curve does not match a JWA standard curve id\\.","errorType":"exception","errorClass":"io.jsonwebtoken.security.InvalidKeyException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/EcPublicJwkFactory.java","lineNumber":62,"sourceCode":"    protected static String keyContainsErrorMessage(String curveId) {\n        Assert.hasText(curveId, \"curveId cannot be null or empty.\");\n        String fmt = \"ECPublicKey's ECPoint does not exist on elliptic curve '%s' \" +\n                \"and may not be used to create '%s' JWKs.\";\n        return String.format(fmt, curveId, curveId);\n    }\n\n    protected static String jwkContainsErrorMessage(String curveId, Map<String, ?> jwk) {\n        Assert.hasText(curveId, \"curveId cannot be null or empty.\");\n        String fmt = \"EC JWK x,y coordinates do not exist on elliptic curve '%s'. This \" +\n                \"could be due simply to an incorrectly-created JWK or possibly an attempted Invalid Curve Attack \" +\n                \"(see https://safecurves.cr.yp.to/twist.html for more information).\";\n        return String.format(fmt, curveId, jwk);\n    }\n\n    protected static String getJwaIdByCurve(EllipticCurve curve) {\n        ECCurve c = ECCurve.findByJcaCurve(curve);\n        if (c == null) {\n            throw new InvalidKeyException(UNSUPPORTED_CURVE_MSG);\n        }\n        return c.getId();\n    }\n\n    @Override\n    protected EcPublicJwk createJwkFromKey(JwkContext<ECPublicKey> ctx) {\n\n        ECPublicKey key = ctx.getKey();\n\n        ECParameterSpec spec = key.getParams();\n        EllipticCurve curve = spec.getCurve();\n        ECPoint point = key.getW();\n\n        String curveId = getJwaIdByCurve(curve);\n        if (!ECCurve.contains(curve, point)) {\n            String msg = keyContainsErrorMessage(curveId);\n            throw new InvalidKeyException(msg);\n        }","sourceCodeStart":44,"sourceCodeEnd":80,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/EcPublicJwkFactory.java#L44-L80","documentation":"getJwaIdByCurve maps a JCA EllipticCurve to a standard JWA curve id (P-256, P-384, P-521). If ECCurve.findByJcaCurve finds no match, the curve is not one of the RFC 7518 standard curves, and the factory throws this InvalidKeyException because a crv value cannot be determined.","triggerScenarios":"Creating an EC JWK from a key on a non-standard curve (e.g. secp256k1, brainpool curves) via Jwks.builder().setKey(ecPublicKey) or parsing an EC key with custom ECParameterSpec.","commonSituations":"Using secp256k1 (Bitcoin) keys, elliptic curves from custom providers, or keys generated with explicit field parameters instead of a named standard curve.","solutions":["Generate EC keys on a JWA standard curve: new ECGenParameterSpec(\"secp256r1\") (or secp384r1, secp521r1).","If the key is on secp256k1 or another non-JWA curve, it cannot be used in JWK/JWT; obtain a key on a standard curve.","Convert custom ECParameterSpec keys to a named standard curve via KeyFactory translation if the parameters match a standard curve.","Check key.getParams().getCurve() against known P-256/P-384/P-521 curves before building the JWK."],"exampleFix":"// before\nKeyPairGenerator kg = KeyPairGenerator.getInstance(\"EC\");\nkg.initialize(new ECGenParameterSpec(\"secp256k1\"));\n// after\nKeyPairGenerator kg = KeyPairGenerator.getInstance(\"EC\");\nkg.initialize(new ECGenParameterSpec(\"secp256r1\"));\nKeyPair kp = kg.generateKeyPair();","handlingStrategy":"validation","validationCode":"java.security.interfaces.ECPublicKey k = (java.security.interfaces.ECPublicKey) key;\nint fieldSize = k.getParams().getCurve().getField().getFieldSize();\nif (fieldSize != 256 && fieldSize != 384 && fieldSize != 521) {\n    throw new IllegalArgumentException(\"Curve is not a JWA standard curve (P-256/P-384/P-521)\");\n}","typeGuard":"boolean isStandardCurve(java.security.interfaces.ECPublicKey k) {\n    int s = k.getParams().getCurve().getField().getFieldSize();\n    return s == 256 || s == 384 || s == 521;\n}","tryCatchPattern":"try {\n    Jwk<?> jwk = Jwks.builder().setKey(ecKey).build();\n} catch (io.jsonwebtoken.security.InvalidKeyException e) {\n    // use a key on a standard curve\n}","preventionTips":["Use secp256r1/secp384r1/secp521r1 only","Avoid secp256k1 and brainpool curves in JWT contexts","Prefer named-curve ECGenParameterSpec over raw parameter specs"],"tags":["java","jjwt","ec","jwk","unsupported-curve"],"backgroundTag":"unsupported-enum-value","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}