jwtk/jjwt · error · MalformedKeyException

${e.getMessage()}

Error message

${e.getMessage()}

What it means

Wraps any exception raised while copying the 'oth' element map entries into a JwkContext, or (via the later required reads in applyFrom) while extracting the required r/t/d BigInteger parameters, rethrowing it as a MalformedKeyException. The message is the underlying exception's message.

Source

Thrown at impl/src/main/java/io/jsonwebtoken/impl/security/RSAOtherPrimeInfoConverter.java:73

        if (!(o instanceof Map)) {
            String msg = "RSA JWK 'oth' (Other Prime Info) must contain map elements of name/value pairs. " +
                    "Element type found: " + o.getClass().getName();
            throw new MalformedKeyException(msg);
        }
        Map<?, ?> m = (Map<?, ?>) o;
        if (Collections.isEmpty(m)) {
            throw new MalformedKeyException("RSA JWK 'oth' (Other Prime Info) element map cannot be empty.");
        }

        // Need a Context instance to satisfy the API contract of the reader.get* methods below.
        JwkContext<?> ctx = new DefaultJwkContext<>(PARAMS);
        try {
            for (Map.Entry<?, ?> entry : m.entrySet()) {
                String name = String.valueOf(entry.getKey());
                ctx.put(name, entry.getValue());
            }
        } catch (Exception e) {
            throw new MalformedKeyException(e.getMessage(), e);
        }

        ParameterReadable reader = new RequiredParameterReader(ctx);
        BigInteger prime = reader.get(PRIME_FACTOR);
        BigInteger primeExponent = reader.get(FACTOR_CRT_EXPONENT);
        BigInteger crtCoefficient = reader.get(FACTOR_CRT_COEFFICIENT);

        return new RSAOtherPrimeInfo(prime, primeExponent, crtCoefficient);
    }
}

View on GitHub (pinned to fb71496164)

Solutions

1. Inspect the cause exception message; ensure each 'oth' element has r, t, and d as Base64URL-encoded unsigned integers.
2. Validate the JWK with an external JWK validator before feeding it to jjwt.
3. Regenerate or re-export the multi-prime RSA key with complete CRT parameters.

Example fix

// before
{"r":"..."} // missing t and d
// after
{"r":"...","t":"...","d":"..."} // all Base64URL-encoded

boolean othComplete = othElements.stream().allMatch(m -> m instanceof Map && ((Map<?,?>) m).keySet().containsAll(Arrays.asList("r","t","d")));

try { /* build JWK from oth */ } catch (MalformedKeyException e) { inspectCause(e); throw new IllegalArgumentException("Bad 'oth' parameters: " + e.getMessage(), e); }

When it happens

Trigger: Parsing an 'oth' element whose values are not usable as the required PRIME_FACTOR, FACTOR_CRT_EXPONENT, and FACTOR_CRT_COEFFICIENT parameters (e.g. missing r/t/d keys, or non-Base64URL/non-numeric values) during JWK parsing.

Common situations: JWKs with renamed or missing r/t/d fields; values encoded in standard Base64 instead of Base64URL; decoding failures on corrupted parameter strings.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• RSA JWK 'oth' (Other Prime Info) must contain map elements o
• RSA JWK 'oth' (Other Prime Info) element map cannot be empty
• Unable to create JWK: ${iae.getMessage()}
• RSA JWK 'oth' (Other Prime Info) element cannot be null.
• ${String.format(PUB_EXPONENT_EX_MSG, KeysBridge.toString(key

AI-assisted analysis of jwtk/jjwt@fb71496164 (2026-09-09). Data as JSON: /api/errors/0cf56ab73c8c7a75. Report an issue: GitHub.