jwtk/jjwt · error · io.jsonwebtoken.security.InvalidKeyException

The specified ECKey curve does not match a JWA standard curv

Error message

The specified ECKey curve does not match a JWA standard curve id.

What it means

getJwaIdByCurve maps a JCA EllipticCurve to a standard JWA curve id (P-256, P-384, P-521). If ECCurve.findByJcaCurve finds no match, the curve is not one of the RFC 7518 standard curves, and the factory throws this InvalidKeyException because a crv value cannot be determined.

Source

Thrown at impl/src/main/java/io/jsonwebtoken/impl/security/EcPublicJwkFactory.java:62

    protected static String keyContainsErrorMessage(String curveId) {
        Assert.hasText(curveId, "curveId cannot be null or empty.");
        String fmt = "ECPublicKey's ECPoint does not exist on elliptic curve '%s' " +
                "and may not be used to create '%s' JWKs.";
        return String.format(fmt, curveId, curveId);
    }

    protected static String jwkContainsErrorMessage(String curveId, Map<String, ?> jwk) {
        Assert.hasText(curveId, "curveId cannot be null or empty.");
        String fmt = "EC JWK x,y coordinates do not exist on elliptic curve '%s'. This " +
                "could be due simply to an incorrectly-created JWK or possibly an attempted Invalid Curve Attack " +
                "(see https://safecurves.cr.yp.to/twist.html for more information).";
        return String.format(fmt, curveId, jwk);
    }

    protected static String getJwaIdByCurve(EllipticCurve curve) {
        ECCurve c = ECCurve.findByJcaCurve(curve);
        if (c == null) {
            throw new InvalidKeyException(UNSUPPORTED_CURVE_MSG);
        }
        return c.getId();
    }

    @Override
    protected EcPublicJwk createJwkFromKey(JwkContext<ECPublicKey> ctx) {

        ECPublicKey key = ctx.getKey();

        ECParameterSpec spec = key.getParams();
        EllipticCurve curve = spec.getCurve();
        ECPoint point = key.getW();

        String curveId = getJwaIdByCurve(curve);
        if (!ECCurve.contains(curve, point)) {
            String msg = keyContainsErrorMessage(curveId);
            throw new InvalidKeyException(msg);
        }

View on GitHub (pinned to fb71496164)

Solutions

1. Generate EC keys on a JWA standard curve: new ECGenParameterSpec("secp256r1") (or secp384r1, secp521r1).
2. If the key is on secp256k1 or another non-JWA curve, it cannot be used in JWK/JWT; obtain a key on a standard curve.
3. Convert custom ECParameterSpec keys to a named standard curve via KeyFactory translation if the parameters match a standard curve.
4. Check key.getParams().getCurve() against known P-256/P-384/P-521 curves before building the JWK.

Example fix

// before
KeyPairGenerator kg = KeyPairGenerator.getInstance("EC");
kg.initialize(new ECGenParameterSpec("secp256k1"));
// after
KeyPairGenerator kg = KeyPairGenerator.getInstance("EC");
kg.initialize(new ECGenParameterSpec("secp256r1"));
KeyPair kp = kg.generateKeyPair();

java.security.interfaces.ECPublicKey k = (java.security.interfaces.ECPublicKey) key;
int fieldSize = k.getParams().getCurve().getField().getFieldSize();
if (fieldSize != 256 && fieldSize != 384 && fieldSize != 521) {
    throw new IllegalArgumentException("Curve is not a JWA standard curve (P-256/P-384/P-521)");
}

boolean isStandardCurve(java.security.interfaces.ECPublicKey k) {
    int s = k.getParams().getCurve().getField().getFieldSize();
    return s == 256 || s == 384 || s == 521;
}

try {
    Jwk<?> jwk = Jwks.builder().setKey(ecKey).build();
} catch (io.jsonwebtoken.security.InvalidKeyException e) {
    // use a key on a standard curve
}

When it happens

Trigger: Creating an EC JWK from a key on a non-standard curve (e.g. secp256k1, brainpool curves) via Jwks.builder().setKey(ecPublicKey) or parsing an EC key with custom ECParameterSpec.

Common situations: Using secp256k1 (Bitcoin) keys, elliptic curves from custom providers, or keys generated with explicit field parameters instead of a named standard curve.

Related errors

• Unable to derive ECPublicKey from ECPrivateKey: ${e.getMessa
• ECPublicKey's ECPoint does not exist on elliptic curve '%s'
• EC JWK x,y coordinates do not exist on elliptic curve '%s'.
• Unrelated key operations are not allowed. KeyOperation [${in
• Either a Key instance or a kty value is required to create a

AI-assisted analysis of jwtk/jjwt@fb71496164 (2026-09-09). Data as JSON: /api/errors/eceb3ea947bf6d33. Report an issue: GitHub.