lcobucci/jwt · error · Lcobucci\JWT\Signer\InvalidKeyProvided

Key provided is shorter than

Error message

Key provided is shorter than {expectedLength} bits, only {actualLength} bits provided

What it means

Thrown by Rsa::guardAgainstIncompatibleKey when the RSA key's bit length is below MINIMUM_KEY_LENGTH (the library's floor for secure RSA, commonly 384/512 bits depending on version). Short RSA keys are rejected to prevent trivially weak signatures.

Solutions

1. Generate a new RSA key of at least 2048 bits: `openssl genrsa -out private.pem 2048`
2. Derive the matching public key: `openssl rsa -in private.pem -pubout -out public.pem`
3. Check the deployed key's size: `openssl rsa -in private.pem -noout -text | head -1`
4. If you must keep the old key, confirm the library version's MINIMUM_KEY_LENGTH and rotate anyway (short keys are insecure)

Example fix

// before
$ openssl genrsa -out private.pem 512
// after
$ openssl genrsa -out private.pem 2048

$details = openssl_pkey_get_details(openssl_pkey_get_private(file_get_contents($pem))); if ($details['bits'] < 2048) { throw new RuntimeException('RSA key too short: ' . $details['bits'] . ' bits'); }

try { $signature = $signer->sign($payload, $key); } catch (\Jose\Component\Signature\Exception\InvalidKeyProvided $e) { /* weak key length; rotate key */ }

When it happens

Trigger: Signing or verifying with an RSA key shorter than the configured minimum (e.g. a 512- or 1024-bit test key when the minimum is higher), loaded via RsaSha256::create()->sign() with InMemory::file()/plainText PEM.

Common situations: Legacy keys generated long ago at 1024 bits, quick test keys generated with tiny sizes, library upgrades raising the minimum length, keys generated with `openssl genrsa 512`.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

• Key provided is shorter than
• Key provided is shorter than
• The length of the provided key is different than
• There was an error while creating the signature
• The type of the provided key is not

AI-assisted analysis of lcobucci/jwt@375813049c (2026-09-14). Data as JSON: /api/errors/e79841107c16c572. Report an issue: GitHub.

Appendix: source

Thrown at src/Signer/Rsa.php:32

        return $this->createSignature($key, $payload);
    }

    final public function verify(string $expected, string $payload, Key $key): bool
    {
        return $this->verifySignature($expected, $payload, $key);
    }

    final protected function guardAgainstIncompatibleKey(int $type, int $lengthInBits): void
    {
        if ($type !== OPENSSL_KEYTYPE_RSA) {
            throw InvalidKeyProvided::incompatibleKeyType(
                self::KEY_TYPE_MAP[OPENSSL_KEYTYPE_RSA],
                self::KEY_TYPE_MAP[$type] ?? 'unknown',
            );
        }

        if ($lengthInBits < self::MINIMUM_KEY_LENGTH) {
            throw InvalidKeyProvided::tooShort(self::MINIMUM_KEY_LENGTH, $lengthInBits);
        }
    }
}

View on GitHub (pinned to 375813049c)