Method prepare_key

jwt/algorithms.py:641–672

(self, key: AllowedECKeys | str | bytes)

                )

        def prepare_key(self, key: AllowedECKeys | str | bytes) -> AllowedECKeys:
            if isinstance(key, self._crypto_key_types):
                # See note in RSAAlgorithm.prepare_key.
                ec_key = cast(AllowedECKeys, key)  # type: ignore[redundant-cast,unused-ignore]
                self._validate_curve(ec_key)
                return ec_key

            if not isinstance(key, (bytes, str)):
                raise TypeError("Expecting a PEM-formatted key.")

            key_bytes = force_bytes(key)

            # Attempt to load key. We don't know if it's
            # a Signing Key or a Verifying Key, so we try
            # the Verifying Key first.
            try:
                if key_bytes.startswith(b"ecdsa-sha2-"):
                    public_key: PublicKeyTypes = load_ssh_public_key(key_bytes)
                else:
                    public_key = load_pem_public_key(key_bytes)

                # Explicit check the key to prevent confusing errors from cryptography
                self.check_crypto_key_type(public_key)
                ec_public_key = cast(EllipticCurvePublicKey, public_key)
                self._validate_curve(ec_public_key)
                return ec_public_key
            except ValueError:
                private_key = load_pem_private_key(key_bytes, password=None)
                self.check_crypto_key_type(private_key)
                ec_private_key = cast(EllipticCurvePrivateKey, private_key)
                self._validate_curve(ec_private_key)
                return ec_private_key

        def sign(self, msg: bytes, key: EllipticCurvePrivateKey) -> bytes:
            der_sig = key.sign(msg, ECDSA(self.hash_alg()))