向Azure Key Vault导入仅公钥椭圆曲线密钥失败问题排查

问题现象 #

导入包含私钥（D、X、Y字段）的EC密钥到Azure Key Vault时请求成功，但仅提交公钥（X、Y字段）时，返回错误：

EC key is not valid - cannot instantiate crypto service.

成功请求示例（含私钥） #

PUT https://XXX.vault.azure.net/keys/f851dad4-3a02-4039-90fa-6aed47fa06f0?api-version=7.4 HTTP/1.1
Host: XXX.vault.azure.net
Authorization: Bearer XXX
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 274

{"kid":"f851dad4-3a02-4039-90fa-6aed47fa06f0","key":{"kid":"f851dad4-3a02-4039-90fa-6aed47fa06f0","kty":"EC","crv":"P-256","d":"Wjdwwdd2dnf9QT6KqXsexBSs0DEbnKsfj0vW3fNkvJo","x":"U4h1986Oy6ARYQxIBU3JRGIuHA_GhWcPT1zwYAaG9Rg","y":"8_-7MQY-fiY2UvBcgnNtSqrs1AeoNxXvo-21mn8dKJs"}}

失败请求示例（仅公钥） #

PUT https://XXX.vault.azure.net/keys/f851dad4-3a02-4039-90fa-6aed47fa06f9?api-version=7.4 HTTP/1.1
Host: XXX.vault.azure.net
Authorization: Bearer XXX
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 224

{"kid":"f851dad4-3a02-4039-90fa-6aed47fa06f9","key":{"kid":"f851dad4-3a02-4039-90fa-6aed47fa06f9","kty":"EC","crv":"P-256","x":"U4h1986Oy6ARYQxIBU3JRGIuHA_GhWcPT1zwYAaG9Rg","y":"8_-7MQY-fiY2UvBcgnNtSqrs1AeoNxXvo-21mn8dKJs"}}

失败响应 #

HTTP/1.1 400 Bad Request
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 102
Content-Type: application/json; charset=utf-8
Expires: -1
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000;includeSubDomains
Date: Thu, 27 Jul 2023 13:34:44 GMT

{"error":{"code":"BadParameter","message":"EC key is not valid - cannot instantiate crypto service."}}

解决方法 #

Azure Key Vault导入纯公钥时，必须明确指定密钥支持的操作（key_ops字段）——纯公钥无法执行签名、解密等私钥操作，仅能完成验证、加密等公钥操作，未指定操作时服务无法实例化加密服务。

修改后的请求需添加key_ops数组，示例如下（根据实际需求调整操作类型，如["verify", "encrypt"]）：

PUT https://XXX.vault.azure.net/keys/f851dad4-3a02-4039-90fa-6aed47fa06f9?api-version=7.4 HTTP/1.1
Host: XXX.vault.azure.net
Authorization: Bearer XXX
Accept-Encoding: gzip, deflate
Content-Type: application/json
Content-Length: 256

{"kid":"f851dad4-3a02-4039-90fa-6aed47fa06f9","key":{"kid":"f851dad4-3a02-4039-90fa-6aed47fa06f9","kty":"EC","crv":"P-256","x":"U4h1986Oy6ARYQxIBU3JRGIuHA_GhWcPT1zwYAaG9Rg","y":"8_-7MQY-fiY2UvBcgnNtSqrs1AeoNxXvo-21mn8dKJs","key_ops":["verify"]}}

补充说明 #

• 导入含私钥的密钥时，Azure Key Vault会自动推断支持的全量操作，无需手动指定key_ops。
• key_ops的可选值遵循JWK规范，针对EC公钥，常用值包括verify（验证签名）、encrypt（加密）。

内容的提问来源于stack exchange，提问作者Curt