[anakinj]

Description

Refs #786.

RFC 8812, section 3.1 registers the JWK crv value for secp256k1 as "secp256k1". JWT::JWK::EC.to_openssl_curve only recognised "P-256K", an earlier draft name, so standard secp256k1 JWKs raised JWT::JWKError: Invalid curve provided from verify_key, private? and export. One example is the EC key in the Connect2id demo JWKS. ES256K tokens couldn't be verified against such keys.

This accepts both names when importing. An imported JWK keeps the curve name it was given, so "secp256k1" stays "secp256k1" when exported.

This PR doesn't change export. Keys generated from an OpenSSL::PKey::EC are still exported with crv: "P-256K", because switching to "secp256k1" would change exported JWKs and their thumbprints. That's left in #786 for a minor release.

Specs cover the curve mapping, importing a private "secp256k1" JWK and exporting it unchanged, and verifying an ES256K token against a public JWKS that uses the registered name. Without the fix, all three fail. I also tried the real Connect2id JWKS: its secp256k1 key now resolves, and the whole set exports.

Checklist

Before the PR can be merged be sure the following are checked:

• There are tests for the fix or feature added/changed
• A description of the changes and a reference to the PR has been added to CHANGELOG.md. More details in the CONTRIBUTING.md

Posted by Claude on behalf of @anakinj.

[Copilot]

🟢 Approval recommended

No active review issues are reported for the EC JWK curve-name compatibility change.

No open issues 🎉

What changed in this PR

Adds support for the RFC 8812 secp256k1 curve name when importing EC JWKs, enabling ES256K verification with standards-compliant keys while preserving compatibility with P-256K.

Changes:

• Accepts both curve names without changing export behavior.
• Adds tests for curve mapping, private-key import and export preservation, and token verification through a public JWKS.
• Documents the compatibility fix in the changelog.

File	Description
spec/​jwt/​jwk/​ec_spec.rb	Tests the registered curve name and ES256K verification.
lib/​jwt/​jwk/​ec.rb	Maps both accepted JWK curve names to OpenSSL’s secp256k1.
CHANGELOG.md	Records support for importing the registered curve name.

_{Review effort: Balanced}