Lua Requires Chilkat v9.5.0.66+

JWE using AES Key Wrap and AES_128_CBC_HMAC_SHA_256

See more JSON Web Encryption (JWE) Examples

This example duplicates the example A.3 in RFC 7516 for JSON Web Encryption (JWE). Lua

local chilkat = require("chilkat")

-- This requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.

local plaintext = "Live long and prosper."

local jwe = chilkat.Jwe.new()

-- First build the JWE Protected Header: {"alg":"A128KW","enc":"A128CBC-HS256"}
local jweProtHdr = chilkat.JsonObject.new()
jweProtHdr:append_string("alg", "A128KW")
jweProtHdr:append_string("enc", "A128CBC-HS256")
jwe:set_protected_header(jweProtHdr)

print("JWE Protected Header: " .. jweProtHdr:emit())
print("--")

-- The example A.3 in RFC 7516 uses the following 128-bit AES key,
-- specified in JWK (JSON Web Key) format:
--      {"kty":"oct",
--       "k":"GawgguFyGrWKav7AX4VKUg"
--      }
-- This is just a way of saying: The key type ("kty") is
-- a bunch of octets ("k") in base64url encoding.
-- We can simply set the AES wrapping key like this:
local aesWrappingKey = "GawgguFyGrWKav7AX4VKUg"
jwe:set_wrapping_key(0, aesWrappingKey, "base64url")

-- Encrypt and return the JWE:
local strJwe = jwe:encrypt(plaintext, "utf-8")
if not jwe.last_method_success then
    print(jwe.last_error_text)
    return
end

-- Show the JWE we just created:
print(strJwe)

-- Decrypt the JWE that was just produced.
-- 1) Load the JWE.
-- 2) Set the AES wrapping key.
-- 3) Decrypt.
local jwe2 = chilkat.Jwe.new()
local success = jwe2:load_jwe(strJwe)
if not success then
    print(jwe2.last_error_text)
    return
end

-- Set the AES wrap key.
jwe2:set_wrapping_key(0, aesWrappingKey, "base64url")

-- Decrypt.
local originalPlaintext = jwe2:decrypt(0, "utf-8")
if not jwe2.last_method_success then
    print(jwe2.last_error_text)
    return
end

print("original text: ")
print(originalPlaintext)

-- ---------------------------------------------------------------------------------
-- It should also be possible to decrypt the JWE as shown in RFC 7516, Appendix A.3.7
-- because it was produced using the same AES Wrap key.

local sbJwe = chilkat.StringBuilder.new()
sbJwe:append("eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0.")
sbJwe:append("6KB707dM9YTIgHtLvtgWQ8mKwboJW3of9locizkDTHzBC2IlrT1oOQ.")
sbJwe:append("AxY8DCtDaGlsbGljb3RoZQ.")
sbJwe:append("KDlTtXchhZTGufMYmOYGS4HffxPSUrfmqCHXaI9wOGY.")
sbJwe:append("U0m_YmjN04DJvceFICbCVQ")

success = jwe2:load_jwe_sb(sbJwe)
if not success then
    print(jwe2.last_error_text)
    return
end

jwe2:set_wrapping_key(0, aesWrappingKey, "base64url")

-- Decrypt.
originalPlaintext = jwe2:decrypt(0, "utf-8")
if not jwe2.last_method_success then
    print(jwe2.last_error_text)
    return
end

print(originalPlaintext)