DataFlex
DataFlex
JWE using RSAES-OAEP and AES GCM
See more JSON Web Encryption (JWE) Examples
This example duplicates the example A.1 in RFC 7516 for JSON Web Encryption (JWE).Chilkat DataFlex Downloads
Use ChilkatAx-win32.pkg
Procedure Test
Boolean iSuccess
String sPlaintext
ProtHdr Handle hoJweProtHdr
Handle hoSbJwk
Variant vRsaPrivKey
Handle hoRsaPrivKey
Variant vRsaPubKey
Handle hoRsaPubKey
Handle hoJwe
String sStrJwe
2 Handle hoJwe2
String sOriginalPlaintext
Variant vSbJwe
Handle hoSbJwe
String sTemp1
Boolean bTemp1
Move False To iSuccess
// This requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.
// Note: This example requires Chilkat v9.5.0.66 or greater.
Move "The true sign of intelligence is not knowledge but imagination." To sPlaintext
// ---------------------------------
// A.1.1 JOSE Header
// First build the JWE Protected Header.
// We want to build this: {"alg":"RSA-OAEP","enc":"A256GCM"}
Get Create (RefClass(cComChilkatJsonObject)) To hoJweProtHdr
If (Not(IsComObjectCreated(hoJweProtHdr))) Begin
Send CreateComObject of hoJweProtHdr
End
Get ComAppendString Of hoJweProtHdr "alg" "RSA-OAEP" To iSuccess
Get ComAppendString Of hoJweProtHdr "enc" "A256GCM" To iSuccess
Get ComEmit Of hoJweProtHdr To sTemp1
Showln "JWE Protected Header: " sTemp1
Showln "--"
// ---------------------------------
// A.1.2 Content Encryption Key
// Note: Chilkat automatically generates the random CEK internally.
// The application does not need to explicitly take this step.
// ---------------------------------
// A.1.3. Key Encryption
// The application should load an RSA private key from any format.
// However, the application does not need to explicitly construct the JWE Encrypted Key.
// Chilkat automatically does it internally.
// The design of the Chilkat JWE API is to allow the application to create the JWE
// after specifying the inputs. (This is in contrast to forcing the application developer
// to painstakingly go through each step of the JWE construction process.)
// The specific RSA key used in the A.1 example is the following JWK:
Get Create (RefClass(cComChilkatStringBuilder)) To hoSbJwk
If (Not(IsComObjectCreated(hoSbJwk))) Begin
Send CreateComObject of hoSbJwk
End
Get ComAppend Of hoSbJwk '{"kty": "RSA",' To iSuccess
Get ComAppend Of hoSbJwk '"n": "oahUIoWw0K0usKNuOR6H4wkf4oBUXHTxRvgb48E-BVvxkeDNjbC4he8rUW' To iSuccess
Get ComAppend Of hoSbJwk "cJoZmds2h7M70imEVhRU5djINXtqllXI4DFqcI1DgjT9LewND8MW2Krf3S" To iSuccess
Get ComAppend Of hoSbJwk "psk_ZkoFnilakGygTwpZ3uesH-PFABNIUYpOiN15dsQRkgr0vEhxN92i2a" To iSuccess
Get ComAppend Of hoSbJwk "sbOenSZeyaxziK72UwxrrKoExv6kc5twXTq4h-QChLOln0_mtUZwfsRaMS" To iSuccess
Get ComAppend Of hoSbJwk "tPs6mS6XrgxnxbWhojf663tuEQueGC-FCMfra36C9knDFGzKsNa7LZK2dj" To iSuccess
Get ComAppend Of hoSbJwk 'YgyD3JR_MB_4NUJW_TqOQtwHYbxevoJArm-L5StowjzGy-_bq6Gw",' To iSuccess
Get ComAppend Of hoSbJwk '"e": "AQAB",' To iSuccess
Get ComAppend Of hoSbJwk '"d": "kLdtIj6GbDks_ApCSTYQtelcNttlKiOyPzMrXHeI-yk1F7-kpDxY4-WY5N' To iSuccess
Get ComAppend Of hoSbJwk "WV5KntaEeXS1j82E375xxhWMHXyvjYecPT9fpwR_M9gV8n9Hrh2anTpTD9" To iSuccess
Get ComAppend Of hoSbJwk "3Dt62ypW3yDsJzBnTnrYu1iwWRgBKrEYY46qAZIrA2xAwnm2X7uGR1hghk" To iSuccess
Get ComAppend Of hoSbJwk "qDp0Vqj3kbSCz1XyfCs6_LehBwtxHIyh8Ripy40p24moOAbgxVw3rxT_vl" To iSuccess
Get ComAppend Of hoSbJwk "t3UVe4WO3JkJOzlpUf-KTVI2Ptgm-dARxTEtE-id-4OJr0h-K-VFs3VSnd" To iSuccess
Get ComAppend Of hoSbJwk 'VTIznSxfyrj8ILL6MG_Uv8YAu7VILSB3lOW085-4qE3DzgrTjgyQ",' To iSuccess
Get ComAppend Of hoSbJwk '"p": "1r52Xk46c-LsfB5P442p7atdPUrxQSy4mti_tZI3Mgf2EuFVbUoDBvaRQ-' To iSuccess
Get ComAppend Of hoSbJwk "SWxkbkmoEzL7JXroSBjSrK3YIQgYdMgyAEPTPjXv_hI2_1eTSPVZfzL0lf" To iSuccess
Get ComAppend Of hoSbJwk 'fNn03IXqWF5MDFuoUYE0hzb2vhrlN_rKrbfDIwUbTrjjgieRbwC6Cl0",' To iSuccess
Get ComAppend Of hoSbJwk '"q": "wLb35x7hmQWZsWJmB_vle87ihgZ19S8lBEROLIsZG4ayZVe9Hi9gDVCOBm' To iSuccess
Get ComAppend Of hoSbJwk "UDdaDYVTSNx_8Fyw1YYa9XGrGnDew00J28cRUoeBB_jKI1oma0Orv1T9aX" To iSuccess
Get ComAppend Of hoSbJwk 'IWxKwd4gvxFImOWr3QRL9KEBRzk2RatUBnmDZJTIAfwTs0g68UZHvtc",' To iSuccess
Get ComAppend Of hoSbJwk '"dp": "ZK-YwE7diUh0qR1tR7w8WHtolDx3MZ_OTowiFvgfeQ3SiresXjm9gZ5KL' To iSuccess
Get ComAppend Of hoSbJwk "hMXvo-uz-KUJWDxS5pFQ_M0evdo1dKiRTjVw_x4NyqyXPM5nULPkcpU827" To iSuccess
Get ComAppend Of hoSbJwk 'rnpZzAJKpdhWAgqrXGKAECQH0Xt4taznjnd_zVpAmZZq60WPMBMfKcuE",' To iSuccess
Get ComAppend Of hoSbJwk '"dq": "Dq0gfgJ1DdFGXiLvQEZnuKEN0UUmsJBxkjydc3j4ZYdBiMRAy86x0vHCj' To iSuccess
Get ComAppend Of hoSbJwk "ywcMlYYg4yoC4YZa9hNVcsjqA3FeiL19rk8g6Qn29Tt0cj8qqyFpz9vNDB" To iSuccess
Get ComAppend Of hoSbJwk 'UfCAiJVeESOjJDZPYHdHY8v1b-o-Z2X5tvLx-TCekf7oxyeKDUqKWjis",' To iSuccess
Get ComAppend Of hoSbJwk '"qi": "VIMpMYbPf47dT1w_zDUXfPimsSegnMOA1zTaX7aGk_8urY6R8-ZW1FxU7' To iSuccess
Get ComAppend Of hoSbJwk "AlWAyLWybqq6t16VFd7hQd0y6flUK4SlOydB61gwanOsXGOAOv82cHq0E3" To iSuccess
Get ComAppend Of hoSbJwk 'eL4HrtZkUuKvnPrMnsUUFlfUdybVzxyjz9JF_XyaY14ardLSjf4L_FNY"}' To iSuccess
// Load this JWK into a Chilkat private key object.
Get Create (RefClass(cComChilkatPrivateKey)) To hoRsaPrivKey
If (Not(IsComObjectCreated(hoRsaPrivKey))) Begin
Send CreateComObject of hoRsaPrivKey
End
Get ComGetAsString Of hoSbJwk To sTemp1
Get ComLoadJwk Of hoRsaPrivKey sTemp1 To iSuccess
If (iSuccess = False) Begin
Get ComLastErrorText Of hoRsaPrivKey To sTemp1
Showln sTemp1
Procedure_Return
End
// The public key is used to encrypt (i.e. create the JWE),
// and the private key is used to decrypt.
// The RSA public key is simply a subset of the private key. The RSA public key
// is composed of the "n" and "e" members shown above. These are also known as the
// modulus and exponent.
// We can simply get the public key object from the private key object
Get Create (RefClass(cComChilkatPublicKey)) To hoRsaPubKey
If (Not(IsComObjectCreated(hoRsaPubKey))) Begin
Send CreateComObject of hoRsaPubKey
End
Get pvComObject of hoRsaPubKey to vRsaPubKey
Get ComToPublicKey Of hoRsaPrivKey vRsaPubKey To iSuccess
// ---------------------------------
// A.1.4. Initialization Vector
// Chilkat automatically generates the necessary random IV internally.
// The application does not need to do this explicitly.
// ---------------------------------
// A.1.5. Additional Authenticated Data
// The Additional Authenticated Data encryption parameter is
// ASCII(BASE64URL(UTF8(JWE Protected Header))).
// Again, Chilkat automatically takes care of this internally.
// The application does not need to explicitly take this step.
// ---------------------------------
// A.1.6. Content Encryption
// Again... this step is handled by Chilkat internally.
// ---------------------------------
// A.1.7. Complete Representation
// The application need only call the Encrypt, EncryptSb, or EncryptBd method
// return the fully assembled JWE.
// The final representation in the Compact Serialization
// is the string BASE64URL(UTF8(JWE Protected Header)) || '.' ||
// BASE64URL(JWE Encrypted Key) || '.' || BASE64URL(JWE Initialization
// Vector) || '.' || BASE64URL(JWE Ciphertext) || '.' || BASE64URL(JWE
// Authentication Tag).
Get Create (RefClass(cComChilkatJwe)) To hoJwe
If (Not(IsComObjectCreated(hoJwe))) Begin
Send CreateComObject of hoJwe
End
Get pvComObject of hoJweProtHdr to vJweProtHdr
Get ComSetProtectedHeader Of hoJwe vJweProtHdr To iSuccess
Get pvComObject of hoRsaPubKey to vRsaPubKey
Get ComSetPublicKey Of hoJwe 0 vRsaPubKey To iSuccess
Get ComEncrypt Of hoJwe sPlaintext "utf-8" To sStrJwe
Get ComLastMethodSuccess Of hoJwe To bTemp1
If (bTemp1 = False) Begin
Get ComLastErrorText Of hoJwe To sTemp1
Showln sTemp1
Procedure_Return
End
// Note: The RSA OAEP algorithm uses random padding bytes internally.
// Therefore, the results will appear different each time -- even if the
// identical plaintext is encrypted with the identical RSA key.
// (Do not expect the appearance of the results to be the same as what
// is published in the RFC. However, what is published in the RFC *should*
// be decryptable using the code that follows.)
Showln sStrJwe
// Let's decrypt the JWE that was just produced.
// Do the following to decrypt a JWE:
// 1) Load the JWE.
// 2) Set the private key for decryption.
// 3) Decrypt.
Get Create (RefClass(cComChilkatJwe)) To hoJwe2
If (Not(IsComObjectCreated(hoJwe2))) Begin
Send CreateComObject of hoJwe2
End
Get ComLoadJwe Of hoJwe2 sStrJwe To iSuccess
If (iSuccess = False) Begin
Get ComLastErrorText Of hoJwe2 To sTemp1
Showln sTemp1
Procedure_Return
End
// Provide the RSA private key for decryption.
// (The JWE was encrypted for a single recipient at index 0.)
Get pvComObject of hoRsaPrivKey to vRsaPrivKey
Get ComSetPrivateKey Of hoJwe2 0 vRsaPrivKey To iSuccess
// Decrypt.
Get ComDecrypt Of hoJwe2 0 "utf-8" To sOriginalPlaintext
Get ComLastMethodSuccess Of hoJwe2 To bTemp1
If (bTemp1 = False) Begin
Get ComLastErrorText Of hoJwe2 To sTemp1
Showln sTemp1
Procedure_Return
End
Showln "original text: "
Showln sOriginalPlaintext
// ---------------------------------------------------------------------------------
// It should also be possible to decrypt the JWE as shown in RFC 7516, Appendix A.1.7
// because it was produced using the same RSA key.
Get Create (RefClass(cComChilkatStringBuilder)) To hoSbJwe
If (Not(IsComObjectCreated(hoSbJwe))) Begin
Send CreateComObject of hoSbJwe
End
Get ComAppend Of hoSbJwe "eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZHQ00ifQ." To iSuccess
Get ComAppend Of hoSbJwe "OKOawDo13gRp2ojaHV7LFpZcgV7T6DVZKTyKOMTYUmKoTCVJRgckCL9kiMT03JGe" To iSuccess
Get ComAppend Of hoSbJwe "ipsEdY3mx_etLbbWSrFr05kLzcSr4qKAq7YN7e9jwQRb23nfa6c9d-StnImGyFDb" To iSuccess
Get ComAppend Of hoSbJwe "Sv04uVuxIp5Zms1gNxKKK2Da14B8S4rzVRltdYwam_lDp5XnZAYpQdb76FdIKLaV" To iSuccess
Get ComAppend Of hoSbJwe "mqgfwX7XWRxv2322i-vDxRfqNzo_tETKzpVLzfiwQyeyPGLBIO56YJ7eObdv0je8" To iSuccess
Get ComAppend Of hoSbJwe "1860ppamavo35UgoRdbYaBcoh9QcfylQr66oc6vFWXRcZ_ZT2LawVCWTIy3brGPi" To iSuccess
Get ComAppend Of hoSbJwe "6UklfCpIMfIjf7iGdXKHzg." To iSuccess
Get ComAppend Of hoSbJwe "48V1_ALb6US04U3b." To iSuccess
Get ComAppend Of hoSbJwe "5eym8TW_c8SuK0ltJ3rpYIzOeDQz7TALvtu6UG9oMo4vpzs9tX_EFShS8iB7j6ji" To iSuccess
Get ComAppend Of hoSbJwe "SdiwkIr3ajwQzaBtQD_A." To iSuccess
Get ComAppend Of hoSbJwe "XFBoMYUZodetZdvTiFvSkQ" To iSuccess
Get pvComObject of hoSbJwe to vSbJwe
Get ComLoadJweSb Of hoJwe2 vSbJwe To iSuccess
If (iSuccess = False) Begin
Get ComLastErrorText Of hoJwe2 To sTemp1
Showln sTemp1
Procedure_Return
End
// Provide the RSA private key for decryption.
Get pvComObject of hoRsaPrivKey to vRsaPrivKey
Get ComSetPrivateKey Of hoJwe2 0 vRsaPrivKey To iSuccess
// Decrypt.
Get ComDecrypt Of hoJwe2 0 "utf-8" To sOriginalPlaintext
Get ComLastMethodSuccess Of hoJwe2 To bTemp1
If (bTemp1 = False) Begin
Get ComLastErrorText Of hoJwe2 To sTemp1
Showln sTemp1
Procedure_Return
End
Showln sOriginalPlaintext
End_Procedure