(Node.js) JWE using PBES2 Key Wrapping

Demonstrates how to create and decrypt a JWE that using PBES2 key wrapping.

This example demonstrates PBES2 with HMAC SHA-256 and A128KW wrapping. It is also possible to do the following by simply changing the "alg" parameter:

• PBES2 with HMAC SHA-384 and A192KW wrapping
• PBES2 with HMAC SHA-512 and A256KW wrapping

Note: This example requires Chilkat v9.5.0.66 or greater.

Install Chilkat for Node.js and Electron using npm at Chilkat npm packages for Node.js Chilkat npm packages for Electron on Windows, Linux, MacOSX, and ARM

var os = require('os');
if (os.platform() == 'win32') {  
    if (os.arch() == 'ia32') {
        var chilkat = require('@chilkat/ck-node21-win-ia32');
    } else {
        var chilkat = require('@chilkat/ck-node21-win64'); 
    }
} else if (os.platform() == 'linux') {
    if (os.arch() == 'arm') {
        var chilkat = require('@chilkat/ck-node21-arm');
    } else if (os.arch() == 'x86') {
        var chilkat = require('@chilkat/ck-node21-linux32');
    } else {
        var chilkat = require('@chilkat/ck-node21-linux64');
    }
} else if (os.platform() == 'darwin') {
    if (os.arch() == 'arm64') {
        var chilkat = require('@chilkat/ck-node21-mac-m1');
    } else {
        var chilkat = require('@chilkat/ck-node21-macosx');
    }
}

function chilkatExample() {

    // This requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Note: This example requires Chilkat v9.5.0.66 or greater.

    var success;
    var plaintext = "Live long and prosper.";

    var jwe = new chilkat.Jwe();

    // First build the JWE Protected Header..
    var jweProtHdr = new chilkat.JsonObject();
    jweProtHdr.AppendString("alg","PBES2-HS256+A128KW");
    jweProtHdr.AppendString("enc","A128GCM");

    // PBES2 requires two additional parameters:
    // 1) A random salt parameter ("p2s") containing 8 or more bytes in base64url format.
    // 2) An iteration count parameter ("p2c").  A minimum count of 1000 is recommended.
    //    The iteration count is intended to make the PBES2 computation more expensive (time consuming)
    //    to prevent brute-force attacks.
    var prng = new chilkat.Prng();
    jweProtHdr.AppendString("p2s",prng.GenRandom(16,"base64url"));
    jweProtHdr.AppendString("p2c","1000");

    console.log("JWE Protected Header: " + jweProtHdr.Emit());
    console.log("--");

    // Don't forget to actually provide the protected header to the JWE object:
    jwe.SetProtectedHeader(jweProtHdr);

    // Set the PBES2 password
    var recipientIndex = 0;
    jwe.SetPassword(recipientIndex,"top secret");

    // Encrypt and return the JWE:
    var strJwe = jwe.Encrypt(plaintext,"utf-8");
    if (jwe.LastMethodSuccess !== true) {
        console.log(jwe.LastErrorText);
        return;
    }

    // Show the JWE we just created:
    console.log(strJwe);

    // Decrypt the JWE.
    var jwe2 = new chilkat.Jwe();
    success = jwe2.LoadJwe(strJwe);
    if (success !== true) {
        console.log(jwe2.LastErrorText);
        return;
    }

    // Set the PBES2 password
    jwe2.SetPassword(recipientIndex,"top secret");

    // Decrypt.
    var originalPlaintext = jwe2.Decrypt(0,"utf-8");
    if (jwe2.LastMethodSuccess !== true) {
        console.log(jwe2.LastErrorText);
        return;
    }

    console.log("original text: ");
    console.log(originalPlaintext);

    // Sample output:

    // JWE Protected Header: {"alg":"PBES2-HS256+A128KW","enc":"A128GCM","p2s":"z39rTEfRy1T1Yn_D1mZRlg","p2c":"1000"}
    // --
    // eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIiwicDJzIjoiejM5clRFZlJ5MVQxWW5fRDFtWlJsZyIsInAyYyI6IjEwMDAifQ.koYt6PrFmYwcwdcT7ZcvXHA1d-Xez5h4.luGlbvEnZp-7IsBOj42Yhw.YMTcfLf8Qe4zazozGV2OAu3cUdQ8Kg.rWub47ESWkc6IqZJTvSTmg
    // original text: 
    // Live long and prosper.

}

chilkatExample();