(Objective-C) JWE using AES Key Wrap and AES_128_CBC_HMAC_SHA_256

This example duplicates the example A.3 in RFC 7516 for JSON Web Encryption (JWE).

Note: This example requires Chilkat v9.5.0.66 or greater.

Chilkat Objective-C Library Downloads MAC OS X (Cocoa) Libs iOS Libs

#import <NSString.h>
#import <CkoJwe.h>
#import <CkoJsonObject.h>
#import <CkoStringBuilder.h>

// This requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// Note: This example requires Chilkat v9.5.0.66 or greater.

BOOL success;
NSString *plaintext = @"Live long and prosper.";

CkoJwe *jwe = [[CkoJwe alloc] init];

// First build the JWE Protected Header: {"alg":"A128KW","enc":"A128CBC-HS256"}
CkoJsonObject *jweProtHdr = [[CkoJsonObject alloc] init];
[jweProtHdr AppendString: @"alg" value: @"A128KW"];
[jweProtHdr AppendString: @"enc" value: @"A128CBC-HS256"];
[jwe SetProtectedHeader: jweProtHdr];

NSLog(@"%@%@",@"JWE Protected Header: ",[jweProtHdr Emit]);
NSLog(@"%@",@"--");

// The example A.3 in RFC 7516 uses the following 128-bit AES key,
// specified in JWK (JSON Web Key) format:
//      {"kty":"oct",
//       "k":"GawgguFyGrWKav7AX4VKUg"
//      }
// This is just a way of saying: The key type ("kty") is 
// a bunch of octets ("k") in base64url encoding.
// We can simply set the AES wrapping key like this:
NSString *aesWrappingKey = @"GawgguFyGrWKav7AX4VKUg";
[jwe SetWrappingKey: [NSNumber numberWithInt: 0] encodedKey: aesWrappingKey encoding: @"base64url"];

// Encrypt and return the JWE:
NSString *strJwe = [jwe Encrypt: plaintext charset: @"utf-8"];
if (jwe.LastMethodSuccess != YES) {
    NSLog(@"%@",jwe.LastErrorText);
    return;
}

// Show the JWE we just created:
NSLog(@"%@",strJwe);

// Decrypt the JWE that was just produced.
// 1) Load the JWE.
// 2) Set the AES wrapping key.
// 3) Decrypt.
CkoJwe *jwe2 = [[CkoJwe alloc] init];
success = [jwe2 LoadJwe: strJwe];
if (success != YES) {
    NSLog(@"%@",jwe2.LastErrorText);
    return;
}

// Set the AES wrap key.
[jwe2 SetWrappingKey: [NSNumber numberWithInt: 0] encodedKey: aesWrappingKey encoding: @"base64url"];

// Decrypt.
NSString *originalPlaintext = [jwe2 Decrypt: [NSNumber numberWithInt: 0] charset: @"utf-8"];
if (jwe2.LastMethodSuccess != YES) {
    NSLog(@"%@",jwe2.LastErrorText);
    return;
}

NSLog(@"%@",@"original text: ");
NSLog(@"%@",originalPlaintext);

// ---------------------------------------------------------------------------------
// It should also be possible to decrypt the JWE as shown in RFC 7516, Appendix A.3.7
// because it was produced using the same AES Wrap key.

CkoStringBuilder *sbJwe = [[CkoStringBuilder alloc] init];
[sbJwe Append: @"eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0."];
[sbJwe Append: @"6KB707dM9YTIgHtLvtgWQ8mKwboJW3of9locizkDTHzBC2IlrT1oOQ."];
[sbJwe Append: @"AxY8DCtDaGlsbGljb3RoZQ."];
[sbJwe Append: @"KDlTtXchhZTGufMYmOYGS4HffxPSUrfmqCHXaI9wOGY."];
[sbJwe Append: @"U0m_YmjN04DJvceFICbCVQ"];

success = [jwe2 LoadJweSb: sbJwe];
if (success != YES) {
    NSLog(@"%@",jwe2.LastErrorText);
    return;
}

[jwe2 SetWrappingKey: [NSNumber numberWithInt: 0] encodedKey: aesWrappingKey encoding: @"base64url"];

// Decrypt.
originalPlaintext = [jwe2 Decrypt: [NSNumber numberWithInt: 0] charset: @"utf-8"];
if (jwe2.LastMethodSuccess != YES) {
    NSLog(@"%@",jwe2.LastErrorText);
    return;
}

NSLog(@"%@",originalPlaintext);