(PureBasic) JWE using PBES2 Key Wrapping

Demonstrates how to create and decrypt a JWE that using PBES2 key wrapping.

This example demonstrates PBES2 with HMAC SHA-256 and A128KW wrapping. It is also possible to do the following by simply changing the "alg" parameter:

• PBES2 with HMAC SHA-384 and A192KW wrapping
• PBES2 with HMAC SHA-512 and A256KW wrapping

Note: This example requires Chilkat v9.5.0.66 or greater.

Chilkat PureBasic Module Download Chilkat PureBasic Module

IncludeFile "CkJwe.pb"
IncludeFile "CkJsonObject.pb"
IncludeFile "CkPrng.pb"

Procedure ChilkatExample()

    ; This requires the Chilkat API to have been previously unlocked.
    ; See Global Unlock Sample for sample code.

    ; Note: This example requires Chilkat v9.5.0.66 or greater.

    success.i
    plaintext.s = "Live long and prosper."

    jwe.i = CkJwe::ckCreate()
    If jwe.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    ; First build the JWE Protected Header..
    jweProtHdr.i = CkJsonObject::ckCreate()
    If jweProtHdr.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkJsonObject::ckAppendString(jweProtHdr,"alg","PBES2-HS256+A128KW")
    CkJsonObject::ckAppendString(jweProtHdr,"enc","A128GCM")

    ; PBES2 requires two additional parameters:
    ; 1) A random salt parameter ("p2s") containing 8 or more bytes in base64url format.
    ; 2) An iteration count parameter ("p2c").  A minimum count of 1000 is recommended.
    ;    The iteration count is intended to make the PBES2 computation more expensive (time consuming)
    ;    to prevent brute-force attacks.
    prng.i = CkPrng::ckCreate()
    If prng.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    CkJsonObject::ckAppendString(jweProtHdr,"p2s",CkPrng::ckGenRandom(prng,16,"base64url"))
    CkJsonObject::ckAppendString(jweProtHdr,"p2c","1000")

    Debug "JWE Protected Header: " + CkJsonObject::ckEmit(jweProtHdr)
    Debug "--"

    ; Don't forget to actually provide the protected header to the JWE object:
    CkJwe::ckSetProtectedHeader(jwe,jweProtHdr)

    ; Set the PBES2 password
    recipientIndex.i = 0
    CkJwe::ckSetPassword(jwe,recipientIndex,"top secret")

    ; Encrypt and return the JWE:
    strJwe.s = CkJwe::ckEncrypt(jwe,plaintext,"utf-8")
    If CkJwe::ckLastMethodSuccess(jwe) <> 1
        Debug CkJwe::ckLastErrorText(jwe)
        CkJwe::ckDispose(jwe)
        CkJsonObject::ckDispose(jweProtHdr)
        CkPrng::ckDispose(prng)
        ProcedureReturn
    EndIf

    ; Show the JWE we just created:
    Debug strJwe

    ; Decrypt the JWE.
    jwe2.i = CkJwe::ckCreate()
    If jwe2.i = 0
        Debug "Failed to create object."
        ProcedureReturn
    EndIf

    success = CkJwe::ckLoadJwe(jwe2,strJwe)
    If success <> 1
        Debug CkJwe::ckLastErrorText(jwe2)
        CkJwe::ckDispose(jwe)
        CkJsonObject::ckDispose(jweProtHdr)
        CkPrng::ckDispose(prng)
        CkJwe::ckDispose(jwe2)
        ProcedureReturn
    EndIf

    ; Set the PBES2 password
    CkJwe::ckSetPassword(jwe2,recipientIndex,"top secret")

    ; Decrypt.
    originalPlaintext.s = CkJwe::ckDecrypt(jwe2,0,"utf-8")
    If CkJwe::ckLastMethodSuccess(jwe2) <> 1
        Debug CkJwe::ckLastErrorText(jwe2)
        CkJwe::ckDispose(jwe)
        CkJsonObject::ckDispose(jweProtHdr)
        CkPrng::ckDispose(prng)
        CkJwe::ckDispose(jwe2)
        ProcedureReturn
    EndIf

    Debug "original text: "
    Debug originalPlaintext

    ; Sample output:

    ; JWE Protected Header: {"alg":"PBES2-HS256+A128KW","enc":"A128GCM","p2s":"z39rTEfRy1T1Yn_D1mZRlg","p2c":"1000"}
    ; --
    ; eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIiwicDJzIjoiejM5clRFZlJ5MVQxWW5fRDFtWlJsZyIsInAyYyI6IjEwMDAifQ.koYt6PrFmYwcwdcT7ZcvXHA1d-Xez5h4.luGlbvEnZp-7IsBOj42Yhw.YMTcfLf8Qe4zazozGV2OAu3cUdQ8Kg.rWub47ESWkc6IqZJTvSTmg
    ; original text: 
    ; Live long and prosper.


    CkJwe::ckDispose(jwe)
    CkJsonObject::ckDispose(jweProtHdr)
    CkPrng::ckDispose(prng)
    CkJwe::ckDispose(jwe2)


    ProcedureReturn
EndProcedure