Rust

JWE using AES Key Wrap and AES_128_CBC_HMAC_SHA_256

See more JSON Web Encryption (JWE) Examples

This example duplicates the example A.3 in RFC 7516 for JSON Web Encryption (JWE).

Note: This example requires Chilkat v9.5.0.66 or greater.

Rust

// This requires the Chilkat API to have been previously unlocked.
// See Global Unlock Sample for sample code.

// Note: This example requires Chilkat v9.5.0.66 or greater.

let plaintext = "Live long and prosper.".to_string();

let jwe = chilkat::Jwe::new();

// First build the JWE Protected Header: {"alg":"A128KW","enc":"A128CBC-HS256"}
let jwe_prot_hdr = chilkat::JsonObject::new();
let _ = jwe_prot_hdr.append_string("alg", "A128KW");
let _ = jwe_prot_hdr.append_string("enc", "A128CBC-HS256");
let _ = jwe.set_protected_header(&jwe_prot_hdr);

println!("JWE Protected Header: {}", jwe_prot_hdr.emit().unwrap_or_default());
println!("--");

// The example A.3 in RFC 7516 uses the following 128-bit AES key,
// specified in JWK (JSON Web Key) format:
//      {"kty":"oct",
//       "k":"GawgguFyGrWKav7AX4VKUg"
//      }
// This is just a way of saying: The key type ("kty") is 
// a bunch of octets ("k") in base64url encoding.
// We can simply set the AES wrapping key like this:
let aes_wrapping_key = "GawgguFyGrWKav7AX4VKUg".to_string();
let _ = jwe.set_wrapping_key(0, &aes_wrapping_key, "base64url");

// Encrypt and return the JWE:
let Ok(str_jwe) = jwe.encrypt(&plaintext, "utf-8") else {
    println!("{}", jwe.last_error_text());
    return;
};

// Show the JWE we just created:
println!("{}", str_jwe);

// Decrypt the JWE that was just produced.
// 1) Load the JWE.
// 2) Set the AES wrapping key.
// 3) Decrypt.
let jwe2 = chilkat::Jwe::new();
if jwe2.load_jwe(&str_jwe).is_err() {
    println!("{}", jwe2.last_error_text());
    return;
}

// Set the AES wrap key.
let _ = jwe2.set_wrapping_key(0, &aes_wrapping_key, "base64url");

// Decrypt.
let Ok(mut original_plaintext) = jwe2.decrypt(0, "utf-8") else {
    println!("{}", jwe2.last_error_text());
    return;
};

println!("original text: ");
println!("{}", original_plaintext);

// ---------------------------------------------------------------------------------
// It should also be possible to decrypt the JWE as shown in RFC 7516, Appendix A.3.7
// because it was produced using the same AES Wrap key.

let sb_jwe = chilkat::StringBuilder::new();
let _ = sb_jwe.append("eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0.");
let _ = sb_jwe.append("6KB707dM9YTIgHtLvtgWQ8mKwboJW3of9locizkDTHzBC2IlrT1oOQ.");
let _ = sb_jwe.append("AxY8DCtDaGlsbGljb3RoZQ.");
let _ = sb_jwe.append("KDlTtXchhZTGufMYmOYGS4HffxPSUrfmqCHXaI9wOGY.");
let _ = sb_jwe.append("U0m_YmjN04DJvceFICbCVQ");

if jwe2.load_jwe_sb(&sb_jwe).is_err() {
    println!("{}", jwe2.last_error_text());
    return;
}

let _ = jwe2.set_wrapping_key(0, &aes_wrapping_key, "base64url");

// Decrypt.
original_plaintext = jwe2.decrypt(0, "utf-8").unwrap_or_default();
if !jwe2.last_method_success() {
    println!("{}", jwe2.last_error_text());
    return;
}

println!("{}", original_plaintext);