Xbase++

JWE using AES Key Wrap and AES_128_CBC_HMAC_SHA_256

See more JSON Web Encryption (JWE) Examples

This example duplicates the example A.3 in RFC 7516 for JSON Web Encryption (JWE).

Note: This example requires Chilkat v9.5.0.66 or greater.

Xbase++

LOCAL nSuccess
LOCAL cPlaintext
LOCAL oJwe
LOCAL oJweProtHdr
LOCAL cAesWrappingKey
LOCAL cStrJwe
LOCAL oJwe2
LOCAL cOriginalPlaintext
LOCAL oSbJwe

nSuccess := 0

//  This requires the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  Note: This example requires Chilkat v9.5.0.66 or greater.

cPlaintext := "Live long and prosper."

oJwe := CreateObject("Chilkat.Jwe")

//  First build the JWE Protected Header: {"alg":"A128KW","enc":"A128CBC-HS256"}
oJweProtHdr := CreateObject("Chilkat.JsonObject")
oJweProtHdr:AppendString("alg", "A128KW")
oJweProtHdr:AppendString("enc", "A128CBC-HS256")
oJwe:SetProtectedHeader(oJweProtHdr)

? "JWE Protected Header: " + oJweProtHdr:Emit()
? "--"

//  The example A.3 in RFC 7516 uses the following 128-bit AES key,
//  specified in JWK (JSON Web Key) format:
//       {"kty":"oct",
//        "k":"GawgguFyGrWKav7AX4VKUg"
//       }
//  This is just a way of saying: The key type ("kty") is 
//  a bunch of octets ("k") in base64url encoding.
//  We can simply set the AES wrapping key like this:
cAesWrappingKey := "GawgguFyGrWKav7AX4VKUg"
oJwe:SetWrappingKey(0, cAesWrappingKey, "base64url")

//  Encrypt and return the JWE:
cStrJwe := oJwe:Encrypt(cPlaintext, "utf-8")
IF (oJwe:LastMethodSuccess != 1)
    ? oJwe:LastErrorText
    oJwe:destroy()
    oJweProtHdr:destroy()
    RETURN
ENDIF

//  Show the JWE we just created:
? cStrJwe

//  Decrypt the JWE that was just produced.
//  1) Load the JWE.
//  2) Set the AES wrapping key.
//  3) Decrypt.
oJwe2 := CreateObject("Chilkat.Jwe")
nSuccess := oJwe2:LoadJwe(cStrJwe)
IF (nSuccess != 1)
    ? oJwe2:LastErrorText
    oJwe:destroy()
    oJweProtHdr:destroy()
    oJwe2:destroy()
    RETURN
ENDIF

//  Set the AES wrap key.
oJwe2:SetWrappingKey(0, cAesWrappingKey, "base64url")

//  Decrypt.
cOriginalPlaintext := oJwe2:Decrypt(0, "utf-8")
IF (oJwe2:LastMethodSuccess != 1)
    ? oJwe2:LastErrorText
    oJwe:destroy()
    oJweProtHdr:destroy()
    oJwe2:destroy()
    RETURN
ENDIF

? "original text: "
? cOriginalPlaintext

//  ---------------------------------------------------------------------------------
//  It should also be possible to decrypt the JWE as shown in RFC 7516, Appendix A.3.7
//  because it was produced using the same AES Wrap key.

oSbJwe := CreateObject("Chilkat.StringBuilder")
oSbJwe:Append("eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0.")
oSbJwe:Append("6KB707dM9YTIgHtLvtgWQ8mKwboJW3of9locizkDTHzBC2IlrT1oOQ.")
oSbJwe:Append("AxY8DCtDaGlsbGljb3RoZQ.")
oSbJwe:Append("KDlTtXchhZTGufMYmOYGS4HffxPSUrfmqCHXaI9wOGY.")
oSbJwe:Append("U0m_YmjN04DJvceFICbCVQ")

nSuccess := oJwe2:LoadJweSb(oSbJwe)
IF (nSuccess != 1)
    ? oJwe2:LastErrorText
    oJwe:destroy()
    oJweProtHdr:destroy()
    oJwe2:destroy()
    oSbJwe:destroy()
    RETURN
ENDIF

oJwe2:SetWrappingKey(0, cAesWrappingKey, "base64url")

//  Decrypt.
cOriginalPlaintext := oJwe2:Decrypt(0, "utf-8")
IF (oJwe2:LastMethodSuccess != 1)
    ? oJwe2:LastErrorText
    oJwe:destroy()
    oJweProtHdr:destroy()
    oJwe2:destroy()
    oSbJwe:destroy()
    RETURN
ENDIF

? cOriginalPlaintext

oJwe:destroy()
oJweProtHdr:destroy()
oJwe2:destroy()
oSbJwe:destroy()