Question
· 4 hr ago

How to generate a valid JWE token ?

I'm trying to generate a valid JWE token (it's like a JWT token but encrypted) but I can't figure out which parameters should be used. 
I have this code for a JWT that already works :

Set header = { "alg": "HS256", "typ": "JWT", "enc": "A256GCM" }
Set claims = { "sub": "123456", "data": "HelloWorld" }

Set secret = "3c623f940bbd8be1bd855722243b4ab_just_an_example_7bf8fd9b431cef9c741bef98c3c9ca673bb"
Set sc = ##class(%Net.JSON.JWK).Create("HS256", secret, .privateJWK)

If $$$ISERR(sc) {
    Write $SYSTEM.OBJ.DisplayError(sc)
    Quit
}

Set sc = ##class(%Net.JSON.JWKS).PutJWK(privateJWK, .privateJWKS)
If $$$ISERR(sc) {
    Write $SYSTEM.OBJ.DisplayError(sc)
    Quit
}

Set sc = ##class(%Net.JSON.JWT).Create(header, , claims, privateJWKS, , .JWT)
If $$$ISERR(sc) {
    Write $SYSTEM.OBJ.DisplayError(sc)
} Else {
    Write "Generated JWE: ", JWT, !
}
Quit

According to the docs, the Create() method has a second parameter for JOSE encryption and key can be set so same is used for signing and encrypting :  

Set sc = ##class(%Net.JSON.JWT).Create(header, another_header, claims, privateJWK, privateJWK, .JWT)

But it's unclear to me what to put in another_header

I have tried A256CBC-HS512 (eg: {"enc":"A256CBC-HS512", "alg":"RSA1_5"}) but it does not work. I often get "invalid JOSE or invalid algorithm for signature". It's unclear to me if parameters are wrong or if there is only a particular subset compatible with IRIS.

If someone would have a working example that would help me a lot.

Product version: IRIS 2023.1
Discussion (0)1
Log in or sign up to continue