JWE Support #220

ortyomka · 2022-06-23T12:54:45Z

Issue #67

Add support of JWE with one key (Compact)

Add AES GCM cipher to encrypt content
Add RSA-OAEP to encrypt key

Add test from RFC7516 Section 3.3

cc @mfridman

Signed-off-by: ortyomka <iurin.art@gmail.com>

Add tests Signed-off-by: ortyomka <iurin.art@gmail.com>

Signed-off-by: ortyomka <iurin.art@gmail.com>

mfridman · 2022-06-23T14:58:24Z

I think this was an oversight on our part. This likely doesn't belong in this package.

https://github.com/golang-jwt/jwt#signing-vs-encryption

Not sure if our stance on this has changed cc @oxisto

ortyomka · 2022-06-23T17:18:09Z

As I understand it, this section was written before this issue was created. And in the issue, the author of the section writes that he doesn't mind supporting JWE.

dgrijalva commented on Jul 30, 2019
I've looked into it. JWE is a sibling standard to JWT. I'm open to supporting it

Moreover, some people are waiting for this support.

ptman commented on Mar 22
JWE support seems to still be missing. What other libraries have people had good success with?

I purposely put JWE in a separate module so as not to affect the main part of the project. Developers need to intentionally include the JWE module if they want to use it.

oxisto · 2022-06-25T19:06:48Z

I think this was an oversight on our part. This likely doesn't belong in this package.

https://github.com/golang-jwt/jwt#signing-vs-encryption

Not sure if our stance on this has changed cc @oxisto

Personally, I wouldn’t mind JWE support. We probably need to come up with a good naming / packaging scheme. I hopefully can allocate some time next week to give this a first review round.

Signed-off-by: ortyomka <iurin.art@gmail.com>

ortyomka · 2022-07-01T15:35:20Z

Reminder about PR

@oxisto @mfridman

oxisto · 2022-07-02T16:49:36Z

Before we go any further with this, I wonder whether it would be more appropriate to move this into a separate repository, @mfridman? Since JWT and JWE are more sibling references, and JWE support within the JWT repository might be confusing. So we would have github.com/golang-jwt/jwt and github.com/golang-jwt/jwe.

oxisto

First round of reviews

jwe/aesgcm.go

oxisto · 2022-07-02T17:01:40Z

jwe/jwe.go

+	"strings"
+)
+
+func NewJWE(alg KeyAlgorithm, key interface{}, method EncryptionType, plaintext []byte) (*jwe, error) {


Documentation for exported function

Added documentation

oxisto · 2022-07-02T17:02:02Z

jwe/jwe.go

+}
+
+type jwe struct {
+	protected    map[string]string


Would it make sense to make this header a struct with specific values?

Changed to struct

oxisto · 2022-07-02T17:07:49Z

jwe/jwe_test.go

@@ -0,0 +1,56 @@
+package jwe_test


It would be nice if we could re-use example data from https://datatracker.ietf.org/doc/html/rfc7516#appendix-A

Reused, This required setting a random, so I made a global random reader similar to the crypto.rand package.
Here

oxisto · 2022-07-02T17:16:06Z

jwe/jwe.go

+	"strings"
+)
+
+func NewJWE(alg KeyAlgorithm, key interface{}, method EncryptionType, plaintext []byte) (*jwe, error) {


Plaintext is the JWT in compact form, correct?

Any sensitive info. It can be JWT in compact form.

jwe/keycrypter.go

oxisto · 2022-07-02T17:18:30Z

jwe/keycrypter.go

+
+var RSA_OAEP = KeyAlgorithm("RSA-OAEP")
+
+func rsaEncrypt(key *rsa.PublicKey, cek []byte, alg KeyAlgorithm) ([]byte, error) {


any particular reason why you are using functions here instead of a struct with methods? Just wondering. The latter might be better if we want to make an interface out of it.

Changed to struct with Encrypt and Decrypt. For the future

Change map to struct with json tags Rename enum values Add documentation Signed-off-by: ortyomka <iurin.art@gmail.com>

ortyomka · 2022-07-04T11:29:39Z

@oxisto thank you for the review. I fixed all comments, ask for re-review.

mfridman · 2022-07-06T03:10:58Z

Before we go any further with this, I wonder whether it would be more appropriate to move this into a separate repository, @mfridman? Since JWT and JWE are more sibling references, and JWE support within the JWT repository might be confusing. So we would have github.com/golang-jwt/jwt and github.com/golang-jwt/jwe.

Yes, I think this should be moved to its own repository. github.com/golang-jwt/jwe sounds fine to me.

ortyomka · 2022-07-06T06:37:39Z

Before we go any further with this, I wonder whether it would be more appropriate to move this into a separate repository, @mfridman? Since JWT and JWE are more sibling references, and JWE support within the JWT repository might be confusing. So we would have github.com/golang-jwt/jwt and github.com/golang-jwt/jwe.

Yes, I think this should be moved to its own repository. github.com/golang-jwt/jwe sounds fine to me.

@mfridman, who can create new repo? I will forward this PR to there

oxisto · 2022-07-06T09:26:56Z

Before we go any further with this, I wonder whether it would be more appropriate to move this into a separate repository, @mfridman? Since JWT and JWE are more sibling references, and JWE support within the JWT repository might be confusing. So we would have github.com/golang-jwt/jwt and github.com/golang-jwt/jwe.

Yes, I think this should be moved to its own repository. github.com/golang-jwt/jwe sounds fine to me.

@mfridman, who can create new repo? I will forward this PR to there

https://github.com/golang-jwt/jwe

ortyomka · 2022-07-06T09:32:21Z

Before we go any further with this, I wonder whether it would be more appropriate to move this into a separate repository, @mfridman? Since JWT and JWE are more sibling references, and JWE support within the JWT repository might be confusing. So we would have github.com/golang-jwt/jwt and github.com/golang-jwt/jwe.

Yes, I think this should be moved to its own repository. github.com/golang-jwt/jwe sounds fine to me.

@mfridman, who can create new repo? I will forward this PR to there

https://github.com/golang-jwt/jwe

@oxisto need some init commit, I cannot fork or open PR

ortyomka · 2022-07-06T09:50:45Z

Moved to golang-jwt/jwe#1

ortyomka added 6 commits June 22, 2022 22:35

Add Parse and Serialize JWE token

3598f8d

Signed-off-by: ortyomka <iurin.art@gmail.com>

Add Content Encryption Key generator

f463dd6

Signed-off-by: ortyomka <iurin.art@gmail.com>

Add AESGCM cipher

6ad534b

Signed-off-by: ortyomka <iurin.art@gmail.com>

Add RSA-OAEP to encrypt cek

cdc6944

Signed-off-by: ortyomka <iurin.art@gmail.com>

Add JWE creation and decryption

5d85a53

Add tests Signed-off-by: ortyomka <iurin.art@gmail.com>

Add comments

2df49f0

Signed-off-by: ortyomka <iurin.art@gmail.com>

Fix staticcheck issue

3d93178

Signed-off-by: ortyomka <iurin.art@gmail.com>

oxisto reviewed Jul 2, 2022

View reviewed changes

jwe/keycrypter.go Outdated Show resolved Hide resolved

oxisto reviewed Jul 2, 2022

View reviewed changes

Reuse example from RFC7516

6bbc536

Change map to struct with json tags Rename enum values Add documentation Signed-off-by: ortyomka <iurin.art@gmail.com>

ortyomka requested a review from oxisto July 4, 2022 11:28

ortyomka closed this Jul 13, 2022

MicahParks mentioned this pull request Oct 14, 2022

Resolves #53 Smarter handling of keys marked for use with encryption MicahParks/keyfunc#54

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

JWE Support #220

JWE Support #220

ortyomka commented Jun 23, 2022

mfridman commented Jun 23, 2022

ortyomka commented Jun 23, 2022

oxisto commented Jun 25, 2022

ortyomka commented Jul 1, 2022

oxisto commented Jul 2, 2022

oxisto left a comment

oxisto Jul 2, 2022

ortyomka Jul 4, 2022

oxisto Jul 2, 2022

ortyomka Jul 4, 2022

oxisto Jul 2, 2022

ortyomka Jul 4, 2022

oxisto Jul 2, 2022

ortyomka Jul 4, 2022

oxisto Jul 2, 2022

ortyomka Jul 4, 2022

ortyomka commented Jul 4, 2022

mfridman commented Jul 6, 2022

ortyomka commented Jul 6, 2022

oxisto commented Jul 6, 2022

ortyomka commented Jul 6, 2022

ortyomka commented Jul 6, 2022


		var RSA_OAEP = KeyAlgorithm("RSA-OAEP")

		func rsaEncrypt(key *rsa.PublicKey, cek []byte, alg KeyAlgorithm) ([]byte, error) {

JWE Support #220

JWE Support #220

Conversation

ortyomka commented Jun 23, 2022

mfridman commented Jun 23, 2022

ortyomka commented Jun 23, 2022

oxisto commented Jun 25, 2022

ortyomka commented Jul 1, 2022

oxisto commented Jul 2, 2022

oxisto left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ortyomka commented Jul 4, 2022

mfridman commented Jul 6, 2022

ortyomka commented Jul 6, 2022

oxisto commented Jul 6, 2022

ortyomka commented Jul 6, 2022

ortyomka commented Jul 6, 2022