jose
jose copied to clipboard
Fix EC encryption
jose_jwe_enc using elliptic curve keys does not add the algo or epk values to the protected header value it generates.
These values will be missing when generating a compact serialized JWE string and will fail decrypting because the protected value is missing them.
The patch below tweaks things to include them in the protected value.
lib/jwe.c change to match lib/jws.c putting it protected instead of header.
lib/openssl/ecdhes.c changes to put things in both protected and header.
I do not have test cases for other encryption cases, but I think "protected" might need to be added to the add_entity call in other files in lib/openssl.
Hello @hawk259 : this change seems to break unit tests ... is it because they need to be changed? I am not sure change can be merged if unit tests are broken ...
I have been trying to figure out how to fix the tests, but not making much progress.
Here is a test that you can try to add to see how things break:
- setup keys and call
jose_jwe_enc
on a string - generate a JWT token string using
<protected>.<encrypted_key>.<iv>.<ciphertext>.<tag>
keys from jwe object - Using that string, split on
.
, create a json object with the above keys, setup keys and calljose_jwe_dec
passing that object.
The jose_jwe_dec
will fail because it doesn't have enough info in the protected value to decrypt the strings. The problem is the things needed are saved in the header value, but not copied to protected value.