Reputation: 31
as per title: I want to create a JWE with Microsoft.IdentityModel.Tokens.JsonWebTokens. My problem is: Im forced to use ECDH-ES with AES256GCM over a Brainpool256R1 EC Curve.
Id give it a shot though, but I dont know where to Start,and didnt find much to be honest (maybe I misused google, though). Is there maybe anyone with experience who could tell where to start diggin?
I tried:
string payloadJws = "This is a signedJwt";
JsonWebTokenHandler jwth = new();
JsonWebKey extEncPuk = new()
{
Crv = "BP-256",
X = "X",
Y = "Y"
};
jwth.CreateToken(payloadJws, new EncryptingCredentials(extEncPuk, "ECDH-ES", "AES256GCM"), new Dictionary<string, object>
{
{"exp", "ExpirationAsLong"},
{"cty", "NJWT"}
});
trying this fails: Microsoft.IdentityModel.Tokens.SecurityTokenEncryptionFailedException: "IDX10615: Encryption failed. No support for: Algorithm: 'ECDH-ES'
I did the following:
Ive got a running solution using .NET 8 and JoseJWT. We derived from Jose.IKeyManagement implementing ECDH-ES with BP256R1 curve. Since .NET 8 is able to ECDiffieHellmanCng.DeriveRawSecretAgreement, I already could get rid of BouncyCastle.
internal static string CreateJwe(string payload, long originalTokenExpirationPayloadValue, JsonWebKey idpEncKey) {
return JWT.Encode(payload, RetrieveIdpPubKey(idpEncKey), JweAlgorithm.ECDH_ES, JweEncryption.A256GCM, settings: new JwtSettings().RegisterJwa(JweAlgorithm.ECDH_ES, new BP256R1EcdhKeyManagement()), extraHeaders: new Dictionary<string, object>
{
{"exp", originalTokenExpirationPayloadValue},
{"cty", "NJWT"}
});
}
Id pretty Mmuch would like to drop JOSE also... Though Im not sure where to Extend JsonWebTokenHandler to make ECDH-ES Avaiable.
Upvotes: 0
Views: 281