Taylingo84
Taylingo84

Reputation: 31

.NET 8 - Create JWE with JsonWebTokenHandler using ECDH-ES and AES256GCM => not supported

as per title: I want to create a JWE with Microsoft.IdentityModel.Tokens.JsonWebTokens. My problem is: Im forced to use ECDH-ES with AES256GCM over a Brainpool256R1 EC Curve.

Id give it a shot though, but I dont know where to Start,and didnt find much to be honest (maybe I misused google, though). Is there maybe anyone with experience who could tell where to start diggin?

I tried:

string payloadJws = "This is a signedJwt";
JsonWebTokenHandler jwth = new();
JsonWebKey extEncPuk = new()
{
    Crv = "BP-256",
    X = "X",
    Y = "Y"
};

jwth.CreateToken(payloadJws, new EncryptingCredentials(extEncPuk, "ECDH-ES", "AES256GCM"), new Dictionary<string, object>
            {
                    {"exp", "ExpirationAsLong"},
                    {"cty", "NJWT"}
            });

trying this fails: Microsoft.IdentityModel.Tokens.SecurityTokenEncryptionFailedException: "IDX10615: Encryption failed. No support for: Algorithm: 'ECDH-ES'

I did the following:

Ive got a running solution using .NET 8 and JoseJWT. We derived from Jose.IKeyManagement implementing ECDH-ES with BP256R1 curve. Since .NET 8 is able to ECDiffieHellmanCng.DeriveRawSecretAgreement, I already could get rid of BouncyCastle.

internal static string CreateJwe(string payload, long originalTokenExpirationPayloadValue, JsonWebKey idpEncKey) {
    return JWT.Encode(payload, RetrieveIdpPubKey(idpEncKey), JweAlgorithm.ECDH_ES, JweEncryption.A256GCM, settings: new JwtSettings().RegisterJwa(JweAlgorithm.ECDH_ES, new BP256R1EcdhKeyManagement()), extraHeaders: new Dictionary<string, object>
            {
                    {"exp", originalTokenExpirationPayloadValue},
                    {"cty", "NJWT"}
            });
    }

Id pretty Mmuch would like to drop JOSE also... Though Im not sure where to Extend JsonWebTokenHandler to make ECDH-ES Avaiable.

Upvotes: 0

Views: 281

Answers (0)

Related Questions