Using JWE Direct for encryption

[servlette]

I have a legacy Java code that was written many years ago using JWE.Direct to encrypt:

The Java code looks like this:

  static byte[] getSecretBytes(String sharedSecret)
    {
       
        Charset utf8 = Charset.forName("UTF-8");
        byte[] keyBytes = sharedSecret.getBytes(utf8);
        if (keyBytes.length < 32)
        {
            ByteBuffer byteBuffer = ByteBuffer.allocate(32);
            byteBuffer.put(keyBytes);
            for (int i = keyBytes.length; i < 32; i++)
            {
                byteBuffer.put(0);
            }
            keyBytes = byteBuffer.array();
        }

        return keyBytes;
    }

    void encrypt() {
      // "hello" here is the secret
        com.nimbusds.jose.crypto.DirectEncrypter d =  com.nimbusds.jose.crypto.DirectEncrypter(getSecretBytes("hello"));
        com.nimbusds.jose.JWEHeader header = new com.nimbusds.jose.JWEHeader(JWEAlgorithm.DIR, 
     EncryptionMethod.A128CBC_HS256);
        com.nimbusds.jwt.EncryptedJWT encryptedJWT = com.nimbusds.jwt.EncryptedJWT(header, claims);
        encryptedJWT.encrypt(d);
    }

I tried converting above Java code to golang and my initial attempt is as follows:

 func getSecretBytes(sharedSecret string) []byte {
        keyBytes := []byte(sharedSecret)
        byteBuffer := make([]byte, 32)
        copy(byteBuffer, keyBytes)		
        return byteBuffer
    }
  func encrypt() {
    payload := "lorem ipsem"

       block, e := aes.NewCipher(getSecretBytes("hello"))
     encrypted, err := jwe.Encrypt(payload,
     jwe.WithKey(jwa.DIRECT, block),
    jwe.WithContentEncryption(jwa.A128CBC_HS256)
}

Is this the right approach? Not sure if I can pass the block to jwe.WithKey(...) as I see this error:

jwe.Encrypt: failed to create recipient #0: invalid key: []byte required

I looked at the example here:

jwx/jwe/jwe_test.go

Line 554 in beffa95

encrypted, err := jwe.Encrypt(plaintext, jwe.WithKey(jwa.DIRECT, key), jwe.WithContentEncryption(tc.Algorithm))

And tried passing the bytes as shown below:

  func encrypt() {
     payload := "lorem ipsem"
     encrypted, err := jwe.Encrypt(payload,
     jwe.WithKey(jwa.DIRECT, getSecretBytes("hello")),
    jwe.WithContentEncryption(jwa.A128CBC_HS256)
 }

And I did not see any error but the encrypted JWT has no encrypted payload:

eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0..pJzLGRPeue-UkifNFBnE-w.z6WPCxRKAKkIylBnS12mbTXcgTy40bm1k9IGslqbNyvHp7SrQGtKw3g_NSIuCTXloveLUZcfTIuRIjpCOWx5_2Frv6iAFcH95JWWzi48StUrPKpvw5R2dyuYkLe9cPl_GBZtnb-WsJ3rJoXe-RFQMNaX9ckHXh-kA1CjTnPPya3LYNp6c35UH0g84_La3ruV.8bUAqfuLpmfDcUYIvW76BQ

What am I missing here?

[servlette]

I tried your example and here is what I got (look at 2 dots in the middle) and the payload in your test is not actually encrypted and it shows up as blank.
Just added this line (after line 554 in the test file jwe_test.go) to try it out:

fmt.Printf("Encrypted JWT %v\n", string(encrypted))

Output:

=== RUN   TestEncode_Direct
=== RUN   TestEncode_Direct/A128CBC-HS256
Encrypted JWT eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0..hIumdYFOcW1o9bwirdmB9g.8B46gCmwyTKI8XqGGhpTSQ.JdeZ4CN24R7veAbKATES9Q
=== RUN   TestEncode_Direct/A128GCM
Encrypted JWT eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4R0NNIn0..EA0bNAd3FEBzAlUJ.n6ULEwsrFjy7uVk.ZLhyaKJsT2pEUlSdjv0oTQ
=== RUN   TestEncode_Direct/A192CBC-HS384
Encrypted JWT eyJhbGciOiJkaXIiLCJlbmMiOiJBMTkyQ0JDLUhTMzg0In0..KGP828WzVml8MsuS6BTn0g.wGbpqXMb7fLmT436KygCdw.8rVDmzIU6cbHaxZ2Ntlwacl9LUc0SkSO
=== RUN   TestEncode_Direct/A192GCM
Encrypted JWT eyJhbGciOiJkaXIiLCJlbmMiOiJBMTkyR0NNIn0..KrHkHhM_-UNpSQ_E.Z8Ojx_bLotUozYs.nFGXrNcY9HimXIbIsU2NhQ
=== RUN   TestEncode_Direct/A256CBC-HS512
Encrypted JWT eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIn0..NgNoajF2cZ_In2VIY_QSXg.OkgLKso9Cr0m-ZhvMBpEdg.TjEEYk0iXWSFis6v6WX_zUcKMyM6AP_pZpOGwtX47zU
=== RUN   TestEncode_Direct/A256GCM
Encrypted JWT eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0..tq_KKdeGbonSEgYc.q8yGpKj_iX35KlE.aZ6ZbOS4DVhiqxtJqHgR3g

[lestrrat]

The general format of a compact JWE message is header.encrypted_key.iv.ciphertext.authtag

JWE Direct encryption is used when the sender and the receiver has the raw (direct) key to decode the payload. The key here is usually stored as the second part of the compact serialization, but since both parties are assumed to already know the key in advance, there's no point in carrying the encrypted_key segment with the JWE message.

And therefore when encrypting the JWE message in direct encryption mode, the encrypted_key segment is left blank. This is clearly stated in Section 5.1.5 of the RFC. So there's no problem with this test.

[lestrrat]

As far as you decryption code goes, you shouldn't need to encrypt it using an AES cipher. When you are using direct encryption mode, you are supposed to have the raw Content Encryption Key (CEK) that was used when creating the JWE message.

[servlette]

Thanks for getting back. Is there a complete code to encrypt/decrypt using JWE with direct using a shared key you can share? I was under the assumption that upon encryption, I will have a JWT and if I take the JWT to jwt.io and paste it, I will be seeing the payload part garbled as it is encrypted. What I see is something blank and I thought the payload was lost. As long as I can get it decrypted I think I am good.

[servlette]

Never mind.

[lestrrat]

Is there a complete code to encrypt/decrypt using JWE with direct using a shared key you can share?

You've already found it in jwe_test.go. That's a complete code, no?

if I take the JWT to jwt.io and paste it, I will be seeing the payload part garbled as it is encrypted

No, that doesn't work. JWE != JWT. JWE is a message format for arbitrary payload. The message is a JWE mesage, which may contain JWT, but may contain something totally different. I mean, think about it: do you expect a random website like jwt.io to be able to read your ENCRYPTED message? How are they going to get the necessary key to decrypt the message.

In order for jwt.io to display anything, you must first decrypt the message using the appropriate key, and that's not going to happen :)

I highly recommend you to understand the spec, but in the meantime, this is how JWE works. Please do your own research for any more details:

1. Alice: I want to send encrypted data to Bob.
2. Alice: I will first fetch Bob's public key.
3. Alice: I will create CEK (usually a random byte sequence, with appropriate length for encryption algorithm)
4. Alice: I will encrypt the content using CEK.
5. Alice: I will encrypt the CEK using Bob's public key.
6. Alice: I will create a JWE message with the encrypted key, the encrypted content, and other metadata required for decryption.
7. Alice: I will send the JWE message to Bob
8. Bob: I will decrypt the encrypted key using my private key, and get the CEK
9. Bob: I will decrypt the encrypted content using the CEK
10. Bob: I now know what Alice sent me

In direct encryption mode, you skip step 5 and 8. Both Alice and Bob has access to a previously shared CEK so they can encrypt and decrypt the content without knowing encrypted_key

[servlette]

All good.