Is it possible to use AWS key management service to decrypt the content encryption key ?

[tal-nagra]

Hello,
I am currently attempting to use the jose.jwtDecrypt function.
Sample header:
{"cty":"JWT","enc":"A256GCM","alg":"RSA-OAEP-256"}
The CEK is encrypted using an RSA public key that originates from a key-pair that resides in the AWS key management service (RSAES_OAEP_SHA_256).
Therefore, to obtain the (decrypted) CEK the decryption needs to happen by invoking the AWS KMS sdk (by design, the private key never leaves the AWS key management service).

Is it possible to provide a custom function that performs the decryption of the CEK in place of the function below?

jose/src/runtime/node/rsaes.ts

Line 66 in aff2f7c

export const decrypt: RsaEsDecryptFunction = (

Or achieve the desired CEK decryption via AWS in some other way ?

Thank you in advance

[panva]

This is not in scope for this package. It only works with runtime's native key representations and crypto.

[tal-nagra]

I see. I guess I will take a look at alternative packages. Thanks for the swift response.