JWE Support

[ksivask]

As part of envoyproxy / istio changes, I am adding JWE support to this library and would like to upstream the changes. I am volunteering to get this feature added. Please advise if this feature request is acceptable.

JWE Asymmetric Algorithms (alg)

• RSA-OAEP-256
• ECDH-ES:
  • Curves: P-256, P-384, P-521
• Unsupported:
  • RSA-OAEP (Deprecated)
  • RSA1_5 (No plan)

JWE Symmetric Encryptions (enc)

• A128GCM, A192GCM, A256GCM
• A128CBC-HS256, A192CBC-HS384, A256CBC-HS512

References

• https://www.rfc-editor.org/rfc/rfc7516.html

BASE64URL(UTF8(JWE Protected Header)) + '.' +
BASE64URL(JWE Encrypted CEKey) + '.' +
BASE64URL(JWE Initialization Vector) + '.' +
BASE64URL(JWE Ciphertext) + '.' +
BASE64URL(JWE Authentication Tag)

[pascal-hofmann]

@ksivask I'm not sure which flavor you want to implement (JWE or JWS in JWE), but you might want to check out https://www.youtube.com/watch?v=mJ6BQ5eFkG4&t=1258s