Subject: [jose] Complete JWE computation example

From: Mike Jones <[email-masked]>
Date: Wed, 27 Jun 2012 00:32:58 +0000

Dear working group members,

For the next round of the JOSE JWE spec, I'm adding example encryption computations to aid implementers.  An example JWE computation is included below, in case you'd like to compare your implementations against these.  These values have already been verified by two independent implementations.

This example uses the header values:
    {"alg":"RSA1_5","enc":"A128CBC","int":"HS256","iv":"AxY8DCtDaGlsbGljb3RoZQ"}

As such, there are actually several different things that this example verifies:
  - RSA encryption of the CMK
  - Deriving the CEK and CIK from the CMK (in this case, using the same values as EXAMPLE 1 from my Key Derivation message)
  - AES-CBC encryption of the plaintext
  - Calculation of the integrity value

Note that because RSA PKCS #1-1.5 padding uses random values, the encrypted CMK value will not be repeatable, although all resulting values will be decryptable to retrieve the original CMK value.

All relevant values should be present below.  For the RSA key parameters, the field names used are the ones from the .NET RSAParameters structure documented at http://msdn.microsoft.com/en-us/library/system.security.cryptography.rsaparameters_members(v=vs.71).

                                                               Enjoy,
                                                                -- Mike

CMK
[4, 211, 31, 197, 84, 157, 252, 254, 11, 100, 157, 250, 63, 170, 106, 206,
107, 124, 212, 45, 111, 107, 9, 219, 200, 177, 0, 240, 143, 156, 44, 207]
CEK
[249, 255, 87, 218, 224, 223, 221, 53, 204, 121, 166, 130, 195, 184, 50, 69]
CIK
[218, 209, 130, 50, 169, 45, 70, 214, 29, 187, 123, 20, 3, 158, 111, 122,
182, 94, 57, 133, 245, 76, 97, 44, 193, 80, 81, 246, 115, 177, 225, 159]
IV
[3, 22, 60, 12, 43, 67, 104, 105, 108, 108, 105, 99, 111, 116, 104, 101]
Plaintext
[78, 111, 119, 32, 105, 115, 32, 116, 104, 101, 32, 116, 105, 109, 101, 32,
102, 111, 114, 32, 97, 108, 108, 32, 103, 111, 111, 100, 32, 109, 101, 110,
32, 116, 111, 32, 99, 111, 109, 101, 32, 116, 111, 32, 116, 104, 101, 32,
97, 105, 100, 32, 111, 102, 32, 116, 104, 101, 105, 114, 32, 99, 111, 117,
110, 116, 114, 121, 46]
Header
{"alg":"RSA1_5","enc":"A128CBC","int":"HS256","iv":"AxY8DCtDaGlsbGljb3RoZQ"}
Header Bytes
[123, 34, 97, 108, 103, 34, 58, 34, 82, 83, 65, 49, 95, 53, 34, 44,
34, 101, 110, 99, 34, 58, 34, 65, 49, 50, 56, 67, 66, 67, 34, 44,
34, 105, 110, 116, 34, 58, 34, 72, 83, 50, 53, 54, 34, 44, 34, 105,
118, 34, 58, 34, 65, 120, 89, 56, 68, 67, 116, 68, 97, 71, 108, 115,
98, 71, 108, 106, 98, 51, 82, 111, 90, 81, 34, 125]
Encoded Header
eyJhbGciOiJSU0ExXzUiLCJlbmMiOiJBMTI4Q0JDIiwiaW50IjoiSFMyNTYiLCJpdiI6IkF4WThEQ3REYUdsc2JHbGpiM1JvWlEifQ
BEGIN RSA KEY PARAMETERS
Exponent
[1, 0, 1]
Modulus
[177, 119, 33, 13, 164, 30, 108, 121, 207, 136, 107, 242, 12, 224, 19, 226,
198, 134, 17, 71, 173, 75, 42, 61, 48, 162, 206, 161, 97, 108, 185, 234,
226, 219, 118, 206, 118, 5, 169, 224, 60, 181, 90, 85, 51, 123, 6, 224,
4, 122, 29, 230, 151, 12, 244, 127, 121, 25, 4, 85, 220, 144, 215, 110,
130, 17, 68, 228, 129, 138, 7, 130, 231, 40, 212, 214, 17, 179, 28, 124,
151, 178, 207, 20, 14, 154, 222, 113, 176, 24, 198, 73, 211, 113, 9, 33,
178, 80, 13, 25, 21, 25, 153, 212, 206, 67, 154, 147, 70, 194, 192, 183,
160, 83, 98, 236, 175, 85, 23, 97, 75, 199, 177, 73, 145, 50, 253, 206,
32, 179, 254, 236, 190, 82, 73, 67, 129, 253, 252, 220, 108, 136, 138, 11,
192, 1, 36, 239, 228, 55, 81, 113, 17, 25, 140, 63, 239, 146, 3, 172,
96, 60, 227, 233, 64, 255, 224, 173, 225, 228, 229, 92, 112, 72, 99, 97,
26, 87, 187, 123, 46, 50, 90, 202, 117, 73, 10, 153, 47, 224, 178, 163,
77, 48, 46, 154, 33, 148, 34, 228, 33, 172, 216, 89, 46, 225, 127, 68,
146, 234, 30, 147, 54, 146, 5, 133, 45, 78, 254, 85, 55, 75, 213, 86,
194, 218, 215, 163, 189, 194, 54, 6, 83, 36, 18, 153, 53, 7, 48, 89,
35, 66, 144, 7, 65, 154, 13, 97, 75, 55, 230, 132, 3, 13, 239, 71]
D (private key exponent)
[84, 80, 150, 58, 165, 235, 242, 123, 217, 55, 38, 154, 36, 181, 221, 156,
211, 215, 100, 164, 90, 88, 40, 228, 83, 148, 54, 122, 4, 16, 165, 48,
76, 194, 26, 107, 51, 53, 179, 165, 31, 18, 198, 173, 78, 61, 56, 97,
252, 158, 140, 80, 63, 25, 223, 156, 36, 203, 214, 252, 120, 67, 180, 167,
3, 82, 243, 25, 97, 214, 83, 133, 69, 16, 104, 54, 160, 200, 41, 83,
164, 187, 70, 153, 111, 234, 242, 158, 175, 28, 198, 48, 211, 45, 148, 58,
23, 62, 227, 74, 52, 117, 42, 90, 41, 249, 130, 154, 80, 119, 61, 26,
193, 40, 125, 10, 152, 174, 227, 225, 205, 32, 62, 66, 6, 163, 100, 99,
219, 19, 253, 25, 105, 80, 201, 29, 252, 157, 237, 69, 1, 80, 171, 167,
20, 196, 156, 109, 249, 88, 0, 3, 152, 38, 165, 72, 87, 6, 152, 71,
156, 214, 16, 71, 30, 82, 51, 103, 76, 218, 63, 9, 84, 163, 249, 91,
215, 44, 238, 85, 101, 240, 148, 1, 82, 224, 91, 135, 105, 127, 84, 171,
181, 152, 210, 183, 126, 24, 46, 196, 90, 173, 38, 245, 219, 186, 222, 27,
240, 212, 194, 15, 66, 135, 226, 178, 190, 52, 245, 74, 65, 224, 81, 100,
85, 25, 204, 165, 203, 187, 175, 84, 100, 82, 15, 11, 23, 202, 151, 107,
54, 41, 207, 3, 136, 229, 134, 131, 93, 139, 50, 182, 204, 93, 130, 89]
The remaining RSA key parameters are included for completeness, but should not be needed
DP
[195, 73, 25, 109, 94, 183, 113, 84, 111, 85, 126, 178, 147, 112, 188, 112,
204, 104, 218, 160, 140, 225, 143, 39, 178, 173, 101, 152, 196, 152, 132, 110,
4, 112, 190, 133, 89, 181, 249, 135, 220, 174, 190, 120, 44, 226, 34, 196,
22, 78, 158, 0, 186, 20, 75, 139, 200, 88, 76, 28, 47, 139, 113, 195,
210, 236, 88, 127, 243, 40, 143, 161, 194, 132, 94, 160, 254, 251, 112, 231,
82, 47, 128, 21, 114, 182, 135, 107, 9, 100, 167, 39, 118, 77, 104, 196,
229, 235, 224, 110, 21, 173, 59, 25, 217, 121, 237, 220, 92, 144, 100, 2,
46, 184, 34, 78, 163, 103, 22, 239, 147, 228, 81, 222, 145, 33, 156, 43]
DQ
[163, 255, 21, 215, 132, 158, 205, 201, 14, 232, 35, 75, 42, 207, 219, 180,
247, 69, 136, 239, 127, 144, 45, 67, 178, 229, 19, 119, 98, 192, 124, 130,
21, 120, 198, 123, 142, 125, 70, 186, 207, 197, 127, 176, 123, 33, 92, 119,
167, 146, 174, 4, 99, 149, 23, 194, 254, 170, 39, 203, 111, 169, 208, 156,
188, 172, 128, 112, 225, 215, 125, 141, 14, 42, 25, 146, 17, 251, 152, 142,
225, 60, 111, 143, 96, 79, 232, 116, 10, 74, 118, 122, 132, 8, 117, 176,
208, 159, 133, 208, 149, 167, 81, 222, 131, 216, 31, 245, 78, 241, 125, 153,
112, 54, 67, 31, 162, 25, 137, 252, 57, 85, 117, 6, 201, 169, 234, 165]
InverseQ
[120, 216, 104, 231, 36, 65, 16, 28, 97, 24, 27, 80, 71, 12, 61, 66,
42, 217, 176, 30, 186, 78, 183, 197, 69, 225, 191, 9, 203, 94, 35, 86,
130, 157, 228, 244, 16, 177, 161, 98, 84, 101, 10, 213, 36, 77, 23, 37,
33, 251, 132, 62, 99, 108, 52, 51, 219, 46, 130, 234, 168, 37, 115, 156,
86, 239, 116, 30, 241, 249, 57, 126, 155, 73, 127, 120, 84, 227, 216, 168,
170, 192, 106, 132, 244, 246, 65, 246, 115, 83, 192, 197, 111, 31, 117, 81,
69, 34, 214, 0, 43, 207, 157, 40, 176, 63, 195, 121, 82, 204, 190, 89,
21, 210, 249, 94, 211, 110, 156, 72, 134, 247, 169, 77, 241, 52, 52, 218]
P
[246, 6, 54, 195, 162, 58, 75, 162, 244, 142, 225, 10, 177, 183, 131, 3,
10, 93, 245, 99, 31, 130, 161, 104, 120, 15, 111, 19, 33, 20, 186, 78,
36, 47, 0, 74, 114, 135, 181, 199, 129, 198, 235, 200, 164, 247, 95, 33,
116, 52, 132, 246, 240, 208, 73, 199, 0, 223, 21, 199, 56, 1, 78, 60,
159, 17, 244, 71, 136, 1, 180, 226, 213, 92, 1, 98, 118, 211, 167, 206,
215, 251, 23, 15, 90, 81, 15, 146, 183, 104, 80, 165, 186, 210, 216, 44,
213, 163, 93, 252, 217, 220, 244, 177, 21, 84, 243, 18, 223, 221, 51, 108,
92, 109, 241, 51, 127, 110, 38, 129, 129, 233, 77, 129, 176, 189, 230, 195]
Q
[184, 169, 66, 42, 242, 175, 253, 146, 76, 85, 199, 72, 179, 155, 213, 73,
79, 250, 112, 251, 88, 35, 89, 99, 91, 43, 68, 197, 95, 236, 146, 203,
111, 69, 35, 98, 246, 190, 186, 141, 215, 125, 251, 32, 97, 85, 251, 134,
226, 200, 108, 167, 104, 251, 172, 105, 200, 138, 143, 116, 213, 16, 94, 30,
142, 147, 60, 165, 149, 87, 41, 15, 187, 88, 152, 133, 5, 240, 214, 50,
0, 5, 252, 62, 49, 91, 13, 251, 118, 208, 239, 165, 139, 118, 221, 146,
15, 27, 7, 179, 186, 187, 204, 252, 148, 200, 117, 230, 166, 206, 242, 113,
158, 92, 239, 108, 6, 145, 76, 13, 58, 54, 30, 150, 105, 34, 53, 45]
END RSA KEY PARAMETERS
Encrypted Key
[32, 242, 63, 207, 94, 246, 133, 37, 135, 48, 88, 4, 15, 193, 6, 244,
51, 58, 132, 133, 212, 255, 163, 90, 59, 80, 200, 152, 41, 244, 188, 215,
174, 160, 26, 188, 227, 180, 165, 234, 172, 63, 24, 116, 152, 28, 149, 16,
94, 213, 201, 171, 180, 191, 11, 21, 149, 172, 143, 54, 194, 58, 206, 201,
164, 28, 107, 155, 75, 101, 22, 92, 227, 144, 95, 40, 119, 170, 7, 36,
225, 40, 141, 186, 213, 7, 175, 16, 174, 122, 75, 32, 48, 193, 119, 202,
41, 152, 210, 190, 68, 57, 119, 4, 197, 74, 7, 242, 239, 170, 204, 73,
75, 213, 202, 113, 216, 18, 23, 66, 106, 208, 69, 244, 117, 147, 2, 37,
207, 199, 184, 96, 102, 44, 70, 212, 87, 143, 253, 0, 166, 59, 41, 115,
217, 80, 165, 87, 38, 5, 9, 184, 202, 68, 67, 176, 4, 87, 254, 166,
227, 88, 124, 238, 249, 75, 114, 205, 148, 149, 45, 78, 193, 134, 64, 189,
168, 76, 170, 76, 176, 72, 148, 77, 215, 159, 146, 55, 189, 213, 85, 253,
135, 200, 59, 247, 79, 37, 22, 200, 32, 110, 53, 123, 54, 39, 9, 178,
231, 238, 95, 25, 211, 143, 87, 220, 88, 138, 209, 13, 227, 72, 58, 102,
164, 136, 241, 14, 14, 45, 32, 77, 44, 244, 162, 239, 150, 248, 181, 138,
251, 116, 245, 205, 137, 78, 34, 34, 10, 6, 59, 4, 197, 2, 153, 251]
Encoded Encrypted Key
IPI_z172hSWHMFgED8EG9DM6hIXU_6NaO1DImCn0vNeuoBq847Sl6qw_GHSYHJUQXtXJq7S_CxWVrI82wjrOyaQca5tLZRZc45BfKHeqByThKI261QevEK56SyAwwXfKKZjSvkQ5dwTFSgfy76rMSUvVynHYEhdCatBF9HWTAiXPx7hgZixG1FeP_QCmOylz2VClVyYFCbjKREOwBFf-puNYfO75S3LNlJUtTsGGQL2oTKpMsEiUTdefkje91VX9h8g7908lFsggbjV7NicJsufuXxnTj1fcWIrRDeNIOmakiPEODi0gTSz0ou-W-LWK-3T1zYlOIiIKBjsExQKZ-w
Ciphertext
[253, 159, 221, 142, 82, 40, 11, 131, 3, 72, 34, 162, 173, 229, 146, 217,
183, 173, 139, 132, 58, 137, 33, 182, 82, 49, 110, 141, 11, 221, 207, 239,
207, 65, 213, 28, 20, 217, 14, 186, 87, 160, 15, 160, 96, 142, 7, 69,
46, 55, 129, 224, 113, 206, 59, 181, 7, 188, 255, 15, 16, 59, 180, 107,
75, 0, 217, 175, 254, 8, 141, 48, 217, 132, 16, 217, 4, 30, 223, 147]
Encoded Ciphertext
_Z_djlIoC4MDSCKireWS2beti4Q6iSG2UjFujQvdz-_PQdUcFNkOulegD6BgjgdFLjeB4HHOO7UHvP8PEDu0a0sA2a_-CI0w2YQQ2QQe35M
Secured Input
eyJhbGciOiJSU0ExXzUiLCJlbmMiOiJBMTI4Q0JDIiwiaW50IjoiSFMyNTYiLCJpdiI6IkF4WThEQ3REYUdsc2JHbGpiM1JvWlEifQ.IPI_z172hSWHMFgED8EG9DM6hIXU_6NaO1DImCn0vNeuoBq847Sl6qw_GHSYHJUQXtXJq7S_CxWVrI82wjrOyaQca5tLZRZc45BfKHeqByThKI261QevEK56SyAwwXfKKZjSvkQ5dwTFSgfy76rMSUvVynHYEhdCatBF9HWTAiXPx7hgZixG1FeP_QCmOylz2VClVyYFCbjKREOwBFf-puNYfO75S3LNlJUtTsGGQL2oTKpMsEiUTdefkje91VX9h8g7908lFsggbjV7NicJsufuXxnTj1fcWIrRDeNIOmakiPEODi0gTSz0ou-W-LWK-3T1zYlOIiIKBjsExQKZ-w._Z_djlIoC4MDSCKireWS2beti4Q6iSG2UjFujQvdz-_PQdUcFNkOulegD6BgjgdFLjeB4HHOO7UHvP8PEDu0a0sA2a_-CI0w2YQQ2QQe35M
Secured Input Bytes
[101, 121, 74, 104, 98, 71, 99, 105, 79, 105, 74, 83, 85, 48, 69, 120,
88, 122, 85, 105, 76, 67, 74, 108, 98, 109, 77, 105, 79, 105, 74, 66,
77, 84, 73, 52, 81, 48, 74, 68, 73, 105, 119, 105, 97, 87, 53, 48,
73, 106, 111, 105, 83, 70, 77, 121, 78, 84, 89, 105, 76, 67, 74, 112,
100, 105, 73, 54, 73, 107, 70, 52, 87, 84, 104, 69, 81, 51, 82, 69,
89, 85, 100, 115, 99, 50, 74, 72, 98, 71, 112, 105, 77, 49, 74, 118,
87, 108, 69, 105, 102, 81, 46, 73, 80, 73, 95, 122, 49, 55, 50, 104,
83, 87, 72, 77, 70, 103, 69, 68, 56, 69, 71, 57, 68, 77, 54, 104,
73, 88, 85, 95, 54, 78, 97, 79, 49, 68, 73, 109, 67, 110, 48, 118,
78, 101, 117, 111, 66, 113, 56, 52, 55, 83, 108, 54, 113, 119, 95, 71,
72, 83, 89, 72, 74, 85, 81, 88, 116, 88, 74, 113, 55, 83, 95, 67,
120, 87, 86, 114, 73, 56, 50, 119, 106, 114, 79, 121, 97, 81, 99, 97,
53, 116, 76, 90, 82, 90, 99, 52, 53, 66, 102, 75, 72, 101, 113, 66,
121, 84, 104, 75, 73, 50, 54, 49, 81, 101, 118, 69, 75, 53, 54, 83,
121, 65, 119, 119, 88, 102, 75, 75, 90, 106, 83, 118, 107, 81, 53, 100,
119, 84, 70, 83, 103, 102, 121, 55, 54, 114, 77, 83, 85, 118, 86, 121,
110, 72, 89, 69, 104, 100, 67, 97, 116, 66, 70, 57, 72, 87, 84, 65,
105, 88, 80, 120, 55, 104, 103, 90, 105, 120, 71, 49, 70, 101, 80, 95,
81, 67, 109, 79, 121, 108, 122, 50, 86, 67, 108, 86, 121, 89, 70, 67,
98, 106, 75, 82, 69, 79, 119, 66, 70, 102, 45, 112, 117, 78, 89, 102,
79, 55, 53, 83, 51, 76, 78, 108, 74, 85, 116, 84, 115, 71, 71, 81,
76, 50, 111, 84, 75, 112, 77, 115, 69, 105, 85, 84, 100, 101, 102, 107,
106, 101, 57, 49, 86, 88, 57, 104, 56, 103, 55, 57, 48, 56, 108, 70,
115, 103, 103, 98, 106, 86, 55, 78, 105, 99, 74, 115, 117, 102, 117, 88,
120, 110, 84, 106, 49, 102, 99, 87, 73, 114, 82, 68, 101, 78, 73, 79,
109, 97, 107, 105, 80, 69, 79, 68, 105, 48, 103, 84, 83, 122, 48, 111,
117, 45, 87, 45, 76, 87, 75, 45, 51, 84, 49, 122, 89, 108, 79, 73,
105, 73, 75, 66, 106, 115, 69, 120, 81, 75, 90, 45, 119, 46, 95, 90,
95, 100, 106, 108, 73, 111, 67, 52, 77, 68, 83, 67, 75, 105, 114, 101,
87, 83, 50, 98, 101, 116, 105, 52, 81, 54, 105, 83, 71, 50, 85, 106,
70, 117, 106, 81, 118, 100, 122, 45, 95, 80, 81, 100, 85, 99, 70, 78,
107, 79, 117, 108, 101, 103, 68, 54, 66, 103, 106, 103, 100, 70, 76, 106,
101, 66, 52, 72, 72, 79, 79, 55, 85, 72, 118, 80, 56, 80, 69, 68,
117, 48, 97, 48, 115, 65, 50, 97, 95, 45, 67, 73, 48, 119, 50, 89,
81, 81, 50, 81, 81, 101, 51, 53, 77]
Integrity Value
[115, 141, 100, 225, 62, 30, 2, 0, 130, 183, 173, 230, 241, 147, 102, 136,
232, 167, 49, 200, 133, 23, 42, 78, 22, 155, 226, 119, 184, 186, 15, 73]
Encoded Integrity Value
c41k4T4eAgCCt63m8ZNmiOinMciFFypOFpvid7i6D0k
JWE
eyJhbGciOiJSU0ExXzUiLCJlbmMiOiJBMTI4Q0JDIiwiaW50IjoiSFMyNTYiLCJpdiI6IkF4WThEQ3REYUdsc2JHbGpiM1JvWlEifQ.IPI_z172hSWHMFgED8EG9DM6hIXU_6NaO1DImCn0vNeuoBq847Sl6qw_GHSYHJUQXtXJq7S_CxWVrI82wjrOyaQca5tLZRZc45BfKHeqByThKI261QevEK56SyAwwXfKKZjSvkQ5dwTFSgfy76rMSUvVynHYEhdCatBF9HWTAiXPx7hgZixG1FeP_QCmOylz2VClVyYFCbjKREOwBFf-puNYfO75S3LNlJUtTsGGQL2oTKpMsEiUTdefkje91VX9h8g7908lFsggbjV7NicJsufuXxnTj1fcWIrRDeNIOmakiPEODi0gTSz0ou-W-LWK-3T1zYlOIiIKBjsExQKZ-w._Z_djlIoC4MDSCKireWS2beti4Q6iSG2UjFujQvdz-_PQdUcFNkOulegD6BgjgdFLjeB4HHOO7UHvP8PEDu0a0sA2a_-CI0w2YQQ2QQe35M.c41k4T4eAgCCt63m8ZNmiOinMciFFypOFpvid7i6D0k

---

From: "Richard L. Barnes" <[email-masked]>
Date: Wed, 27 Jun 2012 21:40:42 -0400

This is really a comment against the JWE spec, but I'll go ahead and mention it here:

How is the recipient of this object supposed to know that public key to use to verify the object?

On Jun 26, 2012, at 8:32 PM, Mike Jones wrote:

> For the next round of the JOSE JWE spec, I’m adding example encryption computations to aid implementers.  An example JWE computation is included below, in case you’d like to compare your implementations against these.  These values have already been verified by two independent implementations.
>  
> All relevant values should be present below.  For the RSA key parameters, the field names used are the ones from the .NET RSAParameters structure documented athttp://msdn.microsoft.com/en-us/library/system.security.cryptography.rsaparameters_members(v=vs.71).
>  
>                                                                Enjoy,
>                                                                 -- Mike
>  
> CMK
> <JWE.log>_______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose

---

From: Richard L. Barnes <[email-masked]>
Date: Wed, 27 Jun 2012 21:41:43 -0400

> How is the recipient of this object supposed to know that public key to use to verify the object?

s/public key/private key/
s/verify/decrypt/

Sorry, was thinking JWS.  Same comment applies to JWS, though, IIRC.

--Richard

---

From: Breno de Medeiros <[email-masked]>
Date: Wed, 27 Jun 2012 18:56:01 -0700

The recipient will use the issuer information to decide what keys and means
to retrieve them are acceptable in the application security context. The
actual keys may be supplied by URL, for instance, in the envelope.

On Wed, Jun 27, 2012 at 6:41 PM, Richard L. Barnes <[email-masked]> wrote:

> >> For the next round of the JOSE JWE spec, I’m adding example encryption
> computations to aid implementers.  An example JWE computation is included
> below, in case you’d like to compare your implementations against these.
>  These values have already been verified by two independent implementations.
> >>
> >>  - Deriving the CEK and CIK from the CMK (in this case, using the same
> values as EXAMPLE 1 from my Key Derivation message)
> >> Note that because RSA PKCS #1-1.5 padding uses random values, the
> encrypted CMK value will not be repeatable, although all resulting values
> will be decryptable to retrieve the original CMK value.
> >>
> >> All relevant values should be present below.  For the RSA key
> parameters, the field names used are the ones from the .NET RSAParameters
> structure documented athttp://
> msdn.microsoft.com/en-us/library/system.security.cryptography.rsaparameters_members(v=vs.71)
> .
> >>
> >>                                                               Enjoy,
> >>                                                                -- Mike
> >>
> >> CMK
> _______________________________________________
> jose mailing list
> [email-masked]

-- 
--Breno

---

From: "Richard L. Barnes" <[email-masked]>
Date: Wed, 27 Jun 2012 22:16:42 -0400

Am I missing where the issuer information is in the example message?  Or is the example incomplete?  Or do you expect this information to be entirely out of band?

On Jun 27, 2012, at 9:56 PM, Breno de Medeiros wrote:

> The recipient will use the issuer information to decide what keys and means to retrieve them are acceptable in the application security context. The actual keys may be supplied by URL, for instance, in the envelope.
> 
>

---

From: Breno de Medeiros <[email-masked]>
Date: Wed, 27 Jun 2012 19:36:34 -0700

In this particular example it is OOB. In general JWE is not a trust
framework spec (neither needs to be) so trust is OOB but key identification
metadata can be transported via tokens.
On Jun 27, 2012 7:16 PM, "Richard L. Barnes" <[email-masked]> wrote:

> Am I missing where the issuer information is in the example message?  Or
> is the example incomplete?  Or do you expect this information to be
> entirely out of band?
>
>
>
> > The recipient will use the issuer information to decide what keys and
> means to retrieve them are acceptable in the application security context.
> The actual keys may be supplied by URL, for instance, in the envelope.
> >
> >
> > >> For the next round of the JOSE JWE spec, I’m adding example
> encryption computations to aid implementers.  An example JWE computation is
> included below, in case you’d like to compare your implementations against
> these.  These values have already been verified by two independent
> implementations.
> > >>
> > >>  - Deriving the CEK and CIK from the CMK (in this case, using the
> same values as EXAMPLE 1 from my Key Derivation message)

---

From: "Manger, James H" <[email-masked]>
Date: Thu, 28 Jun 2012 16:22:41 +1000

The calculations in these examples worked for me too. Providing binary values as comma-separated decimal values for each byte is a bit annoying. I guess this is a JavaScript thing.

The key derivation cannot really call itself the Concat KDF from NIST 800 56A. Leaving the AlgorithmID, PartyUInfo (sender id), and PartyVInfo (receiver id) empty is not allowed. Additionally, the NIST spec’s way of deriving an HMAC and AES key would be to run the KDF once to generate enough bits for both keys (“concatenated”). JWE, in contrast, runs the KDF twice to get the HMAC and AES keys separately.

Nothing actually specifies the actual key size for the HS256 calculation. JWA only says 256-bits is the minimum key length.

Please put a key id in the header. JWE decryption step 5 says “verify that the JWE Header references a key known to the recipient” which is a bit hard with no key reference. Everyone should support key rollover (even if manually) which basically needs a key id so it may as well be mandatory. If the key id is conveyed out-of-band (or merely implied) it isn’t protected by the integrity check – which almost starts to undo the argument for integrity-protection of the header.

--
James Manger

From: [email-masked] [mailto:[email-masked]] On Behalf Of Mike Jones
Sent: Wednesday, 27 June 2012 10:33 AM
To: [email-masked]
Subject: [jose] Complete JWE computation example

…