I am trying to encrypt a request using the JWE mechanism as per my vendor's requirement and for that I have to do multiple steps which are as follows
- First use one crt file used as certificate and encrypt it using algo RSA-OAEP-256
- Then use our plain request and encrypt it using the above key using A256GCM algorithm
- At last when Sign this encrypted request using our private key using RS256
Now I am performing this in PHP laravel and somehow i have managed to do so but when I am sending my request to vendor end there is decryption failure .
Firstly i am not sure if I am doing right or not ,I found one package providing the feature PHP JWE package
they have explained very well each and evry steps and i did the same , but somehow there are some mistakes which i am not able to verify
//key encryption algoritm
$keyEncryptionAlgorithmManager = new AlgorithmManager([
new RSAOAEP256(),
]);
//content encryption algorithm
$contentEncryptionAlgorithmManager = new AlgorithmManager([
new A256GCM(),
]);
//compression manager if needed
$compressionMethodManager = new CompressionMethodManager([
new Deflate(),
]);
//create key from certificate from axis
$key = JWKFactory::createFromCertificateFile(
public_path('my_cert.crt'), // The filename
[
'use' => 'enc', // Additional parameters
// 'use' => 'sig',// signature
]
);
// We instantiate our JWE Builder.
$jweBuilder = new JWEBuilder(
$keyEncryptionAlgorithmManager,
$contentEncryptionAlgorithmManager,
$compressionMethodManager
);
$payload = json_encode($request);
$jwe = $jweBuilder
->create() // We want to create a new JWE
->withPayload($payload) // We set the payload
->withSharedProtectedHeader([
'alg' => 'RSA-OAEP-256', // Key Encryption Algorithm
'enc' => 'A256GCM', // Content Encryption Algorithm
// 'zip' => 'DEF', // We enable the compression (irrelevant as the payload is small, just for the example).
])
->addRecipient($key) // We add a recipient (a shared key or public key).
->build(); // We build it
$serializer = new CompactSerializerForEncryption(); // The serializer
$token = $serializer->serialize($jwe, 0); // We serialize the recipient at index 0 (we only have one recipient)
this process is for creating JWE objedt using public certificate given by vendor after encrypting request i have to sign it using private key and I guess I am doing something wrong here as JWE is for encryption and JWS is for signing so for signing process i did this
$signAlgorithmManager = new AlgorithmManager([
new RS256(),
]);
// create key from our private key
$key = JWKFactory::createFromKeyFile(
public_path('my_private_key.key'), // The filename
'private_key_password',
[
'use' => 'sig', // Additional parameters
]
);
// We instantiate our JWS Builder.
$jwsBuilder = new JWSBuilder($signAlgorithmManager);
$payload = $token;
$jws = $jwsBuilder
->create() // We want to create a new JWS
->withPayload($payload) // We set the payload
->addSignature($key, ['alg' => 'RS256']) // We add a signature with a simple protected header
->build();
$serializer = new CompactSerializerForSignature(); // The serializer
$newToken = $serializer->serialize($jws, 0);
but i am not sure for this process so my question here arises that if this is right process for signing my encrypted request or if there is anything else which i am missing please suggest me.