How to sign a token after encrypting it using private key in PHP?

Viewed 42

I am trying to encrypt a request using the JWE mechanism as per my vendor's requirement and for that I have to do multiple steps which are as follows

  1. First use one crt file used as certificate and encrypt it using algo RSA-OAEP-256
  2. Then use our plain request and encrypt it using the above key using A256GCM algorithm
  3. At last when Sign this encrypted request using our private key using RS256

Now I am performing this in PHP laravel and somehow i have managed to do so but when I am sending my request to vendor end there is decryption failure .

Firstly i am not sure if I am doing right or not ,I found one package providing the feature PHP JWE package

they have explained very well each and evry steps and i did the same , but somehow there are some mistakes which i am not able to verify

//key encryption algoritm
        $keyEncryptionAlgorithmManager = new AlgorithmManager([
            new RSAOAEP256(),
        ]);

        //content encryption algorithm
        $contentEncryptionAlgorithmManager = new AlgorithmManager([
            new A256GCM(),
        ]);

        //compression manager if needed
        $compressionMethodManager = new CompressionMethodManager([
            new Deflate(),
        ]);

        //create key from certificate from axis
        $key = JWKFactory::createFromCertificateFile(
            public_path('my_cert.crt'), // The filename
            [
                'use' => 'enc', // Additional parameters
                // 'use' => 'sig',// signature
            ]
        );

        // We instantiate our JWE Builder.
        $jweBuilder = new JWEBuilder(
            $keyEncryptionAlgorithmManager,
            $contentEncryptionAlgorithmManager,
            $compressionMethodManager
        );

        $payload = json_encode($request);

        $jwe = $jweBuilder
            ->create() // We want to create a new JWE
            ->withPayload($payload) // We set the payload
            ->withSharedProtectedHeader([
                'alg' => 'RSA-OAEP-256', // Key Encryption Algorithm
                'enc' => 'A256GCM', // Content Encryption Algorithm
                // 'zip' => 'DEF', // We enable the compression (irrelevant as the payload is small, just for the example).
            ])
            ->addRecipient($key) // We add a recipient (a shared key or public key).
            ->build(); // We build it

        $serializer = new CompactSerializerForEncryption(); // The serializer
        $token = $serializer->serialize($jwe, 0); // We serialize the recipient at index 0 (we only have one recipient)

this process is for creating JWE objedt using public certificate given by vendor after encrypting request i have to sign it using private key and I guess I am doing something wrong here as JWE is for encryption and JWS is for signing so for signing process i did this

 $signAlgorithmManager = new AlgorithmManager([
            new RS256(),
        ]);

        // create key from our private key
        $key = JWKFactory::createFromKeyFile(
            public_path('my_private_key.key'), // The filename
            'private_key_password',
            [
                'use' => 'sig', // Additional parameters
            ]
        );

        // We instantiate our JWS Builder.
        $jwsBuilder = new JWSBuilder($signAlgorithmManager);

        $payload = $token;

        $jws = $jwsBuilder
            ->create() // We want to create a new JWS
            ->withPayload($payload) // We set the payload
            ->addSignature($key, ['alg' => 'RS256']) // We add a signature with a simple protected header
            ->build();

        $serializer = new CompactSerializerForSignature(); // The serializer

        $newToken = $serializer->serialize($jws, 0);

but i am not sure for this process so my question here arises that if this is right process for signing my encrypted request or if there is anything else which i am missing please suggest me.

1 Answers

I am also facing same issue, but my friend solved my issue by writing some python code if you want i can share to you too, I had issue with decrypting singpass api person payload

Related