Pascal (Lazarus/Delphi)

JWE using PBES2 Key Wrapping

See more JSON Web Encryption (JWE) Examples

Demonstrates how to create and decrypt a JWE that using PBES2 key wrapping.

This example demonstrates PBES2 with HMAC SHA-256 and A128KW wrapping. It is also possible to do the following by simply changing the "alg" parameter:

• PBES2 with HMAC SHA-384 and A192KW wrapping
• PBES2 with HMAC SHA-512 and A256KW wrapping

Note: This example requires Chilkat v9.5.0.66 or greater.

Pascal (Lazarus/Delphi)

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.Jwe,
  Chilkat.Prng,
  Chilkat.JsonObject;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  plaintext: string;
  jwe: TJwe;
  jweProtHdr: TJsonObject;
  prng: TPrng;
  recipientIndex: Integer;
  strJwe: string;
  jwe2: TJwe;
  originalPlaintext: string;

begin
  success := False;

  //  This requires the Chilkat API to have been previously unlocked.
  //  See Global Unlock Sample for sample code.

  //  Note: This example requires Chilkat v9.5.0.66 or greater.

  plaintext := 'Live long and prosper.';

  jwe := TJwe.Create;

  //  First build the JWE Protected Header..
  jweProtHdr := TJsonObject.Create;
  jweProtHdr.AppendString('alg','PBES2-HS256+A128KW');
  jweProtHdr.AppendString('enc','A128GCM');

  //  PBES2 requires two additional parameters:
  //  1) A random salt parameter ("p2s") containing 8 or more bytes in base64url format.
  //  2) An iteration count parameter ("p2c").  A minimum count of 1000 is recommended.
  //     The iteration count is intended to make the PBES2 computation more expensive (time consuming)
  //     to prevent brute-force attacks.
  prng := TPrng.Create;
  jweProtHdr.AppendString('p2s',prng.GenRandom(16,'base64url'));
  jweProtHdr.AppendString('p2c','1000');

  WriteLn('JWE Protected Header: ' + jweProtHdr.Emit());
  WriteLn('--');

  //  Don't forget to actually provide the protected header to the JWE object:
  jwe.SetProtectedHeader(jweProtHdr);

  //  Set the PBES2 password
  recipientIndex := 0;
  jwe.SetPassword(recipientIndex,'top secret');

  //  Encrypt and return the JWE:
  strJwe := jwe.Encrypt(plaintext,'utf-8');
  if (jwe.LastMethodSuccess <> True) then
    begin
      WriteLn(jwe.LastErrorText);
      Exit;
    end;

  //  Show the JWE we just created:
  WriteLn(strJwe);

  //  Decrypt the JWE.
  jwe2 := TJwe.Create;
  success := jwe2.LoadJwe(strJwe);
  if (success <> True) then
    begin
      WriteLn(jwe2.LastErrorText);
      Exit;
    end;
  //  Set the PBES2 password
  jwe2.SetPassword(recipientIndex,'top secret');

  //  Decrypt.
  originalPlaintext := jwe2.Decrypt(0,'utf-8');
  if (jwe2.LastMethodSuccess <> True) then
    begin
      WriteLn(jwe2.LastErrorText);
      Exit;
    end;

  WriteLn('original text: ');
  WriteLn(originalPlaintext);

  //  Sample output:

  //  JWE Protected Header: {"alg":"PBES2-HS256+A128KW","enc":"A128GCM","p2s":"z39rTEfRy1T1Yn_D1mZRlg","p2c":"1000"}
  //  --
  //  eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIiwicDJzIjoiejM5clRFZlJ5MVQxWW5fRDFtWlJsZyIsInAyYyI6IjEwMDAifQ.koYt6PrFmYwcwdcT7ZcvXHA1d-Xez5h4.luGlbvEnZp-7IsBOj42Yhw.YMTcfLf8Qe4zazozGV2OAu3cUdQ8Kg.rWub47ESWkc6IqZJTvSTmg
  //  original text: 
  //  Live long and prosper.


  jwe.Free;
  jweProtHdr.Free;
  prng.Free;
  jwe2.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.