Perl Requires Chilkat v9.5.0.66+

JWE using PBES2 Key Wrapping

See more JSON Web Encryption (JWE) Examples

Demonstrates how to create and decrypt a JWE that using PBES2 key wrapping.

This example demonstrates PBES2 with HMAC SHA-256 and A128KW wrapping. It is also possible to do the following by simply changing the "alg" parameter:

• PBES2 with HMAC SHA-384 and A192KW wrapping
• PBES2 with HMAC SHA-512 and A256KW wrapping

Chilkat2 Perl

use strict;
use warnings;
use Chilkat2;

# This requires the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

my $plaintext = 'Live long and prosper.';

my $jwe = Chilkat2::Jwe->new;

# First build the JWE Protected Header..
my $jweProtHdr = Chilkat2::JsonObject->new;
$jweProtHdr->AppendString('alg', 'PBES2-HS256+A128KW');
$jweProtHdr->AppendString('enc', 'A128GCM');

# PBES2 requires two additional parameters:
# 1) A random salt parameter ("p2s") containing 8 or more bytes in base64url format.
# 2) An iteration count parameter ("p2c").  A minimum count of 1000 is recommended.
#    The iteration count is intended to make the PBES2 computation more expensive (time consuming)
#    to prevent brute-force attacks.
my $prng = Chilkat2::Prng->new;
$jweProtHdr->AppendString('p2s', $prng->GenRandom(16, 'base64url'));
$jweProtHdr->AppendString('p2c', '1000');

print 'JWE Protected Header: ', $jweProtHdr->Emit(), "\n";
print "--\n";

# Don't forget to actually provide the protected header to the JWE object:
$jwe->SetProtectedHeader($jweProtHdr);

# Set the PBES2 password
my $recipientIndex = 0;
$jwe->SetPassword($recipientIndex, 'top secret');

# Encrypt and return the JWE:
my $strJwe = $jwe->Encrypt($plaintext, 'utf-8');
if (!$jwe->LastMethodSuccess) {
    print $jwe->LastErrorText, "\n";
    exit;
}

# Show the JWE we just created:
print $strJwe, "\n";

# Decrypt the JWE.
my $jwe2 = Chilkat2::Jwe->new;
my $success = $jwe2->LoadJwe($strJwe);
if (!$success) {
    print $jwe2->LastErrorText, "\n";
    exit;
}

# Set the PBES2 password
$jwe2->SetPassword($recipientIndex, 'top secret');

# Decrypt.
my $originalPlaintext = $jwe2->Decrypt(0, 'utf-8');
if (!$jwe2->LastMethodSuccess) {
    print $jwe2->LastErrorText, "\n";
    exit;
}

print "original text: \n";
print $originalPlaintext, "\n";

# Sample output:

# JWE Protected Header: {"alg":"PBES2-HS256+A128KW","enc":"A128GCM","p2s":"z39rTEfRy1T1Yn_D1mZRlg","p2c":"1000"}
# --
# eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMTI4R0NNIiwicDJzIjoiejM5clRFZlJ5MVQxWW5fRDFtWlJsZyIsInAyYyI6IjEwMDAifQ.koYt6PrFmYwcwdcT7ZcvXHA1d-Xez5h4.luGlbvEnZp-7IsBOj42Yhw.YMTcfLf8Qe4zazozGV2OAu3cUdQ8Kg.rWub47ESWkc6IqZJTvSTmg
# original text:
# Live long and prosper.