Decrypt a JWE to a String

See more JSON Web Encryption (JWE) Examples

Demonstrates Jwe.Decrypt, which decrypts a recipient of a loaded JWE and returns the plaintext, decoded using the given charset. Before decrypting, the example inspects the JWE protected header and, under application policy, accepts only permitted algorithms and selects an acceptable recipient.

integer li_rc
integer li_Success
oleobject loo_Jwe
string ls_JweCompact
oleobject loo_ProtHeader
oleobject loo_SbAlg
oleobject loo_SbEnc
integer li_BCaseSensitive
integer li_RecipientIndex
string ls_Base64Key
string ls_Content

li_Success = 0

loo_Jwe = create oleobject
li_rc = loo_Jwe.ConnectToNewObject("Chilkat.Jwe")
if li_rc < 0 then
    destroy loo_Jwe
    MessageBox("Error","Connecting to COM object failed")
    return
end if

//  Load the JWE compact serialization to be decrypted.
ls_JweCompact = "eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJBMjU2R0NNIn0.<...>.<iv>.<ciphertext>.<tag>"
li_Success = loo_Jwe.LoadJwe(ls_JweCompact)
if li_Success = 0 then
    Write-Debug loo_Jwe.LastErrorText
    destroy loo_Jwe
    return
end if

//  Application policy: before decrypting, inspect the JWE header and accept only algorithms the
//  application trusts.  Never assume the algorithms in a received JWE are safe -- a sender could
//  specify a weak or unexpected algorithm.
loo_ProtHeader = create oleobject
li_rc = loo_ProtHeader.ConnectToNewObject("Chilkat.JsonObject")

li_Success = loo_Jwe.GetProtectedHeader(loo_ProtHeader)
if li_Success = 0 then
    Write-Debug loo_Jwe.LastErrorText
    destroy loo_Jwe
    destroy loo_ProtHeader
    return
end if

//  Read the alg (key-management) and enc (content-encryption) header values into StringBuilder
//  objects so they can be compared.
loo_SbAlg = create oleobject
li_rc = loo_SbAlg.ConnectToNewObject("Chilkat.StringBuilder")

li_Success = loo_ProtHeader.StringOfSb("alg",loo_SbAlg)
if li_Success = 0 then
    Write-Debug loo_ProtHeader.LastErrorText
    destroy loo_Jwe
    destroy loo_ProtHeader
    destroy loo_SbAlg
    return
end if

loo_SbEnc = create oleobject
li_rc = loo_SbEnc.ConnectToNewObject("Chilkat.StringBuilder")

li_Success = loo_ProtHeader.StringOfSb("enc",loo_SbEnc)
if li_Success = 0 then
    Write-Debug loo_ProtHeader.LastErrorText
    destroy loo_Jwe
    destroy loo_ProtHeader
    destroy loo_SbAlg
    destroy loo_SbEnc
    return
end if

Write-Debug "JWE algorithms: alg=" + loo_SbAlg.GetAsString() + " enc=" + loo_SbEnc.GetAsString()

//  Enforce an allowlist of acceptable algorithms.  Reject anything not permitted by policy.  String
//  values are compared using StringBuilder.ContentsEqual.
li_BCaseSensitive = 1
if loo_SbAlg.ContentsEqual("A256KW",li_BCaseSensitive) <> 1 then
    Write-Debug "Rejecting JWE: key-management algorithm is not permitted by policy."
    destroy loo_Jwe
    destroy loo_ProtHeader
    destroy loo_SbAlg
    destroy loo_SbEnc
    return
end if

if loo_SbEnc.ContentsEqual("A256GCM",li_BCaseSensitive) <> 1 then
    Write-Debug "Rejecting JWE: content-encryption algorithm is not permitted by policy."
    destroy loo_Jwe
    destroy loo_ProtHeader
    destroy loo_SbAlg
    destroy loo_SbEnc
    return
end if

//  Select an acceptable recipient.  For a multi-recipient JWE, FindRecipient locates the recipient
//  this application holds a key for by a per-recipient header value such as "kid".  A compact JWE
//  has a single recipient at index 0, so FindRecipient returns -1; fall back to index 0 in that case.
li_RecipientIndex = loo_Jwe.FindRecipient("kid","recipient-key-1",li_BCaseSensitive)
if li_RecipientIndex < 0 then
    li_RecipientIndex = 0
end if

//  Provide the key for the selected recipient.  In production, obtain the key from a secure source
//  rather than hard-coding it.
ls_Base64Key = "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU="
li_Success = loo_Jwe.SetWrappingKey(li_RecipientIndex,ls_Base64Key,"base64")
if li_Success = 0 then
    Write-Debug loo_Jwe.LastErrorText
    destroy loo_Jwe
    destroy loo_ProtHeader
    destroy loo_SbAlg
    destroy loo_SbEnc
    return
end if

//  Decrypt the selected recipient and return the plaintext, decoded using the given charset.
ls_Content = loo_Jwe.Decrypt(li_RecipientIndex,"utf-8")
if loo_Jwe.LastMethodSuccess = 0 then
    Write-Debug loo_Jwe.LastErrorText
    destroy loo_Jwe
    destroy loo_ProtHeader
    destroy loo_SbAlg
    destroy loo_SbEnc
    return
end if

Write-Debug ls_Content


destroy loo_Jwe
destroy loo_ProtHeader
destroy loo_SbAlg
destroy loo_SbEnc