Decrypt a JWE to a String

See more JSON Web Encryption (JWE) Examples

Demonstrates Jwe.Decrypt, which decrypts a recipient of a loaded JWE and returns the plaintext, decoded using the given charset. Before decrypting, the example inspects the JWE protected header and, under application policy, accepts only permitted algorithms and selects an acceptable recipient.

Dim success As Long
success = 0

Dim jwe As New ChilkatJwe

'  Load the JWE compact serialization to be decrypted.
Dim jweCompact As String
jweCompact = "eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJBMjU2R0NNIn0.<...>.<iv>.<ciphertext>.<tag>"
success = jwe.LoadJwe(jweCompact)
If (success = 0) Then
    Debug.Print jwe.LastErrorText
    Exit Sub
End If

'  Application policy: before decrypting, inspect the JWE header and accept only algorithms the
'  application trusts.  Never assume the algorithms in a received JWE are safe -- a sender could
'  specify a weak or unexpected algorithm.
Dim protHeader As New ChilkatJsonObject
success = jwe.GetProtectedHeader(protHeader)
If (success = 0) Then
    Debug.Print jwe.LastErrorText
    Exit Sub
End If

'  Read the alg (key-management) and enc (content-encryption) header values into StringBuilder
'  objects so they can be compared.
Dim sbAlg As New ChilkatStringBuilder
success = protHeader.StringOfSb("alg",sbAlg)
If (success = 0) Then
    Debug.Print protHeader.LastErrorText
    Exit Sub
End If

Dim sbEnc As New ChilkatStringBuilder
success = protHeader.StringOfSb("enc",sbEnc)
If (success = 0) Then
    Debug.Print protHeader.LastErrorText
    Exit Sub
End If

Debug.Print "JWE algorithms: alg=" & sbAlg.GetAsString() & " enc=" & sbEnc.GetAsString()

'  Enforce an allowlist of acceptable algorithms.  Reject anything not permitted by policy.  String
'  values are compared using StringBuilder.ContentsEqual.
Dim bCaseSensitive As Long
bCaseSensitive = 1
If (sbAlg.ContentsEqual("A256KW",bCaseSensitive) <> 1) Then
    Debug.Print "Rejecting JWE: key-management algorithm is not permitted by policy."
    Exit Sub
End If

If (sbEnc.ContentsEqual("A256GCM",bCaseSensitive) <> 1) Then
    Debug.Print "Rejecting JWE: content-encryption algorithm is not permitted by policy."
    Exit Sub
End If

'  Select an acceptable recipient.  For a multi-recipient JWE, FindRecipient locates the recipient
'  this application holds a key for by a per-recipient header value such as "kid".  A compact JWE
'  has a single recipient at index 0, so FindRecipient returns -1; fall back to index 0 in that case.
Dim recipientIndex As Long
recipientIndex = jwe.FindRecipient("kid","recipient-key-1",bCaseSensitive)
If (recipientIndex < 0) Then
    recipientIndex = 0
End If

'  Provide the key for the selected recipient.  In production, obtain the key from a secure source
'  rather than hard-coding it.
Dim base64Key As String
base64Key = "YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXowMTIzNDU="
success = jwe.SetWrappingKey(recipientIndex,base64Key,"base64")
If (success = 0) Then
    Debug.Print jwe.LastErrorText
    Exit Sub
End If

'  Decrypt the selected recipient and return the plaintext, decoded using the given charset.
Dim content As String
content = jwe.Decrypt(recipientIndex,"utf-8")
If (jwe.LastMethodSuccess = 0) Then
    Debug.Print jwe.LastErrorText
    Exit Sub
End If

Debug.Print content