node.js - 如何使用 node-jose 生成加密的 JWE

Question

我正在使用 node-jose v0.11.0 ( https://www.npmjs.com/package/node-jose ) 进行 JWK 和 JWE 操作。我有一个 JWK 格式的 RSA key ，我可以将其加载到 JWK keystore 中并再次提取。但是，当我尝试加密任何内容时，我会遇到“error2”、“不支持的算法”。 RSA 怎么可能是不受支持的算法？

import * as jose from "node-jose";

const webkey = {
        "keys": [
            {
                "kty": "RSA",
                "e": "AQAB",
                "kid": "a024254d-0321-459f-9530-93020ce9d54a",
                "key_ops": [
                    "encrypt"
                ],
                "n": "jkHgYN98dlR2w7NX-gekCWaCdbxs7X4XXh52DVQrK--krwUYqRbBIUEw1bV8KX0ox6TLt-e6wpYsYYFUItSd5ySqohHRMq1IhyE2zpEC95BA9V7VrFUYnczf1bd5c-aR079aoz5JPXfqx01TzNfxWBb04SlRjsmJeY1v6JrDUI5U0FSOmnJTb3tSS6Szrvi_qOyViYp4v9V2_OVYy45kF_LQQy-pr-kP4gapXL235cieeTW6UvkhzaPT2D-JKyzVjjjgnfRXr8Ox9I9c4wpef2-5nPPeafB5EnOMpJE11KzO_8xxiTGUywPPLQagBvY35gkhQbYS2dv3NGIVSLZHFw"
            }
        ]
    };
    console.log("webkey", webkey);

    //generate key store from public JWK
    jose.JWK.asKeyStore(webkey)
        .then((result) => {
            console.log("Key Store", JSON.stringify(result.toJSON()));
            let keyStore = result;

            //get the key to encrypt
            const encryptionKey: jose.JWK.Key = keyStore.get(webkey.keys[0].kid);
            const output = jose.util.base64url.encode("Hello World");
            const output2 = jose.util.asBuffer(output);

            //encrypting content
            jose.JWE.createEncrypt(encryptionKey)
                .update(output2)
                .final()
                .then((jweInGeneralSerialization) => {
                    console.log("Encryption result", JSON.stringify(jweInGeneralSerialization));
                }, (error) => {
                    console.log("error2", error.message);
                });

        }, (error) => {
            console.log("error1", error.message);
        })

输出如下:

'webkey', Object{keys: [Object{kty: ..., e: ..., kid: ..., key_ops: ..., n: ...}]}
'Key Store', '{"keys":[{"kty":"RSA","kid":"a024254d-0321-459f-9530-93020ce9d54a","key_ops":["encrypt"],"e":"AQAB","n":"jkHgYN98dlR2w7NX-gekCWaCdbxs7X4XXh52DVQrK--krwUYqRbBIUEw1bV8KX0ox6TLt-e6wpYsYYFUItSd5ySqohHRMq1IhyE2zpEC95BA9V7VrFUYnczf1bd5c-aR079aoz5JPXfqx01TzNfxWBb04SlRjsmJeY1v6JrDUI5U0FSOmnJTb3tSS6Szrvi_qOyViYp4v9V2_OVYy45kF_LQQy-pr-kP4gapXL235cieeTW6UvkhzaPT2D-JKyzVjjjgnfRXr8Ox9I9c4wpef2-5nPPeafB5EnOMpJE11KzO_8xxiTGUywPPLQagBvY35gkhQbYS2dv3NGIVSLZHFw"}]}'
'error2', 'unsupported algorithm'

更新我在实际代码中挖掘了一下，发现在“basekey.js”中抛出了错误，因为库的算法是空的。

 Object.defineProperty(this, "encrypt", {
 value: function(alg, data, props) {
  // validate appropriateness
  if (this.algorithms("encrypt").indexOf(alg) === -1) {
      console.log("Algorithm USED", alg
      );
      console.log("All algorithms", this.algorithms("encrypt"))
    return Promise.reject(new Error("unsupported algorithm"));
  }

这里的输出是:

'Algorithm USED', 'A128CBC-HS256'
'All algorithms', []

Answer 1

我在另一个问题中添加了一个示例: node-jose explanation / example?

我在研究证明中使用了 node-jose，为了反射(reflect)我的 c# 代码，我只在我的服务器(用 c# 编写)上创建用于解密和验证的签名和加密 token 。

I need to use symetric secret key or asymetric public private key pair ?

我使用 RSA key 进行非对称签名和 key 包装内容的对称加密细节。内容加密的加密算法是对称算法。 node-jose 包生成了对称 key 。 Key Wrap 算法加密了对称 key 。

我的 C# 代码解密并验证 token 签名。请注意:我使用包的功能来完成所有工作。

这是我的 runkit 笔记本，用于我的检查:

用于签名 (JWS) https://runkit.com/archeon2/5bd66a8e7ee3b70012ec2e39

用于加密 (JWE) https://runkit.com/archeon2/5bd6736ff36b39001313262a

在我的决赛中，我将两者结合起来，创建了一个签名 token ，然后使用输出作为加密 token (JWS + JWE) 的有效负载。我成功地使用 c# 服务器代码解密和验证创建的 token 。

JWS + JWE:https://runkit.com/archeon2/jws-jwe-integration

How i need to generate and where i need to store keys in my server node app to then allow me to sign and verify my tokens ?

var store = jose.JWK.createKeyStore();
await store.generate("RSA",2048,{alg:"RS256", key_ops:["sign", "decrypt", "unwrap"]});
lkey = (await store.get());
var key = lkey.toJSON(); //get public key to exchange
key.use = "sig";
key.key_ops=["encrypt","verify", "wrap"];

var pubKey = await jose.JWK.asKey(key);
key = null;

Keystore 可以序列化为 JSON，所以我的想法是将其存储在 session 存储或浏览器的本地存储中。然后检索 JSON 表示并读入 keystore 。

var store= await jose.JWK.asKeyStore({"keys":[{"kty":"RSA","kid":"h9VHWShTfENF6xwjF3FR_b-9k1MvBvl3gnWnthV0Slk","alg":"RS256","key_ops":["sign","decrypt","unwrap"],"e":"AQAB","n":"l61fUp2hM3QxbFKk182yI5wTtiVS-g4ZxB4SXiY70sn23TalKT_01bgFElICexBXYVBwEndp6Gq60fCbaBeqTEyRvVbIlPlelCIhtYtL32iHvkkh2cXUgrQOscLGBm-8aWVtZE3HrtO-lu23qAoV7cGDU0UkX9z2QgQVmvT0JYxFsxHEYuWBOiWSGcBCgH10GWj40QBryhCPVtkqxBE3CCi9qjMFRaDqUg6kLqY8f0jtpY9ebgYWOmc1m_ujh7K6EDdsdn3D_QHfwtXtPi0ydEWu7pj1vq5AqacOd7AQzs4sWaTmMrpD9Ux43SVHbXK0UUkN5z3hcy6utysiBjqOwQ","d":"AVCHWvfyxbdkFkRBGX225Ygcw59fMLuejYyVLCu4qQMHGLO4irr7LD8EDDyZuOdTWoyP7BkM2e7S367uKeDKoQ6o1LND2cavgykokaI7bhxB0OxhVrnYNanJ1tCRVszxHRi78fqamHFNXZGB3fr4Za8frEEVJ5-KotfWOBmXZBvnoXbYbFXsKuaGo121AUCcEzFCGwuft75kPawzNjcdKhItfFrYh45OQLIO08W0fr_ByhxzWMU7yFUCELHSX5-4GT8ssq1dtvVgY2G14PbT67aYWJ2V571aSxM8DTwHrnB9tI8btbkXWt9JyVoQq13wDdo5fVN-c_5t07HBIaPoAQ","p":"8nLGa9_bRnke1w4paNCMjpdJ--eOUpZYbqEa8jnbsiaSWFwxZiOzUakIcpJ3iO0Bl28JEcdVbo7DE7mZ4M3BkOtm577cNuuK8243L7-k1a71X_ko2mQ3yF4rG2PzWAH_5P4wca1uk0Jj3PmhbkXDI6f_btm1X7Vw_U1K6jRhNbE","q":"oCe94Bed1Wzh-xgNq0hz52Z6WLf9eQlNxLzBbYkpLc_bGj9vMeGNO10qdxhWPi8ClkW9h5gBiFEk2s6aEWYRvIoZjrMYXD7xzyTNC5zcsikjNhM3FVj-kVdqUJy25o9uqgn2IwTvQr5WSKuxz37ZSnItEqK5SEgpCpjwEju_XhE","dp":"jAe2ir-0ijOSmGtZh2xMgl7nIFNRZGnpkZwDUDwSpAabJ-W3smKUQ2n5sxLdb3xUGv7KojYbJcvW6CGeurScQ_NycA9QaXgJvSe_QBjUP4bZuiDSc7DGdzfMdfl4pzAgeEZH_KBK6UrDGvIjRumMF6AEbCXaF_lX1TU7O6IdM0E","dq":"fDU2OjS2sQ5n2IAYIc3oLf-5RVM0nwlLKhil_xiQOjppF9s4lrvx96dSxti2EjYNUJQ34JBQJ_OenJ_8tx-tA8cq-RQHAYvDp75H1AjM1NO4vjh60PCbRgdAqdJQu1FkJzXgkdpC4UWSz3txRJaBWQ5hzIEtJ1Tnl5NzJQD3crE","qi":"3EoKqhKh5mwVGldSjwUGX7xnfQIfkQ4IETsQZh9jcfOFlf9f8rT2qnJ7eeJoXWlm5jwMnsTZAMg4l3rUlbYmCdg10zGA5PDadnRoCnSgMBF87d0mVYXxM1p2C-JmLJjqKhJObr3wndhvBXUImo_jV6aHismwkUjc1gSx_b3ajyU"},{"kty":"RSA","kid":"h9VHWShTfENF6xwjF3FR_b-9k1MvBvl3gnWnthV0Slk","use":"verify","alg":"RS256","key_ops":["encrypt","verify","wrap"],"e":"AQAB","n":"l61fUp2hM3QxbFKk182yI5wTtiVS-g4ZxB4SXiY70sn23TalKT_01bgFElICexBXYVBwEndp6Gq60fCbaBeqTEyRvVbIlPlelCIhtYtL32iHvkkh2cXUgrQOscLGBm-8aWVtZE3HrtO-lu23qAoV7cGDU0UkX9z2QgQVmvT0JYxFsxHEYuWBOiWSGcBCgH10GWj40QBryhCPVtkqxBE3CCi9qjMFRaDqUg6kLqY8f0jtpY9ebgYWOmc1m_ujh7K6EDdsdn3D_QHfwtXtPi0ydEWu7pj1vq5AqacOd7AQzs4sWaTmMrpD9Ux43SVHbXK0UUkN5z3hcy6utysiBjqOwQ","use":"sig"}]});

How can i know which one use between OCT, EC, RSA etc ?

为此，您的 token 所服务的需求可能会决定这一点。我需要接收者是可以看到内容的人，所以我选择了 RSA，用于非对称 key 。伪造有点难。

这些笔记本在某种程度上是一项正在进行的工作。请仔细阅读，因为这是我的解释以及我如何计算出我需要的东西。我希望他们能提供一些指导。