Skip to content

Conversation

@ObeydKhan
Copy link

Add support for ECDH-ES Key Agreement:

Overview:
Elliptic-curve Diffie–Hellman (ECDH) is a key agreement protocol that allows two parties, each having an elliptic-curve public–private key pair, to establish a shared secret over an insecure channel. This shared secret may be directly used as a key, or to derive another key. The key, or the derived key, can then be used to encrypt subsequent communications using a symmetric-key cipher.

Steps:

  • ECDH requires two sets of EC keys.
  • A shared secret Z is generated using one private key and one public key. See openssl's pkey:derive
  • The final Content Encryption Key (CEK) is derived using a key derivation function (KDF). It is derived from JWE header and Z.
  • The derived shared key (CEK) is then used to encrypt/decrypt payload.

Some additional JWT headers set for ECDH:

  • apu
  • apv
  • epk

References:

  1. https://www.rfc-editor.org/rfc/rfc7518#appendix-C

Add support for AES-GCM-128 encryption algorithm

Related issue: #65

@ObeydKhan
Copy link
Author

cc: @cdbattags

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant