Encrypt/Decrypt, ECDH-ES, A256GCM, apu/apv header claims

[alenhorvat]

Hi,

Thank you for this great library. I ran into the following issue:

When trying to encrypt/decrypt:

• alg: ECDH-ES
• enc: A256GCM
• apv, apu header claims are different from ""

decryption fails. After inspecting the encryption, it seems that DeriveECDHES ignores the apu, apv JOSE header parameters when encrypting (

go-jose/asymmetric.go

Line 399 in 66f2b1f

out := josecipher.DeriveECDHES(ctx.algID, []byte{}, []byte{}, priv, ctx.publicKey, ctx.size)

), however, it is not ignoring the claims when decrypting (

go-jose/asymmetric.go

Line 444 in 66f2b1f

return josecipher.DeriveECDHES(algID, apuData.bytes(), apvData.bytes(), ctx.privateKey, publicKey, size)

)

Temporary workaround can be achieved using "direct" encryption using the snippet below.

package main

import (
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"encoding/base64"
	"fmt"

	jose "github.com/go-jose/go-jose/v3"
	cipher "github.com/go-jose/go-jose/v3/cipher"
)

func EncryptTest() {

	// Sender's key
	var senderKey, _ = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	// Receiver's key
	var receiverKey, _ = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)

	// Define apu/apv
	apuPlain := "alice"
	apvPlain := "bob"
	apu := base64.URLEncoding.EncodeToString([]byte(apuPlain))
	apv := base64.URLEncoding.EncodeToString([]byte(apvPlain))

	// Define the epk (private key)
	jwkKey := jose.JSONWebKey{
		Key:       senderKey,
		KeyID:     "1",
		Algorithm: "ES256",
		Use:       "enc",
	}
	// epk Public part
	jwkPub := jwkKey.Public()

	// Derive a shared secret
	encKey := cipher.DeriveECDHES("A256GCM", []byte(apuPlain), []byte(apvPlain), senderKey, &receiverKey.PublicKey, 32)

	// Init a new encrypter
	encrypter, err := jose.NewEncrypter(
		jose.A256GCM, jose.Recipient{
			Algorithm: jose.DIRECT,
			Key:       encKey,
		}, &jose.EncrypterOptions{
			ExtraHeaders: map[jose.HeaderKey]interface{}{
				// Set the header claims. Important!
				"typ": "JWT",
				"apu": apu,
				"apv": apv,
				"epk": jwkPub,
				"alg": "ECDH-ES",
			},
		})
	if err != nil {
		panic(err)
	}

	// Content we're encrypting
	var plaintext = []byte("Lorem ipsum dolor sit amet")
	// Encrypt
	object, err := encrypter.Encrypt(plaintext)
	if err != nil {
		panic(err)
	}
	// Serialise
	serialised, _ := object.CompactSerialize()
	fmt.Println(serialised)

	// Parse the serialized, encrypted JWE object. An error would indicate that
	// the given input did not represent a valid message.
	deserialised, err := jose.ParseEncrypted(serialised)
	if err != nil {
		panic(err)
	}

	// Now we can decrypt and get back our original plaintext. An error here
	// would indicate that the message failed to decrypt, e.g. because the auth
	// tag was broken or the message was tampered with.
	decrypted, err := deserialised.Decrypt(receiverKey)
	if err != nil {
		panic(err)
	}
	fmt.Println("Decrypted: ", string(decrypted))
	if err != nil {
		panic(err)
	}
}