How to encrypt a json object?

[DoneDeal0]

Hi,

I would like to store sensitive information in the local storage of my client. My idea is:

• retrieve info from the database, encrypt the object as a JOSE, send it to the client
• in the client, store the JOSE in local storage, and decipher it when an information is needed.

Your library seems perfect for that. However, though I read your doc, I couldn't make it work. Here is what I got:

app.get("/user", async (req, res) => {
  const encoder = new TextEncoder()
  const encryptedUser = await new CompactEncrypt(encoder.encode({name: "joe", age: 99, hobbies: ["swim", "eat"]}))
  .setProtectedHeader({ alg: 'RSA-OAEP-256', enc: 'A256GCM' })
  .encrypt("myPrivateKey")
  res.status(200).json({
    user: encryptedUser,
  });
});

Node throws this error: invalid key input.

How to fix this, and which library would you recommend to decipher the JOSE token in the client? Is jsonwebtoken good enough if I pass it the right key?

Thanks for your help!

[panva]

First of all give #114 and the documentation for the encrypt method's key parameter type a read. See if it helps. If not, please come back.

[DoneDeal0]

Alright, I've learnt the basics, the secretKey is indeed properly stored in indexedDB. The encrypted json is now deciphered. However, the plaintext is an array of number (Uint8Array, 455 items), and not a proper object.

I've tried to decode the Unit8Array with new TextDecoder().decode(plaintext), but I've only got the encoded string.

It looks like this:

I've tried with and without JSON.stringify in encoder.encode. The secret key looks ok though:

[panva]

Uint8array is the binary representation of your plaintext. First use the textdecoder, then json parse it.

[panva]

Its even shown in the decrypt functions doc examples.

[DoneDeal0]

Ok it works, all my apologies it was a stupid mistake of mine, it was midnight yesterday, I was definitely doing crap. I should have waited the morning with a fresh mind to come back at you. Have a great day, thanks again for your help!

[panva]

You're welcome, glad i could help. Please consider supporting the library if it provides value to you or your company and this was of help to you. Supporting the library means, amongst other things, that such support will be available in the future.

[panva]

Second of all, this library is a universal/isomorphic javascript library. This means it works both in Node and the browser. The only difference is the KeyLike type that i've asked you to give a read in my previous comment.

The jsonwebtoken is not fit for neither JWE nor browser runtime.