Encryption with "alg" ECDH_ES*

[giovanni9793]

Hi Panva, I'm sorry for bothering you, but I don't understand how can I encrypt a JWT with this alg.
I know that I have to derive a secret from a private key of mine and the corresponding public key of the client that require such encryption alg, so I used the method 'crypto.createSecretKey' to create a KeyObject for the encryption, but I have the type error "only 'private' or 'public' key objects can be used for this operation". What passage am I doing wrong?

PS: for derivation I'm using 'elliptic' because 'crypto.createECDH' does not support 'secp256r1' (?)

import * as ec from 'elliptic'
import crypto from 'crypto'
import CompactEncrypt from 'jose/jwe/compact/encrypt'

const ecKey = new ec.ec('p256')

const clientGen = ecKey.keyFromPublic(/*hex of publicKey*/)
const providerGen = ecKey.keyFromPrivate(/*hex of privateKey*/)

clientGen.validate()

const providerSecret = providerGen.derive(clientGen.getPublic()) // return BN

const secretKey = crypto.createSecretKey(providerSecret.toArrayLike(Buffer))

const id_token = await new CompactEncrypt(new TextEncoder().encode(/*jwt*/))
            .setProtectedHeader({
                alg: "ECDH_ES_A128KW",
                enc: "A128GCM",
                epk: /*providerPublicJwk*/,
              })
              .encrypt(secretKey)

[panva]

What passage am I doing wrong?

A little bit in everything.

• ECDH-ES(+*) is a public key based encryption. You're passing a secret key.
• let the library generate the ephemeral key, don't do it yourself.
• ECDH_ES_A128KW is not a registered algorithm, ECDH-ES+A128KW is.
• secp256r1 is not a curve registered for JOSE use.

import { parseJwk } from 'jose/jwk/parse'
import { CompactEncrypt } from 'jose/jwe/compact/encrypt'

const recipientPublicKey = {
  "kty": "EC",
  "crv": "P-256",
  "x": "Eb3RtGgBGOEz33yu46aha_RU6pyBaYNlu6SawlWGGHQ",
  "y": "tUncttzF6Ud4Abfn1N2A1Rz2MBbJSdI0zuKS28BNb-U"
}

const alg = 'ECDH-ES'

const publicKey = await parseJwk(recipientPublicKey, alg)

const token = await new CompactEncrypt(new TextEncoder().encode('Hello World!'))
  .setProtectedHeader({
    alg: alg,
    enc: 'A128GCM',
  })
  .encrypt(publicKey)

console.log(token)

[giovanni9793]

First and second point:

• I don't understand, how can the library generate the ephemeral key if has no information about also the private key of mine? I thought that for the generation of the shared secret mine private key and client public key were needed, so for that reason I thought that I have to pass directly the shared secret.
  EDIT: oh, I understand, is not static for provider, but for client, so the library create the ephemeral key and use it for generate the shared secret and then encrypt

Third point:

• I pasted enum key and not value, my fault :/

Fourth point:

• I knew that 'secp256r1' was an alias for 'P-256'

[panva]

• Algorithm Selection Guide #114 (comment)
• https://datatracker.ietf.org/doc/html/rfc7518#section-4.6

[giovanni9793]

I read it, but I didn't really understand what you mean with that before this example. I searched also in the test files for an example use, but I found only alg 'dir' examples, that obviously use secret.
Thank you very much for the clarification.