Jwe Tcl Reference Documentation

Jwe

Current Version: 10.1.0

An API for JSON Web Encryption (JWE). Provides the ability to create (encrypt) and decrypt JWE's.

Supported Algorithms:

  • RSAES OAEP 256 (using SHA-256 and MGF1 with SHA-256) encryption with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM
  • RSAES OAEP (using SHA-1 and MGF1 with SHA-1) encryption with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM
  • RSAES-PKCS1-V1_5 encryption with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM
  • Direct symmetric key encryption with pre-shared key A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM and A256GCM
  • A128KW, A192KW, A256KW encryption with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM
  • A128GCMKW, A192GCMKW, A256GCMKW encryption with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM
  • PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM

Object Creation

set myJwe [new CkJwe]

Properties

DebugLogFilePath
string
# ckStr is a CkString
CkJwe_get_DebugLogFilePath $myJwe $ckStr
set strVal [CkJwe_get_debugLogFilePath $myJwe]
CkJwe_put_DebugLogFilePath $myJwe $strVal

If set to a file path, causes each Chilkat method or property call to automatically append it's LastErrorText to the specified log file. The information is appended such that if a hang or crash occurs, it is possible to see the context in which the problem occurred, as well as a history of all Chilkat calls up to the point of the problem. The VerboseLogging property can be set to provide more detailed information.

This property is typically used for debugging the rare cases where a Chilkat method call hangs or generates an exception that halts program execution (i.e. crashes). A hang or crash should generally never happen. The typical causes of a hang are:

  1. a timeout related property was set to 0 to explicitly indicate that an infinite timeout is desired,
  2. the hang is actually a hang within an event callback (i.e. it is a hang within the application code), or
  3. there is an internal problem (bug) in the Chilkat code that causes the hang.

More Information and Examples
top
LastErrorHtml
string
# ckStr is a CkString
CkJwe_get_LastErrorHtml $myJwe $ckStr
set strVal [CkJwe_get_lastErrorHtml $myJwe]

Provides information in HTML format about the last method/property called. If a method call returns a value indicating failure, or behaves unexpectedly, examine this property to get more information.

top
LastErrorText
string
# ckStr is a CkString
CkJwe_get_LastErrorText $myJwe $ckStr
set strVal [CkJwe_get_lastErrorText $myJwe]

Provides information in plain-text format about the last method/property called. If a method call returns a value indicating failure, or behaves unexpectedly, examine this property to get more information.

top
LastErrorXml
string
# ckStr is a CkString
CkJwe_get_LastErrorXml $myJwe $ckStr
set strVal [CkJwe_get_lastErrorXml $myJwe]

Provides information in XML format about the last method/property called. If a method call returns a value indicating failure, or behaves unexpectedly, examine this property to get more information.

top
LastMethodSuccess
boolean 1/0
set boolVal [CkJwe_get_LastMethodSuccess $myJwe]
CkJwe_put_LastMethodSuccess $myJwe $boolVal

Indicate whether the last method call succeeded or failed. A value of 1 indicates success, a value of 0 indicates failure. This property is automatically set for method calls. It is not modified by property accesses. The property is automatically set to indicate success for the following types of method calls:

  • Any method that returns a string.
  • Any method returning a Chilkat object, binary bytes, or a date/time.
  • Any method returning a standard boolean status value where success = 1 and failure = 0.
  • Any method returning an integer where failure is defined by a return value less than zero.

Note: Methods that do not fit the above requirements will always set this property equal to 1. For example, a method that returns no value (such as a "void" in C++) will technically always succeed.

top
NumRecipients
integer
set intVal [CkJwe_get_NumRecipients $myJwe]
Introduced in version 9.5.0.66

The number of recipients for this JWE.

top
PreferCompact
boolean 1/0
set boolVal [CkJwe_get_PreferCompact $myJwe]
CkJwe_put_PreferCompact $myJwe $boolVal
Introduced in version 9.5.0.66

Controls whether the JWE Compact Serialization or JWE JSON Serialization is preferred when creating JWEs. The default value is 1, which is to use compact serialization when possible. If multiple recipients exist, or if any unprotected headers exist, then JWE JSON Serialization is used regardless of this property setting.

top
PreferFlattened
boolean 1/0
set boolVal [CkJwe_get_PreferFlattened $myJwe]
CkJwe_put_PreferFlattened $myJwe $boolVal
Introduced in version 9.5.0.66

Controls whether the flattened serialization is preferred when JWE JSON Serialization is used. The default value is 1, which is to use the flattened serialization when possible. If multiple recipients exist, then the general (non-flattened) JWE JSON Serialization is used regardless of this property setting.

More Information and Examples
top
UncommonOptions
string
# ckStr is a CkString
CkJwe_get_UncommonOptions $myJwe $ckStr
set strVal [CkJwe_get_uncommonOptions $myJwe]
CkJwe_put_UncommonOptions $myJwe $strVal
Introduced in version 10.1.0

This is a catch-all property to be used for uncommon needs. This property defaults to the empty string and should typically remain empty.

top
Utf8
boolean 1/0
set boolVal [CkJwe_get_Utf8 $myJwe]
CkJwe_put_Utf8 $myJwe $boolVal

When set to 1, all "const char *" arguments are interpreted as utf-8 strings. If set to 0 (the default), then "const char *" arguments are interpreted as ANSI strings. Also, when set to 1, and Chilkat method returning a "const char *" is returning the utf-8 representation. If set to 0, all "const char *" return values are ANSI strings.

top
VerboseLogging
boolean 1/0
set boolVal [CkJwe_get_VerboseLogging $myJwe]
CkJwe_put_VerboseLogging $myJwe $boolVal

If set to 1, then the contents of LastErrorText (or LastErrorXml, or LastErrorHtml) may contain more verbose information. The default value is 0. Verbose logging should only be used for debugging. The potentially large quantity of logged information may adversely affect peformance.

top
Version
string
# ckStr is a CkString
CkJwe_get_Version $myJwe $ckStr
set strVal [CkJwe_get_version $myJwe]

Version of the component/library, such as "9.5.0.94"

More Information and Examples
top

Methods

Decrypt
# index is an integer
# charset is a string
# outStr is a CkString (output)
set status [CkJwe_Decrypt $index $charset $outStr]
set retStr [CkJwe_decrypt $myJwe $index $charset]
Introduced in version 9.5.0.66

Decrypts a JWE and returns the original (decrypted) string content. The byte representation of the decrypted bytes is indicated by charset (such as "utf-8"). (The charset tells Chilkat how to intepret the decrypted bytes as characters.)

The index specifies which recipient key is used for decryption. (Most JWEs have only a single recipent, and thus the index is typically 0.)

Supported Algorithms:

  • RSAES OAEP 256 (using SHA-256 and MGF1 with SHA-256) encryption with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM
  • RSAES OAEP (using SHA-1 and MGF1 with SHA-1) encryption with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM
  • RSAES-PKCS1-V1_5 encryption with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM
  • Direct symmetric key encryption with pre-shared key A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM and A256GCM
  • A128KW, A192KW, A256KW encryption with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM
  • A128GCMKW, A192GCMKW, A256GCMKW encryption with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM
  • PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM

Returns 1 for success, 0 for failure.

top
DecryptBd
# index is an integer
# bd is a CkBinData
set status [CkJwe_DecryptBd $index $bd]
Introduced in version 9.5.0.66

Decrypts the loaded JWE and appends the decrypted bytes to the contents of bd. The index specifies which recipient key is used for decryption. (Most JWEs have only a single recipent, and thus the index is typically 0.)

Returns 1 for success, 0 for failure.

More Information and Examples
top
DecryptSb
# index is an integer
# charset is a string
# contentSb is a CkStringBuilder
set status [CkJwe_DecryptSb $index $charset $contentSb]
Introduced in version 9.5.0.66

Decrypts the loaded JWE and appends the decrypted content to contentSb. The byte representation of the decrypted bytes is indicated by charset (such as "utf-8"). (This tells Chilkat how to interpret the bytes as characters.)

The index specifies which recipient key is used for decryption. (Most JWEs have only a single recipent, and thus the index is typically 0.)

Returns 1 for success, 0 for failure.

More Information and Examples
top
Encrypt
# content is a string
# charset is a string
# outStr is a CkString (output)
set status [CkJwe_Encrypt $content $charset $outStr]
set retStr [CkJwe_encrypt $myJwe $content $charset]
Introduced in version 9.5.0.66

Encrypts string content to produce a JWE. The byte representation of the content is indicated by charset (such as "utf-8").

Supported Algorithms:

  • RSAES OAEP 256 (using SHA-256 and MGF1 with SHA-256) encryption with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM
  • RSAES OAEP (using SHA-1 and MGF1 with SHA-1) encryption with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM
  • RSAES-PKCS1-V1_5 encryption with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM
  • Direct symmetric key encryption with pre-shared key A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM and A256GCM
  • A128KW, A192KW, A256KW encryption with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM
  • A128GCMKW, A192GCMKW, A256GCMKW encryption with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM
  • PBES2-HS256+A128KW, PBES2-HS384+A192KW, PBES2-HS512+A256KW with A128CBC-HS256, A192CBC-HS384, A256CBC-HS512, A128GCM, A192GCM, A256GCM

Returns 1 for success, 0 for failure.

top
EncryptBd
# contentBd is a CkBinData
# jweSb is a CkStringBuilder
set status [CkJwe_EncryptBd $contentBd $jweSb]
Introduced in version 9.5.0.66

Encrypts the contents of contentBd to produce a JWE that is appended to the contents of jweSb. (This method provides the means to produce a JWE from binary content.)

Returns 1 for success, 0 for failure.

More Information and Examples
top
EncryptSb
# contentSb is a CkStringBuilder
# charset is a string
# jweSb is a CkStringBuilder
set status [CkJwe_EncryptSb $contentSb $charset $jweSb]
Introduced in version 9.5.0.66

Encrypts the contents of contentSb to produce a JWE that is appended to the contents of jweSb. The byte representation of the string to be encrypted is indicated by charset (such as "utf-8").

Returns 1 for success, 0 for failure.

More Information and Examples
top
FindRecipient
# paramName is a string
# paramValue is a string
# caseSensitive is a boolean
set retInt [CkJwe_FindRecipient $paramName $paramValue $caseSensitive]
Introduced in version 9.5.0.66

Finds the index of the recipient with a header parameter (paramName) equal to a specified value (paramValue). Returns -1 if no recipient contains a header with the given name/value. If caseSensitive is 1, then the header param name/value comparisons are case sensitive. Otherwise it is case insensitive.

The procedure for decrypting a JWE with multiple recipients is the following:

  1. Load the JWE via one of the Load* methods.
  2. Find the recipient index by some identifying header paramter. The typical case is via the "kid" header parameter. ("kid" is an arbitrary key ID applications can assign to identify keys.)
  3. Set the key for decryption at the found index by calling SetPrivateKey, SetWrappingKey, or SetPassword, depending on the type of key wrapping that is employed.
  4. Call Decrypt, DecryptSb, or DecryptBd to decrypt for the recipient (and key) at the given index.

More Information and Examples
top
GetHeader
# json is a CkJsonObject
set status [CkJwe_GetHeader $json]
Introduced in version 9.5.0.89

Returns the JSON header from the JWE. The JSON header is loaded into json.

Returns 1 for success, 0 for failure.

top
GetProtectedHeader
# json is a CkJsonObject
set status [CkJwe_GetProtectedHeader $json]
Introduced in version 9.5.0.89

Returns the shared protected JSON header from the JWE. The shared protected header is loaded into json.

Returns 1 for success, 0 for failure.

top
LoadJwe
# jwe is a string
set status [CkJwe_LoadJwe $jwe]
Introduced in version 9.5.0.66

Loads the contents of a JWE.

Returns 1 for success, 0 for failure.

More Information and Examples
top
LoadJweSb
# sb is a CkStringBuilder
set status [CkJwe_LoadJweSb $sb]
Introduced in version 9.5.0.66

Loads the contents of a JWE from a StringBuilder object.

Returns 1 for success, 0 for failure.

More Information and Examples
top
SetAad
# aad is a string
# charset is a string
set status [CkJwe_SetAad $aad $charset]
Introduced in version 9.5.0.66

Sets the optional Additional Authenticated Data. This is only used for non-compact serializations. The charset specifies the character encoding (such as "utf-8") to be used for the byte representation for the additional authenticated data.

Returns 1 for success, 0 for failure.

top
SetAadBd
# aad is a CkBinData
set status [CkJwe_SetAadBd $aad]
Introduced in version 9.5.0.66

Sets the optional Additional Authenticated Data. This is only used for non-compact serializations. This method provides a way for binary (non-text) additional authenticated data to be used.

Returns 1 for success, 0 for failure.

top
SetPassword
# index is an integer
# password is a string
set status [CkJwe_SetPassword $index $password]
Introduced in version 9.5.0.66

Sets the PBES2 password for key encryption or decryption. This is for the case where the content encryption key (CEK) is encrypted using PBES2. An PBES2 password should be used in the cases where the "alg" header parameter value is equal to one of the following:

PBES2-HS256+A128KW
PBES2-HS384+A192KW
PBES2-HS512+A256KW
The index is the index of the recipient, where the 1st recipient is at index 0. (The typical use case for JWEs is for a single recipient.)

Returns 1 for success, 0 for failure.

top
SetPrivateKey
# index is an integer
# privKey is a CkPrivateKey
set status [CkJwe_SetPrivateKey $index $privKey]
Introduced in version 9.5.0.66

Sets a private key for RSA key unwrapping/decryption. This is for the case where the content encryption key (CEK) is encrypted using RSA. An RSA private key should be used for decrypting in the cases where the "alg" header parameter value is equal to one of the following:

RSA1_5
RSA-OAEP
RSA-OAEP-256
RSA-OAEP-384  (added in Chilkat v9.5.0.71)
RSA-OAEP-512  (added in Chilkat v9.5.0.71)
The index is the index of the recipient, where the 1st recipient is at index 0. (The typical use case for JWEs is for a single recipient.)

Returns 1 for success, 0 for failure.

More Information and Examples
top
SetProtectedHeader
# json is a CkJsonObject
set status [CkJwe_SetProtectedHeader $json]
Introduced in version 9.5.0.66

Sets the JWE Protected Header.

Returns 1 for success, 0 for failure.

top
SetPublicKey
# index is an integer
# pubKey is a CkPublicKey
set status [CkJwe_SetPublicKey $index $pubKey]
Introduced in version 9.5.0.66

Sets a public key for RSA key wrapping encryption. This is for the case where the content encryption key (CEK) is encrypted using RSA. An RSA public key should be used when encrypting for the cases where the "alg" header parameter value is equal to one of the following:

RSA1_5
RSA-OAEP
RSA-OAEP-256
The index is the index of the recipient, where the 1st recipient is at index 0. (The typical use case for JWEs is for a single recipient.)

Returns 1 for success, 0 for failure.

More Information and Examples
top
SetRecipientHeader
# index is an integer
# json is a CkJsonObject
set status [CkJwe_SetRecipientHeader $index $json]
Introduced in version 9.5.0.66

Sets a per-recipient unprotected header. This method would only be called if the JWE is for multiple recipients. The 1st recipient is at index 0.

Returns 1 for success, 0 for failure.

top
SetUnprotectedHeader
# json is a CkJsonObject
set status [CkJwe_SetUnprotectedHeader $json]
Introduced in version 9.5.0.66

Sets the JWE Shared Unprotected Header.

Returns 1 for success, 0 for failure.

top
SetWrappingKey
# index is an integer
# encodedKey is a string
# encoding is a string
set status [CkJwe_SetWrappingKey $index $encodedKey $encoding]
Introduced in version 9.5.0.66

Sets the AES wrapping key for encryption or decryption. This is for the case where the content encryption key (CEK) is encrypted using AES Key Wrap or AES GCM. An AES key should be used in the cases where the "alg" header parameter value is equal to one of the following:

A128KW
A192KW
A256KW
A128GCMKW
A192GCMKW
A256GCMKW
dir
The index is the index of the recipient, where the 1st recipient is at index 0. (The typical use case for JWEs is for a single recipient.)

Note: This method also sets the shared direct symmetric key for the case when the "alg" is equal to "dir". In this case, the key specified is not actualy a key encryption key, but is the direct content encryption key.

The encoding indicates the representation, such as "base64", "hex", "base64url", etc. of the encodedKey.

Returns 1 for success, 0 for failure.

top