handling of cipherparams for ECDH_ES corrected

jalauros · jalauros · commit 3dec144b10eb · 2018-11-21T08:36:19.000+02:00
diff --git a/build.gradle b/build.gradle
@@ -8,6 +8,10 @@ apply plugin: 'net.saliman.cobertura'
 
 sourceCompatibility = 1.7
 
+test {
+  testLogging.showStandardStreams = true
+}
+
 buildscript {
   repositories {
     maven {
diff --git a/src/main/java/org/oidc/msg/AbstractMessage.java b/src/main/java/org/oidc/msg/AbstractMessage.java
@@ -25,6 +25,7 @@
 import com.auth0.jwt.algorithms.CipherParams;
 import com.auth0.jwt.exceptions.JWTDecodeException;
 import com.auth0.jwt.exceptions.JWTVerificationException;
+import com.auth0.jwt.exceptions.KeyAgreementException;
 import com.auth0.jwt.exceptions.oicmsg_exceptions.DeserializationNotPossible;
 import com.auth0.jwt.exceptions.oicmsg_exceptions.JWKException;
 import com.auth0.jwt.exceptions.oicmsg_exceptions.SerializationNotPossible;
@@ -491,10 +492,14 @@ public String toJwt(Key signingKey, String alg, Key transportKey, String encAlg,
           "encAlg and encEnc are mandatory parameters if transport key is set");
     }
     try {
-      return JWTEncryptor.init().withPayload(signedJwt.getBytes("UTF-8")).encrypt(
-          AlgorithmResolver.resolveKeyTransportAlgorithmForEncryption(transportKey, encAlg, encEnc, keyjar, sender, receiver),
-          Algorithm.getContentEncryptionAlg(encEnc, CipherParams.getInstance(encEnc)));
-    } catch (UnsupportedEncodingException | ValueError | SerializationNotPossible e) {
+      Algorithm keyTransportAlgorithm = AlgorithmResolver.resolveKeyTransportAlgorithmForEncryption(
+          transportKey, encAlg, encEnc, keyjar, sender, receiver);
+      Algorithm contentEncryptionAlgorithm = AlgorithmResolver
+          .resolveContentEncryptionAlg(keyTransportAlgorithm, encEnc);
+      return JWTEncryptor.init().withPayload(signedJwt.getBytes("UTF-8"))
+          .encrypt(keyTransportAlgorithm, contentEncryptionAlgorithm);
+    } catch (UnsupportedEncodingException | ValueError | SerializationNotPossible
+        | KeyAgreementException e) {
       throw new SerializationException(
           String.format("Not able to initialize key transport algorithm '%s' to encrypt JWS, '%s'",
               encAlg, e.getMessage()));
diff --git a/src/main/java/org/oidc/msg/oidc/util/AlgorithmResolver.java b/src/main/java/org/oidc/msg/oidc/util/AlgorithmResolver.java
@@ -17,6 +17,9 @@
 package org.oidc.msg.oidc.util;
 
 import com.auth0.jwt.algorithms.Algorithm;
+import com.auth0.jwt.algorithms.CipherParams;
+import com.auth0.jwt.algorithms.ECDHESAlgorithm;
+import com.auth0.jwt.exceptions.KeyAgreementException;
 import com.auth0.jwt.exceptions.oicmsg_exceptions.HeaderError;
 import com.auth0.jwt.exceptions.oicmsg_exceptions.JWKException;
 import com.auth0.jwt.exceptions.oicmsg_exceptions.SerializationNotPossible;
@@ -261,6 +264,25 @@ public static Algorithm resolveKeyTransportAlgorithmForEncryption(Key key, Strin
     throw new ValueError(String.format("Algorithm '%s' not supported ", alg));
   }
   
+  /**
+   * Resolves content encryption algorithm.
+   * 
+   * @param encAlg
+   *          key transport algorithm
+   * @param encEnc
+   *          name of the content encryption algorithm
+   * @return content encryption algorithm
+   * @throws KeyAgreementException
+   */
+  public static Algorithm resolveContentEncryptionAlg(Algorithm encAlg, String encEnc)
+      throws KeyAgreementException {
+    if (encAlg instanceof ECDHESAlgorithm) {
+      return Algorithm.getContentEncryptionAlg(encEnc,
+          CipherParams.getKeyAgreementInstance(encEnc, encAlg));
+    }
+    return Algorithm.getContentEncryptionAlg(encEnc, CipherParams.getInstance(encEnc));
+  }
+  
   /**
    * Gets receiver ephemeral key from keyjar. Any suitable located receiver key is treated as the
    * key.
diff --git a/src/test/java/org/oidc/msg/AbstractMessageTest.java b/src/test/java/org/oidc/msg/AbstractMessageTest.java
@@ -231,8 +231,7 @@ public void testSuccessJWTEncryptDecrypt1()
     testSuccessJWTEncryptDecrypt("RS256","A128KW","A128CBC-HS256");
     testSuccessJWTEncryptDecrypt("RS384","A192KW","A128CBC-HS256");
     testSuccessJWTEncryptDecrypt("RS512","A256KW","A128CBC-HS256");
-    //TODO: not passing
-    //testSuccessJWTEncryptDecrypt("RS256","ECDH-ES","A128CBC-HS256");
+    testSuccessJWTEncryptDecrypt("RS256","ECDH-ES","A128CBC-HS256");
     testSuccessJWTEncryptDecrypt("RS256","ECDH-ES+A128KW","A128GCM");
     testSuccessJWTEncryptDecrypt("RS384","ECDH-ES+A192KW","A192GCM");
     testSuccessJWTEncryptDecrypt("RS512","ECDH-ES+A256KW","A256GCM");
