How to generate JWK for a NestedKey?

[erwanvivien]

I'm following #112 about encoding / decoding a NestedKey

It works super well with the provided keys 👍

I'm not very knowledgeable in the encryption topic... After looking around the Doc / examples I could not figure out how to generate the 4(?) JWK, when I go to https://www.googleapis.com/oauth2/v3/certs as some example do I only get 2 keys

Questions:

• How can I retrieve the 4 different JWK from the example?
• Should I refresh the JWK or they should be save on the backend once?
• which one should I share with the frontend?

Here is my whole code if that helps future devs

Code for encode/decode

// Mainly from https://github.com/panva/jose/issues/112

import {
  compactDecrypt,
  CompactEncrypt,
  importJWK,
  jwtVerify,
  SignJWT,
  type JWK,
  type KeyLike,
} from "jose";

/**
 * Jsonable represents all types that can be converted to JSON.
 */
export type Jsonable =
  | string
  | number
  | boolean
  | null
  | undefined
  | Date
  | Jsonable[]
  | { [key: string]: Jsonable };

const textEncoder = new TextEncoder();

let encodePrivateKey: KeyLike | Uint8Array | undefined = undefined;

export const encode = async (content: Jsonable): Promise<string> => {
  const jwk: JWK = {
    crv: "P-256",
    x: "FM3c0AK77LZbxb2LCmUI-Y83DpX04HfakfD1fgfaMVw",
    y: "fw7dMgz5uHqxbAaYUwgz0IarSIXfkGFP0qTDyC_rkx0",
    d: "VOh1aBPFq8f1nLh-wQzp5B1WglsJZyhhlUeUWIOZ3mc",
    kty: "EC",
    kid: "d2bwmrR5AoI9A0FgNTFxtcNyTPlQTinRxuXUG9uOOWY",
  };

  encodePrivateKey ??= await importJWK(jwk, "ES256");

  // Create a signed JWT
  const jwt = await new SignJWT({})
    .setSubject(JSON.stringify(content))
    .setIssuedAt()
    .setIssuer(forceDefined(process.env.NEXT_PUBLIC_BASE_URL))
    // .setExpirationTime("5m")
    .setProtectedHeader({
      alg: "ES256",
      kid: jwk.kid,
    })
    .sign(encodePrivateKey);

  // Create JWE object with signed JWT as payload
  const recipientJwk: JWK = {
    e: "AQAB",
    kid: "CZSMR6mZCn2dxWzRFP9upf2onQkVIaQld92fyb6a5HE",
    kty: "RSA",
    n: "uDwQ0ON7rzg6w3BobsBTf9XU6bsGAfc234beMZGHYHfFx3GZqe2YC46yd0xFKY1_yJIDzhwUMOpFfqrtHxDjER-9Q2Lwap3VLad6p3KRf-WAkEWxpgk7fkdQEkrqyxlC5GPRnwUXQ0NRlPRRgFVvlIcRQU5GG-gbPqAhM0UcdFS4He82a1YozQyByC3TG7K3gVBzeh-yT2psbpgl4UeuTnpwlRgrqxYY-PQsBHnEWJ2C7L9bZFGmUNrCOsOqe2ngJvdVit-UJKtXQ7CRx0jpR9l1d0_B0iCEi1ic6hacxYO5QMmV8tQPHHnhB2QA5zAvjXC7fIxlZoGRb1oqhZ147w",
    use: "enc",
  };
  const recipientPublicKey = await importJWK(recipientJwk, "RSA-OAEP-256");

  const jwe = await new CompactEncrypt(textEncoder.encode(jwt))
    .setProtectedHeader({
      alg: "RSA-OAEP-256",
      enc: "A256GCM",
      kid: recipientJwk.kid,
    })
    .encrypt(recipientPublicKey);

  return jwe;
};

const textDecoder = new TextDecoder();

let decodePrivateKey: KeyLike | Uint8Array | undefined = undefined;

export const decode = async (jwe: string): Promise<Jsonable> => {
  const privateJwk: JWK = {
    e: "AQAB",
    n: "uDwQ0ON7rzg6w3BobsBTf9XU6bsGAfc234beMZGHYHfFx3GZqe2YC46yd0xFKY1_yJIDzhwUMOpFfqrtHxDjER-9Q2Lwap3VLad6p3KRf-WAkEWxpgk7fkdQEkrqyxlC5GPRnwUXQ0NRlPRRgFVvlIcRQU5GG-gbPqAhM0UcdFS4He82a1YozQyByC3TG7K3gVBzeh-yT2psbpgl4UeuTnpwlRgrqxYY-PQsBHnEWJ2C7L9bZFGmUNrCOsOqe2ngJvdVit-UJKtXQ7CRx0jpR9l1d0_B0iCEi1ic6hacxYO5QMmV8tQPHHnhB2QA5zAvjXC7fIxlZoGRb1oqhZ147w",
    d: "QFgyI1Kf-wVveJzEzJF9WDNthihco8kcsBrhdXx3RJjwSYUCfxfNN5Qh_opzyVxzGbDthUnHP4JCvUejQ2tZcrycFHH0t7fiIWzR6LOZ34pfSYQd1Hh6_9KWQ51IvaBX_X5jUt-rTUGwt45Q_LpaGwzFWQKmd86r3UZ98fMcSgBIKtbZwWPd-paDC5OjOOk9fXBaAhXq19yNIQCVrCdyA9z8YD4JObTzNKxr8tdbXnQ0PqoA0VYf-ifev8uF7Q5gFDfFhARZjnssE9ZPZxMgFVF3ZE9Cg5pWjB7W-IMtnHUFtkEjHKG-ZNw2kzSDOekpJHdpBXHobq2gMTqUwFHj0Q",
    p: "8gIlcIOzQV1iJwImre5CtJ7hnhRTaNalrjeaB1BBOCGvYEjJ76GVvMVvWrXnAHhh8OYk9n-mOnRgu0BELpXA5IKDM8uEwukf2lH4mUka15vpQhdLN9qGekp-PBBIQLoQsN4yqUpRgMhYN5MKHYdM4IralAFC_1Fba44HXJYtX-c",
    q: "wuLWQmgxtrNb9LnaBLP4O6BpwxV47i0F9Z2_PojTZEbGS-LU_YIIqmJuL0DHjZ9Yc7H06lSmCcJ2o7K_N0NZObWRRSu-kI4WwAc4z_qIlSxI0WnO2DQlBBAvcikLxZLf0lbE8bdXlc3jrypA4ADZgq-udrPQQwNPKaPHNkaaHbk",
    dp: "KUQSbEAYxdGNlgc43zmcaD4bTKA8pMjNEYrrmcmmhVLBG9LtlA3igYDM_xO7Ywoj8TbdIKcdiiQkBmnr9mGUtaJHiwJuDepAgzKtCD499HviZ2GfctOxUJL5OXaxS1Au3mnVC6bfhO0klb1d4TEb-8HRiaE5cl3GD-309WWqMQs",
    dq: "fz_t9t5h15G1cU4I9Rkt9IEBjcfvdlUflwixXvuoS8mKoPIzcHP_hIFQwLnjkq2A68o-yOMMp0K6hJiqEkN_dxb_C9NMUsb0Q95zUhmcJQsNYO9dh_5ETSrkT_5NGWyViJnvboTwQ3h0OmO0iI8FdzePCyLN0XPPtLij0uS2rME",
    qi: "MP79AE4ZRtH-eVSnC6Pkzrg1qbdjCKd6mj8zZPsfNu2-8JOR_vhqN2927sH4Zou2V-m7lq0EO7xp_C9RZFhz99T6tbIXVJwR3GewGjwGc3DRuD9ih91dM1qfyApGUTN6G0jOhIaTKbBpMn1MUUZ7haBht4iypLMIfrLBNW6sLYY",
    kty: "RSA",
    use: "enc",
  };
  decodePrivateKey ??= await importJWK(privateJwk, "RSA-OAEP-256");

  // decrypt the JWE
  const { plaintext: decryptedJwt } = await compactDecrypt(
    jwe,
    decodePrivateKey
  );

  const issuerPublicJwk: JWK = {
    crv: "P-256",
    kid: "d2bwmrR5AoI9A0FgNTFxtcNyTPlQTinRxuXUG9uOOWY",
    kty: "EC",
    x: "FM3c0AK77LZbxb2LCmUI-Y83DpX04HfakfD1fgfaMVw",
    y: "fw7dMgz5uHqxbAaYUwgz0IarSIXfkGFP0qTDyC_rkx0",
  };

  // validate the JWT
  const publicKey = await importJWK(issuerPublicJwk, "ES256");

  const { payload } = await jwtVerify(
    textDecoder.decode(decryptedJwt),
    publicKey
  );

  return payload.sub !== undefined ? JSON.parse(payload.sub) : null;
};

Usage of previous code:

const encodedValue = await encode({ user: "[email protected]" })
const decodeValue = await decode(encodedValue)
console.log(decodeValue) // { user: "[email protected]" }

[erwanvivien]

This is what I ended up with:

// Mainly from https://github.com/panva/jose/issues/112

import type { Jsonable } from "@/api/routes";
import {
  compactDecrypt,
  CompactEncrypt,
  generateKeyPair,
  jwtVerify,
  SignJWT,
  type GenerateKeyPairResult,
} from "jose";
import { forceDefined } from "..";

const textEncoder = new TextEncoder();

let keypairWrapper: GenerateKeyPairResult | undefined;
let keypairInner: GenerateKeyPairResult | undefined;

export const encode = async (content: Jsonable): Promise<string> => {
  keypairWrapper ??= await generateKeyPair("ES256", {
    crv: "P-256",
    extractable: true,
    modulusLength: 2048,
  });

  // Create a signed JWT
  const jwt = await new SignJWT({})
    .setSubject(JSON.stringify(content))
    .setIssuedAt()
    .setIssuer(forceDefined(process.env.NEXT_PUBLIC_BASE_URL))
    // .setExpirationTime("5m")
    .setProtectedHeader({
      alg: "ES256",
      // kid: jwk.kid,
    })
    .sign(keypairWrapper.privateKey);

  keypairInner ??= await generateKeyPair("RSA-OAEP-256", {
    extractable: true,
    modulusLength: 2048,
  });

  const jwe = await new CompactEncrypt(textEncoder.encode(jwt))
    .setProtectedHeader({
      alg: "RSA-OAEP-256",
      enc: "A256GCM",
    })
    .encrypt(keypairInner.publicKey);

  return jwe;
};

const textDecoder = new TextDecoder();

export const decode = async (jwe: string): Promise<Jsonable> => {
  keypairInner ??= await generateKeyPair("RSA-OAEP-256", {
    extractable: true,
    modulusLength: 2048,
  });

  // decrypt the JWE
  const { plaintext: decryptedJwt } = await compactDecrypt(
    jwe,
    keypairInner.privateKey
  );

  keypairWrapper ??= await generateKeyPair("ES256", {
    crv: "P-256",
    extractable: true,
    modulusLength: 2048,
  });

  const { payload } = await jwtVerify(
    textDecoder.decode(decryptedJwt),
    keypairWrapper.publicKey
  );

  return payload.sub !== undefined ? JSON.parse(payload.sub) : null;
};