JSON Web encryption (JWE) using Security Framework

Question

AdNicolum OP

Created Mar ’19

Replies 3

Boosts 0

Views 3.8k

Participants 2

Hi everyone,

Our iOS application uses a Web service that returns content encrypted using JWE (https://tools.ietf.org/html/rfc7516). The server encrypts the content using a public key provided by the app in a previous call, and the app decodes the JWE and decrypts the content using its private key.

We encounter issues to decrypt the content, in particular for algorithms that encrypt or derive a symmetric key which is then used to encrypt the content using AES GCM:

RSA OAEP 256 with A256 GCM: RSAES using Optimal Asymmetric Encryption Padding (OAEP) (RFC 3447), with the SHA-256 hash function and the MGF1 with SHA-256 mask generation function; AES in Galois/Counter Mode (GCM) (NIST.800-38D) using a 256 bit key
ECDH ES A256KW with A256GCM: Elliptic Curve Diffie-Hellman Ephemeral Static key agreement per "ECDH-ES", where the agreed-upon key is used to wrap the Content Encryption Key (CEK) with the "A256KW" function; AES in Galois/Counter Mode (GCM) (NIST.800-38D) using a 256 bit key

Is there a way to format JWE attributes (encrypted content key, IV, authentication tag, cipher text) so that it can be passed as parameter to the SecKeyCreateDecryptedData method with a SecKeyAlgorithm like rsaEncryptionOAEPSHA256AESGCM or eciesEncryptionStandardVariableIVX963SHA256AESGCM? If not, is there an alternative that would allow to perform the decryption step by step?

I tried to read the code made available by Apple but I couldn't figure out the exact data format and the documentation is not so clear about the operations performed in those cases.

Thanks in advance

Boost

Answer 1

DTS Engineer OP

Apple

Mar ’19

I think this is going to be challenging. Let’s focus on the RSA case for the moment. The closest match for your requirements is

.rsaEncryptionOAEPSHA256AESGCM

. However, you wrote:

JWE attributes (encrypted content key, IV, authentication tag, cipher text)

The key thing here is that you need to be able to specify the IV. That doesn’t work for

.rsaEncryptionOAEPSHA256AESGCM

, which always uses an all zeroes IV.

The other possible approach is to do this piecemeal, but there you run into the problem that our symmetric crypto API, Common Crypto, does not support AES-GCM [1].

I did a quick ’net search to see if I could find a third-party library for doing this, and it turned up some interesting results. However, from what I can tell, the libraries based on Apple’s crypto do nott include GCM support.

It’s possible that I’ve missed something obvious here — this stuff is, as I’m sure you’re aware, quite complex — so if you’d like a definitive answer then I recommend you open a DTS tech support incident and I can spend some time researching that.

Regardless of how you proceed, once you’ve decided on a strategy I’d appreciate you filing enhancement requests for the things that would have made your life easier (like a public AES-GCM API, for example).

Please post any bug numbers, just for the record.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

[1] Common Crypto has a GCM implementation but it’s not in the public SDK sigh

0

Answer 2

AdNicolum OP

Mar ’19

Thanks for your reply.

We are able to implement decryption in a 2-step approach for RSA and AES-CBC (similarly to this framework) by using

rsaEncryptionOAEPSHA256

and CommonCrypto's

CCCrypt

, but AES-GCM is a different story indeed.

Moreover, the only way to use the Secure Enclave is with EC keys and the Security Framework (correct me if I'm wrong), which limits the possibilities even more.

I filed an enhancement request about AES-GCM (49183472).

0

Answer 3

DTS Engineer OP

Apple

Mar ’19

I filed an enhancement request about AES-GCM (49183472).

Thank you!

Moreover, the only way to use the Secure Enclave is with EC keys and the Security Framework

Correct.

which limits the possibilities even more.

I’m not sure what you’re getting at here. Are you saying that none of the algorithms supported by

SecKey

(

SecKeyAlgorithm

) do EC in a way that’s compatible with JWT’s use of EC?

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

0