001/*
002 * nimbus-jose-jwt
003 *
004 * Copyright 2012-2021, Connect2id Ltd and contributors.
005 *
006 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use
007 * this file except in compliance with the License. You may obtain a copy of the
008 * License at
009 *
010 *    http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software distributed
013 * under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
014 * CONDITIONS OF ANY KIND, either express or implied. See the License for the
015 * specific language governing permissions and limitations under the License.
016 */
017
018package com.nimbusds.jose.crypto;
019
020
021import com.nimbusds.jose.*;
022import com.nimbusds.jose.crypto.impl.*;
023import com.nimbusds.jose.jwk.Curve;
024import com.nimbusds.jose.jwk.ECKey;
025import com.nimbusds.jose.jwk.gen.ECKeyGenerator;
026import com.nimbusds.jose.util.Pair;
027import net.jcip.annotations.ThreadSafe;
028
029import javax.crypto.SecretKey;
030import java.security.interfaces.ECPrivateKey;
031import java.security.interfaces.ECPublicKey;
032import java.util.*;
033
034
035/**
036 * Elliptic Curve Diffie-Hellman Multi-recipient encrypter of
037 * {@link com.nimbusds.jose.JWEObjectJSON JWE objects} for curves using EC JWK keys.
038 * Expects a public EC key (with a P-256, P-384, or P-521 curve).
039 *
040 * <p>Public Key Authenticated Encryption for JOSE
041 * <a href="https://datatracker.ietf.org/doc/html/draft-madden-jose-ecdh-1pu-04">ECDH-1PU</a>
042 * for more information.
043 *
044 * <p>This class is thread-safe.
045 *
046 * <p>Supports the following key management algorithms:
047 *
048 * <ul>
049 *     <li>{@link com.nimbusds.jose.JWEAlgorithm#ECDH_1PU}
050 *     <li>{@link com.nimbusds.jose.JWEAlgorithm#ECDH_1PU_A128KW}
051 *     <li>{@link com.nimbusds.jose.JWEAlgorithm#ECDH_1PU_A192KW}
052 *     <li>{@link com.nimbusds.jose.JWEAlgorithm#ECDH_1PU_A256KW}
053 * </ul>
054 *
055 * <p>Supports the following elliptic curves:
056 *
057 * <ul>
058 *     <li>{@link Curve#P_256}
059 *     <li>{@link Curve#P_384}
060 *     <li>{@link Curve#P_521}
061 * </ul>
062 *
063 * <p>Supports the following content encryption algorithms for Direct key agreement mode:
064 *
065 * <ul>
066 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A128CBC_HS256}
067 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A192CBC_HS384}
068 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A256CBC_HS512}
069 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A128GCM}
070 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A192GCM}
071 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A256GCM}
072 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A128CBC_HS256_DEPRECATED}
073 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A256CBC_HS512_DEPRECATED}
074 *     <li>{@link com.nimbusds.jose.EncryptionMethod#XC20P}
075 * </ul>
076 *
077 * <p>Supports the following content encryption algorithms for Key wrapping mode:
078 *
079 * <ul>
080 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A128CBC_HS256}
081 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A192CBC_HS384}
082 *     <li>{@link com.nimbusds.jose.EncryptionMethod#A256CBC_HS512}
083 * </ul>
084 * @author Alexander Martynov
085 * @version 2021-08-18
086 */
087@ThreadSafe
088public class ECDH1PUEncrypterMulti extends ECDH1PUCryptoProvider implements JWEEncrypterMulti {
089
090    /**
091     * The supported EC JWK curves by the ECDH crypto provider class.
092     */
093    public static final Set<Curve> SUPPORTED_ELLIPTIC_CURVES;
094
095
096    static {
097        Set<Curve> curves = new LinkedHashSet<>();
098        curves.add(Curve.P_256);
099        curves.add(Curve.P_384);
100        curves.add(Curve.P_521);
101        SUPPORTED_ELLIPTIC_CURVES = Collections.unmodifiableSet(curves);
102    }
103
104    /**
105     * The private sender JWK key.
106     */
107    private final ECKey sender;
108
109    /**
110     * The list of public recipient's keys.
111     */
112    private final List<Pair<UnprotectedHeader, ECKey>>recipients;
113
114    /**
115     * Creates Elliptic Curve Diffie-Hellman Multi-recipient encryptor.
116     *
117     * @param sender     The private sender JWK key.
118     * @param recipients The list of public recipient's keys.
119     *
120     * @throws JOSEException If the key subtype is not supported.
121     */
122    public ECDH1PUEncrypterMulti(final ECKey sender, final List<Pair<UnprotectedHeader, ECKey>>recipients)
123        throws JOSEException {
124
125        super(sender.getCurve());
126
127        this.sender = sender;
128        this.recipients = recipients;
129    }
130
131    @Override
132    public Set<Curve> supportedEllipticCurves() {
133        return SUPPORTED_ELLIPTIC_CURVES;
134    }
135
136    @Override
137    public JWECryptoParts encrypt(JWEHeader header, byte[] clearText) throws JOSEException {
138
139        // Generate ephemeral EC key pair on the same curve as the consumer's public key
140        ECKey ephemeralKeyPair = new ECKeyGenerator(getCurve()).generate();
141        ECPublicKey ephemeralPublicKey = ephemeralKeyPair.toECPublicKey();
142        ECPrivateKey ephemeralPrivateKey = ephemeralKeyPair.toECPrivateKey();
143
144        // Add the ephemeral public EC key to the header
145        JWEHeader updatedHeader = new JWEHeader.Builder(header).
146                ephemeralPublicKey(new ECKey.Builder(getCurve(), ephemeralPublicKey).build()).
147                build();
148
149        List<Pair<UnprotectedHeader, SecretKey>> sharedKeys = new ArrayList<>();
150
151        for (Pair<UnprotectedHeader, ECKey> recipient : recipients) {
152            SecretKey Z = ECDH1PU.deriveSenderZ(
153                    sender.toECPrivateKey(),
154                    recipient.getRight().toECPublicKey(),
155                    ephemeralPrivateKey,
156                    getJCAContext().getKeyEncryptionProvider()
157            );
158
159            sharedKeys.add(Pair.of(recipient.getLeft(), Z));
160        }
161
162        return encryptMulti(updatedHeader, sharedKeys, clearText);
163    }
164}