001/*
002 * nimbus-jose-jwt
003 *
004 * Copyright 2012-2021, Connect2id Ltd and contributors.
005 *
006 * Licensed under the Apache License, Version 2.0 (the "License"); you may not use
007 * this file except in compliance with the License. You may obtain a copy of the
008 * License at
009 *
010 *    http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software distributed
013 * under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
014 * CONDITIONS OF ANY KIND, either express or implied. See the License for the
015 * specific language governing permissions and limitations under the License.
016 */
017
018package com.nimbusds.jose.crypto;
019
020
021import com.nimbusds.jose.*;
022import com.nimbusds.jose.crypto.impl.*;
023import com.nimbusds.jose.jwk.Curve;
024import com.nimbusds.jose.jwk.OctetKeyPair;
025import com.nimbusds.jose.jwk.gen.OctetKeyPairGenerator;
026import com.nimbusds.jose.util.Pair;
027import net.jcip.annotations.ThreadSafe;
028
029import javax.crypto.SecretKey;
030import java.util.*;
031
032
033/**
034 * Elliptic Curve Diffie-Hellman Multi-recipient encrypter of
035 * {@link JWEObjectJSON JWE objects} for curves using EC JWK keys.
036 * Expects a public EC key (with a P-256, P-384, or P-521 curve).
037 *
038 * <p>Public Key Authenticated Encryption for JOSE
039 * <a href="https://datatracker.ietf.org/doc/html/draft-madden-jose-ecdh-1pu-04">ECDH-1PU</a>
040 * for more information.
041 *
042 * <p>For Curve25519/X25519, see {@link ECDH1PUX25519Encrypter} instead.
043 *
044 * <p>This class is thread-safe.
045 *
046 * <p>Supports the following key management algorithms:
047 *
048 * <ul>
049 *     <li>{@link JWEAlgorithm#ECDH_1PU}
050 *     <li>{@link JWEAlgorithm#ECDH_1PU_A128KW}
051 *     <li>{@link JWEAlgorithm#ECDH_1PU_A192KW}
052 *     <li>{@link JWEAlgorithm#ECDH_1PU_A256KW}
053 * </ul>
054 *
055 * <p>Supports the following elliptic curves:
056 *
057 * <ul>
058 *     <li>{@link Curve#X25519}
059 * </ul>
060 *
061 * <p>Supports the following content encryption algorithms for Direct key agreement mode:
062 *
063 * <ul>
064 *     <li>{@link EncryptionMethod#A128CBC_HS256}
065 *     <li>{@link EncryptionMethod#A192CBC_HS384}
066 *     <li>{@link EncryptionMethod#A256CBC_HS512}
067 *     <li>{@link EncryptionMethod#A128GCM}
068 *     <li>{@link EncryptionMethod#A192GCM}
069 *     <li>{@link EncryptionMethod#A256GCM}
070 *     <li>{@link EncryptionMethod#A128CBC_HS256_DEPRECATED}
071 *     <li>{@link EncryptionMethod#A256CBC_HS512_DEPRECATED}
072 *     <li>{@link EncryptionMethod#XC20P}
073 * </ul>
074 *
075 * <p>Supports the following content encryption algorithms for Key wrapping mode:
076 *
077 * <ul>
078 *     <li>{@link EncryptionMethod#A128CBC_HS256}
079 *     <li>{@link EncryptionMethod#A192CBC_HS384}
080 *     <li>{@link EncryptionMethod#A256CBC_HS512}
081 * </ul>
082 *
083 * @author Alexander Martynov
084 * @version 2021-08-18
085 */
086@ThreadSafe
087public class ECDH1PUX25519EncrypterMulti extends ECDH1PUCryptoProvider implements JWEEncrypterMulti {
088
089    /**
090     * The supported EC JWK curves by the ECDH crypto provider class.
091     */
092    public static final Set<Curve> SUPPORTED_ELLIPTIC_CURVES;
093
094
095    static {
096        Set<Curve> curves = new LinkedHashSet<>();
097        curves.add(Curve.X25519);
098        SUPPORTED_ELLIPTIC_CURVES = Collections.unmodifiableSet(curves);
099    }
100
101    /**
102     * The private sender JWK key.
103     */
104    private final OctetKeyPair sender;
105
106    /**
107     * The list of public recipient's keys.
108     */
109    private final List<Pair<UnprotectedHeader, OctetKeyPair>>recipients;
110
111    /**
112     * Creates a curve x25519 Elliptic Curve Diffie-Hellman Multi-recipient encryptor.
113     *
114     * @param sender     The private sender JWK key.
115     * @param recipients The list of public recipient's keys.
116     *
117     * @throws JOSEException If the key subtype is not supported.
118     */
119    public ECDH1PUX25519EncrypterMulti(final OctetKeyPair sender, final List<Pair<UnprotectedHeader, OctetKeyPair>>recipients)
120        throws JOSEException {
121
122        super(sender.getCurve());
123
124        this.sender = sender;
125        this.recipients = recipients;
126    }
127
128    @Override
129    public Set<Curve> supportedEllipticCurves() {
130        return SUPPORTED_ELLIPTIC_CURVES;
131    }
132
133    @Override
134    public JWECryptoParts encrypt(JWEHeader header, byte[] clearText) throws JOSEException {
135
136        // Generate ephemeral OctetKey key pair on the same curve as the consumer's public key
137        OctetKeyPair ephemeralPrivateKey = new OctetKeyPairGenerator(getCurve()).generate();
138        OctetKeyPair ephemeralPublicKey = ephemeralPrivateKey.toPublicJWK();
139
140        // Add the ephemeral public OctetKey key to the header
141        JWEHeader updatedHeader = new JWEHeader.Builder(header).
142                ephemeralPublicKey(ephemeralPublicKey).
143                build();
144
145        List<Pair<UnprotectedHeader, SecretKey>> sharedKeys = new ArrayList<>();
146
147        for (Pair<UnprotectedHeader, OctetKeyPair> recipient : recipients) {
148            SecretKey Z = ECDH1PU.deriveSenderZ(
149                    sender,
150                    recipient.getRight().toPublicJWK(),
151                    ephemeralPrivateKey
152            );
153
154            sharedKeys.add(Pair.of(recipient.getLeft(), Z));
155        }
156
157        return encryptMulti(updatedHeader, sharedKeys, clearText);
158    }
159}