![]() This is a huge patch that should be a global NOP. For unix type platforms it enables -Wconversion to issue warnings (-> error) for all automatic casts that seem less than ideal but are normally concealed by the toolchain. This is things like passing an int to a size_t argument. Once enabled, I went through all args on my default build (which build most things) and tried to make the removed default cast explicit. With that approach it neither change nor bloat the code, since it compiles to whatever it was doing before, just with the casts made explicit... in a few cases I changed some length args from int to size_t but largely left the causes alone. From now on, new code that is relying on less than ideal casting will complain and nudge me to improve it by warnings. |
||
---|---|---|
.. | ||
jwe | ||
jwk | ||
jws | ||
CMakeLists.txt | ||
private-lib-jose.h | ||
README.md |
JOSE support
JOSE is a set of web standards aimed at encapsulating crypto operations flexibly inside JSON objects.
Lws provides lightweight apis to performs operations on JWK, JWS and JWE independent of the tls backend in use. The JSON parsing is handled by the lws lejp stream parser.
Part | RFC | Function |
---|---|---|
JWS | RFC7515 | JSON Web Signatures |
JWE | RFC7516 | JSON Web Encryption |
JWK | RFC7517 | JSON Web Keys |
JWA | RFC7518 | JSON Web Algorithms |
JWA is a set of recommendations for which combinations of algorithms are deemed desirable and secure, which implies what must be done for useful implementations of JWS, JWE and JWK.
Supported algorithms
Supported keys
-
All RFC7517 / JWK forms: octet, RSA and EC
-
singleton and keys[] arrays of keys supported
Symmetric ciphers
- All common AES varaiants: CBC, CFB128, CFB8, CTR, EVB, OFB, KW and XTS
Asymmetric ciphers
-
RSA
-
EC (P-256, P-384 and P-521 JWA curves)
Payload auth and crypt
- AES_128_CBC_HMAC_SHA_256
- AES_192_CBC_HMAC_SHA_384
- AES_256_CBC_HMAC_SHA_512
- AES_128_GCM
For the required and recommended asymmetric algorithms, support currently looks like this
JWK kty | JWA | lws |
---|---|---|
EC | Recommended+ | yes |
RSA | Required | yes |
oct | Required | yes |
JWE alg | JWA | lws |
---|---|---|
RSA1_5 | Recommended- | yes |
RSA-OAEP | Recommended+ | no |
ECDH-ES | Recommended+ | no |
JWS alg | JWA | lws |
---|---|---|
HS256 | Required | yes |
RS256 | Recommended+ | yes |
ES256 | Recommended | yes |
Minimal Example tools
API tests
See ./minimal-examples/api-tests/api-test-jose/
for example test code.
The tests are built and confirmed during CI.