SYMKey handling difference to jwkest

[heck-gd]

Hi,

I'm currently looking to port some old code using jwkest to this newer library.

Consider these two example pieces:

from jwkest.jwk import SYMKey
from jwkest.jwe import JWE
key = "this-is-the-secret-key"
cyphered_token = "eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiQTEyOEtXIn0.H5jWzzXQISSh_QPCO5mWhT0EI9RRV45xA7vbWoxeBIjiCL3qwAmlzg.bBWVKwGTkta5y99c.ArycfFtrlmWgyZ4lwXw_JiSVmkn9YF6Xwlh8nVDku0BLW8kvaxNy3XRbbb17MtZ7mg.pDkpgDwffCyCy4sYNQI6zA"
sym_key = SYMKey(key=key, alg="A128KW")
token = JWE().decrypt(cyphered_token, keys=[sym_key])
print(token)

from cryptojwt.jwk.hmac import SYMKey
from cryptojwt.jwe.jwe import JWE
key = "this-is-the-secret-key"
cyphered_token = "eyJlbmMiOiJBMjU2R0NNIiwiYWxnIjoiQTEyOEtXIn0.H5jWzzXQISSh_QPCO5mWhT0EI9RRV45xA7vbWoxeBIjiCL3qwAmlzg.bBWVKwGTkta5y99c.ArycfFtrlmWgyZ4lwXw_JiSVmkn9YF6Xwlh8nVDku0BLW8kvaxNy3XRbbb17MtZ7mg.pDkpgDwffCyCy4sYNQI6zA"
sym_key = SYMKey(key=key, alg="A128KW")
token = JWE().decrypt(cyphered_token, keys=[sym_key])
print(token)

In the latter case, an exception is thrown because key does not represent a valid AES key length-wise.

This is because the old library did an extra derivation step on the key, while the new one simply accesses key.key directly.

Is this intended behavior?

If so, the whole existence of the encryption_key() func in the new library is a bit fishy, because it's only used in the appropriate_for() function and nowhere else.

[jschlyter]

The key attribute of the JWK object is the raw key in bytes. When serialized, the key attribute will be base64url-encoded. Example below:

from cryptojwt.jwe.jwe import JWE
from cryptojwt.jwk.hmac import new_sym_key

key = new_sym_key(bytes=32)
print(key)

jwe = JWE("The quick brown fox jumps over the lazy dog", alg="A256KW", enc="A256GCM")
token = jwe.encrypt(keys=[key], kid=key.kid)
print(token)

res = jwe.decrypt(token, keys=[key])
print(res)

Yields:

{'kty': 'oct', 'kid': 'ZyWDXhlRNOOD7XgWPm7-cU87dHJS9by9LLlCv_0Ecck', 'k': '7Fsr-N_9FcPr7hhRqPbnDL76-okfFGPCG5k2rrpxxxM'}
eyJhbGciOiJBMjU2S1ciLCJlbmMiOiJBMjU2R0NNIiwia2lkIjoiWnlXRFhobFJOT09EN1hnV1BtNy1jVTg3ZEhKUzlieTlMTGxDdl8wRWNjayJ9.Tvg-EY2Vefy7vCNiwhozepS7X2wr_HtlD4qX-LOq9o8eBhJOD4jLSA.KhSOgdkF_Cvl4lSXlcTq3Q.LeVG_gb_MespkTQoRn6FvvIGyngkKnwV_dso6l1pZCqF1U-rHqvspSckHg.F6lTbVqi64l329y8FMNZ-w
b'The quick brown fox jumps over the lazy dog'