mz.attahri.com/code/jose

JOSE

Go implementation of JSON Object Signing and Encryption (JOSE) standards.

Package	Description	RFC
jwk	JSON Web Key	RFC 7517
jws	JSON Web Signature	RFC 7515
jwe	JSON Web Encryption	RFC 7516

JWK

Parse, create, and serialize cryptographic keys in JWK format.

// Parse a JWK Set (e.g., from /.well-known/jwks.json)
set, err := jwk.ParseSet(jsonData)
verifiers, err := set.Verifiers()
verified, err := jws.Verify(token, verifiers...)

// Create JWK from Go crypto key
privateJWK, err := jwk.FromPrivateKey(ecdsaKey, "key-id")
signer, err := privateJWK.Signer()

Supported key types:

• EC (P-256, P-384, P-521) for ECDSA
• RSA for RS*/PS* algorithms
• OKP (Ed25519) for EdDSA
• oct for HMAC

JWS

Sign and verify data with digital signatures or MACs.

// Sign
signer, verifier, err := jws.HMAC(crypto.SHA256, "key-id", secret)
msg, err := jws.Sign([]byte("payload"), signer)
token, err := msg.Compact()

// Verify
verified, err := jws.Verify(token, verifier)
fmt.Println(string(verified.Payload))

Supported algorithms:

Algorithm	Type	Constructor
HS256, HS384, HS512	HMAC	jws.HMAC
RS256, RS384, RS512	RSA PKCS#1 v1.5	jws.RSA
PS256, PS384, PS512	RSA-PSS	jws.RSAPSS
ES256, ES384, ES512	ECDSA	jws.ECDSA
EdDSA	Ed25519	jws.EdDSA

JWE

Encrypt and decrypt data with authenticated encryption.

// Encrypt
encrypter, err := jwe.RSAOAEP256(publicKey, jwe.A256GCM, "key-id")
msg, err := jwe.Encrypt([]byte("secret"), encrypter)
token, err := msg.Compact()

// Decrypt
decrypter, err := jwe.RSAOAEP256Decrypter(privateKey, "key-id")
decrypted, err := jwe.Decrypt(token, decrypter)
fmt.Println(string(decrypted.Plaintext))

Key management algorithms:

Algorithm	Type	Constructor
RSA-OAEP	RSA-OAEP with SHA-1	jwe.RSAOAEP
RSA-OAEP-256	RSA-OAEP with SHA-256	jwe.RSAOAEP256
A128KW, A192KW, A256KW	AES Key Wrap	jwe.A128KW, jwe.A192KW, jwe.A256KW
ECDH-ES	ECDH Ephemeral Static	jwe.ECDHES
ECDH-ES+A128KW, +A192KW, +A256KW	ECDH-ES with AES Key Wrap	jwe.ECDHESA128KW, etc.
dir	Direct encryption	jwe.Direct

Content encryption algorithms:

Algorithm	Description
A128GCM, A192GCM, A256GCM	AES-GCM
A128CBC-HS256, A192CBC-HS384, A256CBC-HS512	AES-CBC with HMAC