[CXF-6641] JWE elliptic curve error

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.1.9
• Component/s: JAX-RS Security
• Estimated Complexity: Unknown
• Assignee: Sergey Beryozkin
• Reporter: Colm O hEigeartaigh
• Created: 14/Oct/15 14:29
• Updated: 31/Mar/17 19:38
• Resolved: 24/Mar/17 16:41

Description

There's a bug I spotted in the elliptic curve encryption code in JOSE - I'm not sure off hand what the correct behaviour is:

EcdhDirectKeyJweEncryption.EcdhHelper takes a "String ctAlgo" as a parameter that is later used as:

ContentAlgorithm jwtAlgo = ContentAlgorithm.valueOf(ctAlgo);

However, EcdhAesWrapKeyEncryptionAlgorithm which constructs EcdhHelper, passes through the key algorithm, not the content algorithm - keyAlgo.getJwaName() leading to an error.