[CXF-8185] Generated Ephemeral Public Key missing in JWE Headers when Json Serialization is used

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 3.3.4
• Fix Version/s: 3.3.5
• Component/s: JAX-RS Security
• Estimated Complexity: Unknown
• Assignee: Colm O hEigeartaigh
• Reporter: Frederik Libert
• Created: 19/Dec/19 23:22
• Updated: 15/Jan/20 10:23
• Resolved: 03/Jan/20 15:51

Description

When using Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES), the
JWA Specification says that an Ephemeral Public Key MUST be set as "epk" Header Parameter (
https://tools.ietf.org/html/rfc7518#page-16).
The key is generated during the encryption process.
However, it is only added to the jwe output when using compact serialization.
When using Json serialization, the header gets lost somewhere along the way.

Issue Links

• relates to: CXF-8178 ECDH KeyAgreement with Key Wrapping is not in line with the specification
• relates to: CXF-8177 JWE API does not support ECDH Direct Encryption/Decryption
• links to: GitHub Pull Request #617