JWE-ENCRYPT(1) LibJWT C Library JWE-ENCRYPT(1) NAME jwe-encrypt - Encrypt content into a JSON Web Encryption (JWE) token SYNOPSIS jwe-encrypt -k KEY -a ALG -e ENC [options] DESCRIPTION jwe-encrypt encrypts content into a JWE token. By default it produces the Compact Serialization; -f selects a JSON Serialization instead. A JWE requires two algorithms: a key management algorithm (the alg header, given with -a) that determines how the Content Encryption Key (CEK) is pro- duced for the recipient, and a content encryption algorithm (the enc header, given with -e) that performs the authenticated encryption of the plaintext. The recipient key is supplied as a JSON Web Key with -k. See key2jwk(1) to convert a PEM or DER key to JWK format. The plaintext is encrypted once with a single CEK. Additional recipients may be added with -r: each independently wraps that same CEK with its own algorithm and key, and any one recipient's key can later decrypt the token. More than one recipient requires (and implies) the General JSON Serializa- tion. The plaintext is taken from the -j option or, if not given, read from stan- dard input. The resulting token is written to standard output. OPTIONS -h, --help Show help and exit. -k, --key=FILE File containing the recipient JSON Web Key. Required. -a, --algorithm=ALG The JWE key management algorithm. Required. One of: dir, A128KW, A192KW, A256KW, RSA-OAEP, RSA-OAEP-256, ECDH-ES, ECDH-ES+A128KW, ECDH-ES+A192KW, ECDH-ES+A256KW. -e, --enc=ENC The JWE content encryption algorithm. Required. One of: A128GCM, A192GCM, A256GCM, A128CBC-HS256, A192CBC-HS384, A256CBC-HS512. -f, --format=FORMAT The serialization to produce: compact (the default five-part string), json-flat (the Flattened JSON Serialization), or json-gen- eral (the General JSON Serialization). The Compact and Flattened forms carry exactly one recipient. -r, --recipient=ALG:FILE Add another recipient: key management algorithm ALG with the JWK in FILE. May be given more than once. Each recipient wraps the shared CEK independently. Using -r implies --format=json-general. dir and ECDH-ES (Direct) constrain the CEK and cannot be combined with other recipients. -A, --aad=FILE File whose raw contents become the JWE Additional Authenticated Data (the aad member). It is authenticated but not encrypted, and is only available in the JSON serializations. -j, --json=STRING The plaintext to encrypt. If omitted, the plaintext is read from standard input. NOTES For dir, the JWK must be a symmetric (oct) key whose length exactly matches the CEK length required by the enc algorithm. For A*KW, the JWK must be an oct key of the matching size. For RSA-OAEP and RSA-OAEP-256, the JWK must be an RSA public (or private) key. For ECDH-ES and its +A*KW variants, the JWK must be an EC key (P-256/384/521) or an OKP X-curve key (X25519/X448). The key must permit encryption use: a key marked "use":"sig" or whose key_ops forbid the operation is rejected. For the JSON serializations, the same header parameter name must not appear in more than one of the protected, shared-unprotected, or per-recipient headers; jwe-encrypt rejects a configuration that would violate this. SEE ALSO jwe-decrypt(1), key2jwk(1), jwt-generate(1) jwe-encrypt User Manual JWE-ENCRYPT(1)
NAME | SYNOPSIS | DESCRIPTION | OPTIONS | NOTES | SEE ALSO
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=jwe-encrypt&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>