Jose2go

https://pkg.go.dev/github.com/dvsekhvalnov/jose2go
Admin
Jose2go is a pure Golang library for generating, decoding, and encrypting JSON Web Tokens,...
Tokens:23,160
Snippets:194
Trust Score:9.6
Update:3 months ago
Show doc for...
Tokens:
Raw
### Create Plaintext Tokens

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Example of generating an unprotected (NONE algorithm) JWT token.

```go
package main

import (
	"fmt"
	"github.com/dvsekhvalnov/jose2go"
)

func main() {

	payload :=  `{"hello": "world"}`

	token,err := jose.Sign(payload,jose.NONE, nil)

	if(err==nil) {
		//go use token
		fmt.Printf("\nPlaintext = %v\n",token)
	}
}
```

--------------------------------

### Get Algorithm Function

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Returns a function to process headers and payload using the specified key and JWS algorithm.

```go
func Alg(key interface{}, jws string) func(headers map[string]interface{}, payload string) interface{}
```

--------------------------------

### Get Encryption Function

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Returns a function to process headers and payload using the specified key, JWA, and JWE algorithms.

```go
func Enc(key interface{}, jwa string, jwe string) func(headers map[string]interface{}, payload string) interface{}
```

--------------------------------

### Configure extra headers for signing and encryption

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Shows how to include additional headers using Header and Headers helpers. Note that alg, enc, and zip headers cannot be overridden.

```go
	token, err := jose.Sign(payload, jose.ES256, key,
                    		jose.Header("keyid", "111-222-333"),
                    		jose.Header("trans-id", "aaa-bbb"))
```

```go
token, err := jose.Encrypt(payload, jose.DIR, jose.A128GCM, sharedKey,
                    jose.Headers(map[string]interface{}{"keyid": "111-22-33", "cty": "text/plain"}))
```

--------------------------------

### AesKW Implementation

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

AES Key Wrap key management implementation.

```go
type AesKW struct {
	// contains filtered or unexported fields
}
```

```go
func (alg *AesKW) Name() string
```

```go
func (alg *AesKW) Unwrap(encryptedCek []byte, key interface{}, cekSizeBits int, header map[string]interface{}) (cek []byte, err error)
```

```go
func (alg *AesKW) WrapNewKey(cekSizeBits int, key interface{}, header map[string]interface{}) (cek []byte, encryptedCek []byte, err error)
```

--------------------------------

### Import Package

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Standard import statement for the jose2go library.

```go
import (
	"github.com/dvsekhvalnov/jose2go"
)
```

--------------------------------

### Create an ECB Encrypter

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go/aes

Initializes a BlockMode for AES encryption in ECB mode.

```go
func NewECBEncrypter(b cipher.Block) cipher.BlockMode
```

--------------------------------

### RsaPkcs1v15 Implementation

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

RS-AES using PKCS #1 v1.5 padding key management algorithm implementation.

```go
type RsaPkcs1v15 struct {
}
```

```go
func (alg *RsaPkcs1v15) Name() string
```

```go
func (alg *RsaPkcs1v15) Unwrap(encryptedCek []byte, key interface{}, cekSizeBits int, header map[string]interface{}) (cek []byte, err error)
```

--------------------------------

### Create an ECB Decrypter

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go/aes

Initializes a BlockMode for AES decryption in ECB mode.

```go
func NewECBDecrypter(b cipher.Block) cipher.BlockMode
```

--------------------------------

### RsaUsingSha Methods

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Methods for retrieving the algorithm name, signing input, and verifying signatures using RsaUsingSha.

```go
func (alg *RsaUsingSha) Name() string
```

```go
func (alg *RsaUsingSha) Sign(securedInput []byte, key interface{}) (signature []byte, err error)
```

```go
func (alg *RsaUsingSha) Verify(securedInput, signature []byte, key interface{}) error
```

--------------------------------

### AesGcmKW Implementation

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

AES GCM Key Wrap key management implementation.

```go
type AesGcmKW struct {
	// contains filtered or unexported fields
}
```

```go
func (alg *AesGcmKW) Name() string
```

```go
func (alg *AesGcmKW) Unwrap(encryptedCek []byte, key interface{}, cekSizeBits int, header map[string]interface{}) (cek []byte, err error)
```

```go
func (alg *AesGcmKW) WrapNewKey(cekSizeBits int, key interface{}, header map[string]interface{}) (cek []byte, encryptedCek []byte, err error)
```

--------------------------------

### JwcAlgorithm Interface and Management

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Contract for implementing compression algorithms and associated registration functions.

```go
type JwcAlgorithm interface {
	Compress(plainText []byte) []byte
	Decompress(compressedText []byte) ([]byte, error)
	Name() string
}
```

```go
func DeregisterJwc(alg string) JwcAlgorithm
```

```go
func NewDeflate(maxBufferSizeBytes int64) JwcAlgorithm
```

--------------------------------

### RsaPssUsingSha Methods

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Methods for retrieving the algorithm name, signing input, and verifying signatures using RsaPssUsingSha.

```go
func (alg *RsaPssUsingSha) Name() string
```

```go
func (alg *RsaPssUsingSha) Sign(securedInput []byte, key interface{}) (signature []byte, err error)
```

```go
func (alg *RsaPssUsingSha) Verify(securedInput, signature []byte, key interface{}) error
```

--------------------------------

### Register Custom PBKDF2 Parameters

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Override default iteration limits by registering a new algorithm implementation.

```go
	jose.RegisterJwa(NewPbse2HmacAesKWAlg(128, 1300000, 1300000))
	jose.RegisterJwa(NewPbse2HmacAesKWAlg(192, 950000, 950000))
	jose.RegisterJwa(NewPbse2HmacAesKWAlg(256, 600000, 600000))
```

--------------------------------

### Plaintext Implementation

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Plaintext (no signing) signing algorithm implementation.

```go
type Plaintext struct{}
```

```go
func (alg *Plaintext) Name() string
```

```go
func (alg *Plaintext) Sign(securedInput []byte, key interface{}) (signature []byte, err error)
```

```go
func (alg *Plaintext) Verify(securedInput []byte, signature []byte, key interface{}) error
```

--------------------------------

### Configure Compression Limits

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Adjust the decompression buffer size to prevent memory exhaustion attacks.

```go
    // Override compression alg with new limits (10Kb example)
    jose.RegisterJwc(RegisterJwc(NewDeflate(10240)))
```

--------------------------------

### RsaOaep Implementation

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

RSA OAEP key management algorithm implementation.

```go
type RsaOaep struct {
	// contains filtered or unexported fields
}
```

```go
func (alg *RsaOaep) Name() string
```

```go
func (alg *RsaOaep) Unwrap(encryptedCek []byte, key interface{}, cekSizeBits int, header map[string]interface{}) (cek []byte, err error)
```

```go
func (alg *RsaOaep) WrapNewKey(cekSizeBits int, key interface{}, header map[string]interface{}) (cek []byte, encryptedCek []byte, err error)
```

--------------------------------

### JwaAlgorithm Interface and Management

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Contract for implementing key management algorithms and associated registration functions.

```go
type JwaAlgorithm interface {
	WrapNewKey(cekSizeBits int, key interface{}, header map[string]interface{}) (cek []byte, encryptedCek []byte, err error)
	Unwrap(encryptedCek []byte, key interface{}, cekSizeBits int, header map[string]interface{}) (cek []byte, err error)
	Name() string
}
```

```go
func DeregisterJwa(alg string) JwaAlgorithm
```

```go
func NewPbse2HmacAesKWAlg(keySize int, maxIters int64, minIters int64) JwaAlgorithm
```

--------------------------------

### JwsAlgorithm Interface and Management

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Contract for implementing signing algorithms and associated registration functions.

```go
type JwsAlgorithm interface {
	Verify(securedInput, signature []byte, key interface{}) error
	Sign(securedInput []byte, key interface{}) (signature []byte, err error)
	Name() string
}
```

```go
func DeregisterJws(alg string) JwsAlgorithm
```

--------------------------------

### Pbse2HmacAesKW Implementation

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

PBSE2 with HMAC key management algorithm implementation.

```go
type Pbse2HmacAesKW struct {
	// contains filtered or unexported fields
}
```

```go
func (alg *Pbse2HmacAesKW) Name() string
```

```go
func (alg *Pbse2HmacAesKW) Unwrap(encryptedCek []byte, key interface{}, cekSizeBits int, header map[string]interface{}) (cek []byte, err error)
```

```go
func (alg *Pbse2HmacAesKW) WrapNewKey(cekSizeBits int, key interface{}, header map[string]interface{}) (cek []byte, encryptedCek []byte, err error)
```

--------------------------------

### Configure JWT Headers

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Helper functions to set headers in the JoseConfig.

```go
func Header(name string, value interface{}) func(cfg *JoseConfig)
```

```go
func Headers(headers map[string]interface{}) func(cfg *JoseConfig)
```

--------------------------------

### WrapNewKey for RsaPkcs1v15

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Wraps a new content encryption key using the RSA PKCS#1 v1.5 algorithm.

```go
func (alg *RsaPkcs1v15) WrapNewKey(cekSizeBits int, key interface{}, header map[string]interface{}) (cek []byte, encryptedCek []byte, err error)
```

--------------------------------

### Direct Key Management

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Direct (pre-shared) key management implementation.

```go
type Direct struct {
}
```

```go
func (alg *Direct) Name() string
```

```go
func (alg *Direct) Unwrap(encryptedCek []byte, key interface{}, cekSizeBits int, header map[string]interface{}) (cek []byte, err error)
```

```go
func (alg *Direct) WrapNewKey(cekSizeBits int, key interface{}, header map[string]interface{}) (cek []byte, encryptedCek []byte, err error)
```

--------------------------------

### Migrate Compression Interface

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Updates for v1.2 where the standalone Compress method is deprecated in favor of configuration options within the Encrypt method.

```go
token,err := jose.Compress(payload,jose.DIR,jose.A128GCM,jose.DEF, key)
```

```go
token, err := jose.Encrypt(payload, jose.DIR, jose.A128GCM, key, jose.Zip(jose.DEF))
```

--------------------------------

### Define PBKDF2 Iteration Limits

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Default iteration counts for PBES2 algorithms based on OWASP recommendations.

```text
PBES2-HS256+A128KW: 1300000
PBES2-HS384+A192KW: 950000
PBES2-HS512+A256KW: 600000
```

--------------------------------

### Configure JWT Header

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Use these patterns to manually specify the 'typ' header in signing or encryption operations, mimicking behavior from versions prior to 1.4.

```go
token, err := jose.Sign(..., jose.Header("typ", "JWT"))

//or

token, err := jose.Encrypt(..., jose.Header("typ", "JWT"))
```

--------------------------------

### Set Compression Algorithm

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Configures the compression algorithm for the JWT.

```go
func Zip(alg string) func(cfg *JoseConfig)
```

--------------------------------

### Add PKCS7 Padding

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go/padding

Pads a byte array using the PKCS7 schema to reach the specified block size.

```go
func AddPkcs7(data []byte, blockSize int) []byte
```

--------------------------------

### Perform Two-phase Validation

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Use matchers to verify algorithm or encryption headers before decoding the payload.

```go
	token := "eyJhbGciOiJSUzI1NiIsImN0eSI6InRleHRcL3BsYWluIn0.eyJoZWxsbyI6ICJ3b3JsZCJ9.NL_dfVpZkhNn4bZpCyMq5TmnXbT4yiyecuB6Kax_lV8Yq2dG8wLfea-T4UKnrjLOwxlbwLwuKzffWcnWv3LVAWfeBxhGTa0c4_0TX_wzLnsgLuU6s9M2GBkAIuSMHY6UTFumJlEeRBeiqZNrlqvmAzQ9ppJHfWWkW4stcgLCLMAZbTqvRSppC1SMxnvPXnZSWn_Fk_q3oGKWw6Nf0-j-aOhK0S0Lcr0PV69ZE4xBYM9PUS1MpMe2zF5J3Tqlc1VBcJ94fjDj1F7y8twmMT3H1PI9RozO-21R0SiXZ_a93fxhE_l_dj5drgOek7jUN9uBDjkXUwJPAyp9YPehrjyLdw"

	key := Rsa.ReadPublic(....)

	// we expecting 'RS256' alg here and if matching continue to decode with a key
	payload, header, err := jose.Decode(token, Alg(key, "RS256"))

	// or match both alg and enc for decrypting scenarios
	payload, header, err := jose.Decode(token, Enc(key, "RSA-OAEP-256", "A192CBC-HS384"))
```

--------------------------------

### Register Algorithms

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Registers new algorithms for key management, compression, encryption, or signing.

```go
func RegisterJwa(alg JwaAlgorithm)
```

```go
func RegisterJwc(alg JwcAlgorithm)
```

```go
func RegisterJwe(alg JweEncryption)
```

```go
func RegisterJws(alg JwsAlgorithm)
```

--------------------------------

### NewPbse2HmacAesKWAlg

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Creates a new PBSE2 HMAC AES Key Wrap algorithm instance.

```APIDOC
## func NewPbse2HmacAesKWAlg(keySize int, maxIters int64, minIters int64) JwaAlgorithm

### Description
Initializes a new PBSE2 HMAC AES Key Wrap algorithm with specified parameters.

### Parameters
- **keySize** (int) - Required - The key size in bits.
- **maxIters** (int64) - Required - Maximum iterations for PBKDF2.
- **minIters** (int64) - Required - Minimum iterations for PBKDF2.

### Returns
- **JwaAlgorithm** - The initialized algorithm instance.
```

--------------------------------

### Ecdh Key Management

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Elliptic curve Diffie–Hellman key agreement implementation.

```go
type Ecdh struct {
	// contains filtered or unexported fields
}
```

```go
func (alg *Ecdh) Name() string
```

```go
func (alg *Ecdh) Unwrap(encryptedCek []byte, key interface{}, cekSizeBits int, header map[string]interface{}) (cek []byte, err error)
```

```go
func (alg *Ecdh) WrapNewKey(cekSizeBits int, key interface{}, header map[string]interface{}) (cek []byte, encryptedCek []byte, err error)
```

--------------------------------

### Sign tokens with HS-256

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Requires a []byte key of the appropriate length for the chosen HS algorithm.

```go
package main

import (
	"fmt"
	"github.com/dvsekhvalnov/jose2go"
)

func main() {

	payload :=  `{"hello": "world"}`

	key := []byte{97,48,97,50,97,98,100,56,45,54,49,54,50,45,52,49,99,51,45,56,51,100,54,45,49,99,102,53,53,57,98,52,54,97,102,99}

	token,err := jose.Sign(payload,jose.HS256,key)

	if(err==nil) {
		//go use token
		fmt.Printf("\nHS256 = %v\n",token)
	}
}
```

--------------------------------

### Align Byte Array

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go/padding

Left pads a byte array with zeros until it reaches the specified bit size length.

```go
func Align(data []byte, bitSize int) []byte
```

--------------------------------

### Read RSA Public Key

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go/keys/rsa

Loads an rsa.PublicKey from PKIX or PKCS1 X509 byte blobs.

```go
func ReadPublic(raw []byte) (key *rsa.PublicKey, err error)
```

--------------------------------

### Handle binary payloads with jose2go

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Use the Bytes-suffixed functions to process raw binary data instead of strings for decoding, signing, and encryption.

```go
package main

import (
	"github.com/dvsekhvalnov/jose2go"
)

func main() {

	token :=  `eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMjU2R0NNIiwicDJjIjo4MTkyLCJwMnMiOiJlZWpFZTF0YmJVbU5XV2s2In0.J2HTgltxH3p7A2zDgQWpZPgA2CHTSnDmMhlZWeSOMoZ0YvhphCeg-w.FzYG5AOptknu7jsG.L8jAxfxZhDNIqb0T96YWoznQ.yNeOfQWUbm8KuDGZ_5lL_g`

	passphrase := `top secret`

	payload, headers, err := jose.DecodeBytes(token,passphrase)

	if(err==nil) {
		//go use token
		//payload = []byte{....}
	}
}
```

```go
package main

import (
    "fmt"
    "io/ioutil"
    Rsa "github.com/dvsekhvalnov/jose2go/keys/rsa"
    "github.com/dvsekhvalnov/jose2go"
)

func main() {

    payload :=  []byte {0x01, 0x02, 0x03, 0x04}

    keyBytes,err := ioutil.ReadFile("private.key")

    if(err!=nil) {
        panic("invalid key file")
    }

    privateKey,e:=Rsa.ReadPrivate(keyBytes)

    if(e!=nil) {
        panic("invalid key format")
    }

    token,err := jose.SignBytes(payload,jose.RS256, privateKey)

    if(err==nil) {
        //go use token
        fmt.Printf("\nRS256 = %v\n",token)
    }
}
```

```go
package main

import (
    "fmt"
    "io/ioutil"
    Rsa "github.com/dvsekhvalnov/jose2go/keys/rsa"
    "github.com/dvsekhvalnov/jose2go"
)

func main() {

    payload :=  []byte {0x01, 0x02, 0x03, 0x04}

    keyBytes,err := ioutil.ReadFile("public.key")

    if(err!=nil) {
        panic("invalid key file")
    }

    publicKey,e:=Rsa.ReadPublic(keyBytes)

    if(e!=nil) {
        panic("invalid key format")
    }

    token,err := jose.EncryptBytes(payload, jose.RSA_OAEP, jose.A256GCM, publicKey)

    if(err==nil) {
        //go use token
        fmt.Printf("\ntoken = %v\n",token)
    }
}
```

--------------------------------

### Encrypting with RSA Key Management

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Uses RSA-OAEP or RSA1_5 algorithms requiring an *rsa.PublicKey. The public key can be loaded from a file using the keys/rsa package.

```go
package main

import (
    "fmt"
    "io/ioutil"
    Rsa "github.com/dvsekhvalnov/jose2go/keys/rsa"
    "github.com/dvsekhvalnov/jose2go"
)

func main() {

	payload :=  `{"hello": "world"}`

	keyBytes,err := ioutil.ReadFile("public.key")

	if(err!=nil) {
		panic("invalid key file")
	}

	publicKey,e:=Rsa.ReadPublic(keyBytes)

	if(e!=nil) {
		panic("invalid key format")
	}

	//OR:
	//token,err := jose.Encrypt(payload, jose.RSA1_5, jose.A256GCM, publicKey)
	token,err := jose.Encrypt(payload, jose.RSA_OAEP, jose.A256GCM, publicKey)

    if(err==nil) {
        //go use token
        fmt.Printf("\ntoken = %v\n",token)
    }
}
```

--------------------------------

### Key Management Algorithms

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Common methods for key wrapping and unwrapping across various algorithms like AesGcmKW, AesKW, Direct, Ecdh, and EcdhAesKW.

```APIDOC
## Unwrap

### Signature
func (alg) Unwrap(encryptedCek []byte, key interface{}, cekSizeBits int, header map[string]interface{}) (cek []byte, err error)

## WrapNewKey

### Signature
func (alg) WrapNewKey(cekSizeBits int, key interface{}, header map[string]interface{}) (cek []byte, encryptedCek []byte, err error)
```

--------------------------------

### EcdhAesKW Key Management

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Elliptic curve Diffie–Hellman with AES Key Wrap implementation.

```go
type EcdhAesKW struct {
	// contains filtered or unexported fields
}
```

```go
func (alg *EcdhAesKW) Name() string
```

```go
func (alg *EcdhAesKW) Unwrap(encryptedCek []byte, key interface{}, cekSizeBits int, header map[string]interface{}) (cek []byte, err error)
```

```go
func (alg *EcdhAesKW) WrapNewKey(cekSizeBits int, key interface{}, header map[string]interface{}) (cek []byte, encryptedCek []byte, err error)
```

--------------------------------

### Align

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go/padding

Left pads a byte array with zeros to reach a specified bit size.

```APIDOC
## func Align(data []byte, bitSize int) []byte

### Description
Left pads the given byte array with zeros until it has at least the specified bit size length.

### Parameters
- **data** ([]byte) - The input byte array to be aligned.
- **bitSize** (int) - The target length in bits.

### Returns
- **[]byte** - The aligned byte array.
```

--------------------------------

### Deflate Compression

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Deflate compression algorithm implementation.

```go
type Deflate struct {
	// contains filtered or unexported fields
}
```

```go
func (alg *Deflate) Compress(plainText []byte) []byte
```

```go
func (alg *Deflate) Decompress(compressedText []byte) ([]byte, error)
```

```go
func (alg *Deflate) Name() string
```

--------------------------------

### HmacUsingSha Implementation

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

HMAC with SHA signing algorithm implementation.

```go
type HmacUsingSha struct {
	// contains filtered or unexported fields
}
```

```go
func (alg *HmacUsingSha) Name() string
```

```go
func (alg *HmacUsingSha) Sign(securedInput []byte, key interface{}) (signature []byte, err error)
```

```go
func (alg *HmacUsingSha) Verify(securedInput, signature []byte, key interface{}) error
```

--------------------------------

### Serialize data to compact format

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go/compact

Converts multiple byte slices into a single compact serialization format string.

```go
func Serialize(parts ...[]byte) string
```

--------------------------------

### Encrypting with PBES2

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Uses PBES2 key management requiring a string passphrase for key derivation.

```go
package main

import (
	"fmt"
	"github.com/dvsekhvalnov/jose2go"
)

func main() {

	payload :=  `{"hello": "world"}`

	passphrase := `top secret`

	token,err := jose.Encrypt(payload,jose.PBES2_HS256_A128KW,jose.A256GCM,passphrase)

	if(err==nil) {
		//go use token
		fmt.Printf("\nPBES2_HS256_A128KW A256GCM = %v\n",token)
	}
}
```

--------------------------------

### Decode tokens with RSA private keys

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Use RSA private keys for RSA-OAEP and RSA1_5 key management algorithms.

```go
package main

import (
    "fmt"
    "io/ioutil"
    Rsa "github.com/dvsekhvalnov/jose2go/keys/rsa"
    "github.com/dvsekhvalnov/jose2go"
)

func main() {

    token := "eyJhbGciOiJSU0ExXzUiLCJlbmMiOiJBMjU2R0NNIn0.ixD3WVOkvaxeLKi0kyVqTzM6W2EW25SHHYCAr9473Xq528xSK0AVux6kUtv7QMkQKgkMvO8X4VdvonyGkDZTK2jgYUiI06dz7I1sjWJIbyNVrANbBsmBiwikwB-9DLEaKuM85Lwu6gnzbOF6B9R0428ckxmITCPDrzMaXwYZHh46FiSg9djChUTex0pHGhNDiEIgaINpsmqsOFX1L2Y7KM2ZR7wtpR3kidMV3JlxHdKheiPKnDx_eNcdoE-eogPbRGFdkhEE8Dyass1ZSxt4fP27NwsIer5pc0b922_3XWdi1r1TL_fLvGktHLvt6HK6IruXFHpU4x5Z2gTXWxEIog.zzTNmovBowdX2_hi.QSPSgXn0w25ugvzmu2TnhePn.0I3B9BE064HFNP2E0I7M9g"

    keyBytes, err := ioutil.ReadFile("private.key")

    if(err!=nil) {
        panic("invalid key file")
    }

    privateKey, e:=Rsa.ReadPrivate(keyBytes)

    if(e!=nil) {
        panic("invalid key format")
    }

    payload, headers, err := jose.Decode(token, privateKey)

    if(err==nil) {
        //go use payload
        fmt.Printf("\npayload = %v\n",payload)

        //and/or use headers
        fmt.Printf("\nheaders = %v\n",headers)
    }
}
```

--------------------------------

### AesGcm Implementation

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Structure and methods for AES GCM authenticated encryption.

```go
type AesGcm struct {
	// contains filtered or unexported fields
}
```

```go
func (alg *AesGcm) Decrypt(aad, cek, iv, cipherText, authTag []byte) (plainText []byte, err error)
```

```go
func (alg *AesGcm) Encrypt(aad, plainText, cek []byte) (iv, cipherText, authTag []byte, err error)
```

```go
func (alg *AesGcm) KeySizeBits() int
```

```go
func (alg *AesGcm) Name() string
```

--------------------------------

### Dump byte array

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go/arrays

Produces a printable debug representation of a byte array as a string.

```go
func Dump(arr []byte) string
```

--------------------------------

### RsaPkcs1v15.WrapNewKey

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Wraps a new content encryption key using RSA PKCS#1 v1.5.

```APIDOC
### func (*RsaPkcs1v15) WrapNewKey

#### Signature
`func (alg *RsaPkcs1v15) WrapNewKey(cekSizeBits int, key interface{}, header map[string]interface{}) (cek []byte, encryptedCek []byte, err error)`
```

--------------------------------

### AesCbcHmac Methods

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Methods for AES-CBC-HMAC authenticated encryption.

```go
func (alg *AesCbcHmac) Decrypt(aad, cek, iv, cipherText, authTag []byte) (plainText []byte, err error)
```

```go
func (alg *AesCbcHmac) Encrypt(aad, plainText, cek []byte) (iv, cipherText, authTag []byte, err error)
```

```go
func (alg *AesCbcHmac) KeySizeBits() int
```

```go
func (alg *AesCbcHmac) Name() string
```

```go
func (alg *AesCbcHmac) SetKeySizeBits(bits int)
```

--------------------------------

### Sign tokens with RS-256

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Uses an *rsa.PrivateKey. The library provides utilities in jose2go/keys/rsa to load keys from PEM encoded PKCS1 or PKCS8 data.

```go
package main

import (
	"fmt"
	"io/ioutil"
	Rsa "github.com/dvsekhvalnov/jose2go/keys/rsa"
	"github.com/dvsekhvalnov/jose2go"
)

func main() {

	payload :=  `{"hello": "world"}`

	keyBytes,err := ioutil.ReadFile("private.key")

	if(err!=nil) {
		panic("invalid key file")
	}

	privateKey,e:=Rsa.ReadPrivate(keyBytes)

	if(e!=nil) {
		panic("invalid key format")
	}

	token,err := jose.Sign(payload,jose.RS256, privateKey)

	if(err==nil) {
		//go use token
		fmt.Printf("\nRS256 = %v\n",token)
	}
}
```

--------------------------------

### Read RSA Private Key

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go/keys/rsa

Loads an rsa.PrivateKey from PKCS1 or PKCS8 byte blobs.

```go
func ReadPrivate(raw []byte) (key *rsa.PrivateKey, err error)
```

--------------------------------

### JweEncryption Interface and Management

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Contract for implementing encryption algorithms and associated registration functions.

```go
type JweEncryption interface {
	Encrypt(aad, plainText, cek []byte) (iv, cipherText, authTag []byte, err error)
	Decrypt(aad, cek, iv, cipherText, authTag []byte) (plainText []byte, err error)
	KeySizeBits() int
	Name() string
}
```

```go
func DeregisterJwe(alg string) JweEncryption
```

--------------------------------

### Encrypting with AES Key Wrap

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Uses AES-KW algorithms requiring a []byte shared key of the appropriate length.

```go
package main

import (
	"fmt"
	"github.com/dvsekhvalnov/jose2go"
)

func main() {

	payload :=  `{"hello": "world"}`

	sharedKey :=[]byte{194,164,235,6,138,248,171,239,24,216,11,22,137,199,215,133}

	token,err := jose.Encrypt(payload,jose.A128KW,jose.A128GCM,sharedKey)

	if(err==nil) {
		//go use token
		fmt.Printf("\nA128KW A128GCM = %v\n",token)
	}
}
```

--------------------------------

### Decode ECDH-ES token with ECDSA private key

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Demonstrates decoding a token using an ECDSA private key constructed from X, Y, and D parameters.

```go
package main

import (
    "fmt"
    "github.com/dvsekhvalnov/jose2go/keys/ecc"
    "github.com/dvsekhvalnov/jose2go"
)

func main() {

    token := "eyJhbGciOiJFQ0RILUVTIiwiZW5jIjoiQTEyOENCQy1IUzI1NiIsImVwayI6eyJrdHkiOiJFQyIsIngiOiItVk1LTG5NeW9IVHRGUlpGNnFXNndkRm5BN21KQkdiNzk4V3FVMFV3QVhZIiwieSI6ImhQQWNReTgzVS01Qjl1U21xbnNXcFZzbHVoZGJSZE1nbnZ0cGdmNVhXTjgiLCJjcnYiOiJQLTI1NiJ9fQ..UA3N2j-TbYKKD361AxlXUA.XxFur_nY1GauVp5W_KO2DEHfof5s7kUwvOgghiNNNmnB4Vxj5j8VRS8vMOb51nYy2wqmBb2gBf1IHDcKZdACkCOMqMIcpBvhyqbuKiZPLHiilwSgVV6ubIV88X0vK0C8ZPe5lEyRudbgFjdlTnf8TmsvuAsdtPn9dXwDjUR23bD2ocp8UGAV0lKqKzpAw528vTfD0gwMG8gt_op8yZAxqqLLljMuZdTnjofAfsW2Rq3Z6GyLUlxR51DAUlQKi6UpsKMJoXTrm1Jw8sXBHpsRqA.UHCYOtnqk4SfhAknCnymaQ"

	privateKey:=ecc.NewPrivate([]byte{4, 114, 29, 223, 58, 3, 191, 170, 67, 128, 229, 33, 242, 178, 157, 150, 133, 25, 209, 139, 166, 69, 55, 26, 84, 48, 169, 165, 67, 232, 98, 9},
	 	 	 	 	 	   []byte{131, 116, 8, 14, 22, 150, 18, 75, 24, 181, 159, 78, 90, 51, 71, 159, 214, 186, 250, 47, 207, 246, 142, 127, 54, 183, 72, 72, 253, 21, 88, 53},
						   []byte{ 42, 148, 231, 48, 225, 196, 166, 201, 23, 190, 229, 199, 20, 39, 226, 70, 209, 148, 29, 70, 125, 14, 174, 66, 9, 198, 80, 251, 95, 107, 98, 206 })

    payload, headers, err := jose.Decode(token, privateKey)

    if(err==nil) {
        //go use token
        fmt.Printf("\npayload = %v\n",payload)

        //and/or use headers
        fmt.Printf("\nheaders = %v\n",headers)
    }
}
```

--------------------------------

### Encrypting with Direct Symmetric Keys

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Uses the DIR algorithm with a pre-shared symmetric key provided as a []byte.

```go
package main

import (
	"fmt"
	"github.com/dvsekhvalnov/jose2go"
)

func main() {

	payload :=  `{"hello": "world"}`

	sharedKey :=[]byte{194,164,235,6,138,248,171,239,24,216,11,22,137,199,215,133}

	token,err := jose.Encrypt(payload,jose.DIR,jose.A128GCM,sharedKey)

	if(err==nil) {
		//go use token
		fmt.Printf("\nDIR A128GCM = %v\n",token)
	}
}
```

--------------------------------

### NewDeflate

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Creates a new Deflate compression algorithm instance.

```APIDOC
## func NewDeflate(maxBufferSizeBytes int64) JwcAlgorithm

### Description
Initializes a new Deflate compression algorithm instance.

### Parameters
- **maxBufferSizeBytes** (int64) - Required - The maximum buffer size in bytes.

### Returns
- **JwcAlgorithm** - The initialized compression algorithm instance.
```

--------------------------------

### EcdsaUsingSha Signing

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

ECDSA signing algorithm implementation.

```go
type EcdsaUsingSha struct {
	// contains filtered or unexported fields
}
```

```go
func (alg *EcdsaUsingSha) Name() string
```

```go
func (alg *EcdsaUsingSha) Sign(securedInput []byte, key interface{}) (signature []byte, err error)
```

--------------------------------

### Decode tokens with passphrase

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Use a string passphrase for PBES2 key management algorithms.

```go
package main

import (
	"fmt"
	"github.com/dvsekhvalnov/jose2go"
)

func main() {

	token :=  `eyJhbGciOiJQQkVTMi1IUzI1NitBMTI4S1ciLCJlbmMiOiJBMjU2R0NNIiwicDJjIjo4MTkyLCJwMnMiOiJlZWpFZTF0YmJVbU5XV2s2In0.J2HTgltxH3p7A2zDgQWpZPgA2CHTSnDmMhlZWeSOMoZ0YvhphCeg-w.FzYG5AOptknu7jsG.L8jAxfxZhDNIqb0T96YWoznQ.yNeOfQWUbm8KuDGZ_5lL_g`

	passphrase := `top secret`

	payload, headers, err := jose.Decode(token,passphrase)

	if(err==nil) {
		//go use token
		fmt.Printf("\npayload = %v\n",payload)

        //and/or use headers
        fmt.Printf("\nheaders = %v\n",headers)
	}
}
```

--------------------------------

### AddPkcs7

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go/padding

Pads a byte array using the PKCS7 padding schema to a specified block size.

```APIDOC
## func AddPkcs7(data []byte, blockSize int) []byte

### Description
Adds PKCS7 padding to the provided byte array until it reaches the specified block size.

### Parameters
- **data** ([]byte) - The input byte array to be padded.
- **blockSize** (int) - The target block size in bytes.

### Returns
- **[]byte** - The resulting byte array with PKCS7 padding applied.
```

--------------------------------

### Encrypting with ECDH-ES

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Uses ECDH-ES key management requiring an *ecdsa.PublicKey. Public keys can be constructed using the keys/ecc package.

```go
package main

import (
    "fmt"
    "github.com/dvsekhvalnov/jose2go/keys/ecc"
    "github.com/dvsekhvalnov/jose2go"
)

func main() {

    payload := `{"hello":"world"}`

    publicKey:=ecc.NewPublic([]byte{4, 114, 29, 223, 58, 3, 191, 170, 67, 128, 229, 33, 242, 178, 157, 150, 133, 25, 209, 139, 166, 69, 55, 26, 84, 48, 169, 165, 67, 232, 98, 9},
                             []byte{131, 116, 8, 14, 22, 150, 18, 75, 24, 181, 159, 78, 90, 51, 71, 159, 214, 186, 250, 47, 207, 246, 142, 127, 54, 183, 72, 72, 253, 21, 88, 53})

    token,err := jose.Encrypt(payload, jose.ECDH_ES, jose.A128CBC_HS256, publicKey)

    if(err==nil) {
        //go use token
        fmt.Printf("\ntoken = %v\n",token)
    }
}
```

--------------------------------

### RsaPssUsingSha Methods

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Methods for RSA PSS using SHA signing algorithm.

```APIDOC
### func (*RsaPssUsingSha) Name
`func (alg *RsaPssUsingSha) Name() string`

### func (*RsaPssUsingSha) Sign
`func (alg *RsaPssUsingSha) Sign(securedInput []byte, key interface{}) (signature []byte, err error)`

### func (*RsaPssUsingSha) Verify
`func (alg *RsaPssUsingSha) Verify(securedInput, signature []byte, key interface{}) error`
```

--------------------------------

### JoseConfig Structure

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Configuration structure for JOSE operations.

```go
type JoseConfig struct {
	CompressionAlg string
	Headers        map[string]interface{}
}
```

--------------------------------

### Parse compact serialized tokens

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go/compact

Splits and decodes a compact serialized JSON web token into a slice of byte arrays.

```go
func Parse(token string) (result [][]byte, e error)
```

--------------------------------

### Construct ECC Private Key

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Constructs an elliptic private key from X, Y, and D byte slices. The curve is detected automatically based on input length.

```go
package main

import (
	"fmt"
    "github.com/dvsekhvalnov/jose2go/keys/ecc"
)

func main() {

    ecPrivKey:=ecc.NewPrivate([]byte{4, 114, 29, 223, 58, 3, 191, 170, 67, 128, 229, 33, 242, 178, 157, 150, 133, 25, 209, 139, 166, 69, 55, 26, 84, 48, 169, 165, 67, 232, 98, 9},
		 					  []byte{131, 116, 8, 14, 22, 150, 18, 75, 24, 181, 159, 78, 90, 51, 71, 159, 214, 186, 250, 47, 207, 246, 142, 127, 54, 183, 72, 72, 253, 21, 88, 53},
							  []byte{ 42, 148, 231, 48, 225, 196, 166, 201, 23, 190, 229, 199, 20, 39, 226, 70, 209, 148, 29, 70, 125, 14, 174, 66, 9, 198, 80, 251, 95, 107, 98, 206 })

	fmt.Printf("ecPrivKey = %v\n",ecPrivKey)
}
```

--------------------------------

### Define MaxInt constant

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go/kdf

Defines the maximum integer value for the package.

```go
const (
	MaxInt = int(^uint(0) >> 1)
)
```

--------------------------------

### Encrypting with AES GCM Key Wrap

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Uses AES-GCM-KW algorithms requiring a []byte shared key.

```go
package main

import (
	"fmt"
	"github.com/dvsekhvalnov/jose2go"
)

func main() {

	payload :=  `{"hello": "world"}`

	sharedKey :=[]byte{194,164,235,6,138,248,171,239,24,216,11,22,137,199,215,133}

	token,err := jose.Encrypt(payload,jose.A128GCMKW,jose.A128GCM,sharedKey)

	if(err==nil) {
		//go use token
		fmt.Printf("\nA128GCMKW A128GCM = %v\n",token)
	}
}
```

--------------------------------

### Sign tokens with ES-256

Source: https://pkg.go.dev/github.com/dvsekhvalnov/jose2go

Requires an *ecdsa.PrivateKey. Keys can be constructed using ecc.ReadPrivate or ecc.NewPrivate from the jose2go/keys/ecc package.

```go
package main

import (
    "fmt"
    "github.com/dvsekhvalnov/jose2go/keys/ecc"
    "github.com/dvsekhvalnov/jose2go"
)

func main() {

    payload := `{"hello":"world"}`

	privateKey:=ecc.NewPrivate([]byte{4, 114, 29, 223, 58, 3, 191, 170, 67, 128, 229, 33, 242, 178, 157, 150, 133, 25, 209, 139, 166, 69, 55, 26, 84, 48, 169, 165, 67, 232, 98, 9},
	 		 			   []byte{131, 116, 8, 14, 22, 150, 18, 75, 24, 181, 159, 78, 90, 51, 71, 159, 214, 186, 250, 47, 207, 246, 142, 127, 54, 183, 72, 72, 253, 21, 88, 53},
						   []byte{ 42, 148, 231, 48, 225, 196, 166, 201, 23, 190, 229, 199, 20, 39, 226, 70, 209, 148, 29, 70, 125, 14, 174, 66, 9, 198, 80, 251, 95, 107, 98, 206 })

    token,err := jose.Sign(payload, jose.ES256, privateKey)

    if(err==nil) {
        //go use token
        fmt.Printf("\ntoken = %v\n",token)
    }
}
```
Tokens:
Raw