JWS Class

Properties   Methods   Events   Config Settings   Errors  

Create, Sign and Verify JSON Web Signatures (JWS).

Syntax

ipworksencrypt.Jws

Remarks

The JWS class supports signing and verifying JSON Web Signatures (JWS).

Specify any payload via input properties and use Sign to create a JWS message using a variety of algorithms including HMAC, RSA, and ECDSA. Use Verify to verify the signature of any received JWS message. The following algorithms are supported:

  • HS256
  • HS384
  • HS512
  • RS256
  • RS384
  • RS512
  • PS256
  • PS384
  • PS512
  • ES256
  • ES384
  • ES512
  • None

See Algorithm for more details about supported algorithms.

Signing

The Sign method may be used to sign a payload with a variety of algorithms. Before calling the Sign method set Algorithm to the algorithm which will be used to sign the message. The result of signing is a compact serialized JWS string. For instance:

eyJhbGciOiJIUzI1NiJ9.dGVzdA.o_JihJlCwvBO1AgY_Ao3_VBivdFmj3ufv3ZWAqYF4Ow

The class is agnostic of the payload that is signed. Any value may be signed. KeyId may be set to include an identifier to help the receiving party identify the key used to sign the message. The following properties are applicable when calling this method:

Input and Output Properties

The class will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Notes for HMAC Algorithms (HS256, HS384, HS512)

When Algorithm is set to a HMAC algorithm Key must be set to a key of appropriate length for the algorithm. The Key should be the same number of bits as the algorithm being used. For instance a 256 bit key would be used for HS256.

The example code below uses the EzRand class to generate a key, but the key may be created using any means. The key must be known by both parties in order for signing and verification to take place.

//Generate a 256 bit (32 byte) key Ezrand ezrand = new Ezrand(); ezrand.RandBytesLength = 32; ezrand.GetNextBytes(); byte[] key = ezrand.RandBytesB; //Sign the payload using HS256 Jws jws = new Jws(); jws.Algorithm = JwsAlgorithms.jwsHS256; jws.InputMessage = "test data"; jws.KeyB = key; jws.Sign(); string signedData = jws.OutputMessage;

To use an existing HMAC key provide the bytes to the Key property. For instance:

//HMAC SHA-256 Key byte[] key = new byte[] { 170, 171, 221, 209, 7, 181, 48, 178, 48, 118, 242, 132, 36, 218, 74, 140, 216, 165, 161, 70, 11, 42, 246, 205, 235, 231, 19, 48, 87, 141, 122, 10 }; //Sign the payload using HS256 Jws jws = new Jws(); jws.Algorithm = JwsAlgorithms.jwsHS256; jws.InputMessage = "test data"; jws.KeyB = key; jws.Sign(); string signedData = jws.OutputMessage;

Notes for RSA Algorithms (RS256, RS384, RS512, PS256, PS384, PS512)

The RSA based algorithms use asymmetric encryption. Signing is done with a private key and verification is done with a public key. The private key may be in PFX or PEM format.

Jws jws = new Jws(); jws.Algorithm = JwsAlgorithms.jwsRS256; jws.Certificate = new Certificate(CertStoreTypes.cstPFXFile, "..\\jwt.pfx", "test", "*"); jws.InputMessage = "test"; jws.Sign(); string signedMessage = jws.OutputMessage;

Notes for ECDSA Algorithms (ES256, ES384, ES512)

ECDSA algorithms require a valid ECC private key to sign. The ECC class can be used to create or import an ECC key into the Certificate format accepted by the JWS class.

//Create an ECC key with SHA-256 Ecc ecc = new Ecc(); ecc.HashAlgorithm = EccHashAlgorithms.ehaSHA256; ecc.CreateKey(); string privKey = ecc.Key.PrivateKey; //Sign the payload using ES256 Jws jws = new Jws(); jws.Algorithm = JwsAlgorithms.jwsES256; jws.Certificate = new Certificate(CertStoreTypes.cstPEMKeyBlob, privKey, "", "*"); jws.InputMessage = "test"; jws.Sign(); string signedMessage = jws.OutputMessage;

To use an existing ECC Key populate the Rx, Ry, and K values of Key property in the ECC class first. For instance:

//Import an existing ECC private key Ecc ecc = new Ecc(); byte[] x_bytes = new byte[] { 171, 170, 196, 151, 94, 196, 231, 12, 128, 232, 17, 61, 45, 105, 41, 209, 192, 187, 112, 242, 110, 178, 95, 240, 36, 55, 83, 171, 190, 176, 78, 13 }; byte[] y_bytes = new byte[] { 197, 75, 134, 245, 245, 28, 199, 9, 7, 117, 1, 54, 49, 178, 135, 252, 62, 89, 35, 180, 117, 80, 231, 23, 110, 250, 28, 124, 219, 253, 224, 156 }; byte[] k_bytes = new byte[] { 81, 65, 201, 24, 235, 249, 162, 148, 169, 150, 109, 181, 61, 238, 145, 122, 31, 30, 151, 94, 239, 90, 222, 217, 63, 103, 54, 2, 176, 232, 248, 168 }; ecc.Key.RxB = x_bytes; ecc.Key.RyB = y_bytes; ecc.Key.KB = k_bytes; string privKey = ecc.Key.PrivateKey; //Sign the payload using ES256 Jws jws = new Jws(); jws.Algorithm = JwsAlgorithms.jwsES256; jws.Certificate = new Certificate(CertStoreTypes.cstPEMKeyBlob, privKey, "", "*"); jws.InputMessage = "test"; jws.Sign(); string signedMessage = jws.OutputMessage;

Notes for Unsecured (none)

To create a JWS token without any security set Algorithm to jwsNone.

Jws jws = new Jws(); jws.Algorithm = JwsAlgorithms.jwsNone; jws.InputMessage = "test"; jws.Sign(); string unsecuredMessage = jws.OutputMessage;

Signature Verification

The Verify method may be used to verify a received JWS message. Before calling the Verify method set InputMessage or InputFile to a valid compact serialized JWS string. For instance:

eyJhbGciOiJIUzI1NiJ9.dGVzdA.o_JihJlCwvBO1AgY_Ao3_VBivdFmj3ufv3ZWAqYF4Ow

Key or Certificate should be set to the HMAC key or public certificate respectively. If the correct Key or Certificate is not known ahead of time the KeyId parameter of the SignerInfo event may be used to identify the correct key.

If this method returns without error verification was successful. If verification fails then this method throws an exception. After calling this method the payload will be present in the OutputMessage or file specified by OutputFile and the HeaderParams property will contain the headers. Headers of the parsed message are also available through the HeaderParam event.

The following properties are applicable when calling this method:

Input and Output Properties

The class will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Notes for HMAC Algorithms (HS256, HS384, HS512)

When verifying a message originally signed with a HMAC algorithm Key must be set to the same key used during signing. The key must be known by both parties in order for signing and verification to take place.

byte[] key = new byte[] { 170, 171, 221, 209, 7, 181, 48, 178, 48, 118, 242, 132, 36, 218, 74, 140, 216, 165, 161, 70, 11, 42, 246, 205, 235, 231, 19, 48, 87, 141, 122, 10 }; Jws jws = new Jws(); jws.KeyB = key; jws.InputMessage = signedData; jws.Verify(); string verifiedPayload = jws.OutputMessage;

Notes for RSA Algorithms (RS256, RS384, RS512, PS256, PS384, PS512)

The RSA based algorithms use asymmetric encryption. Signing is done with a private key and verification is done with a public key. The public key is typically in PEM format.

Jws jws = new Jws(); jws.Certificate = new Certificate("..\\jwt.cer"); jws.InputMessage = signedData; jws.Verify(); string verifiedPayload = jws.OutputMessage;

Notes for ECDSA Algorithms (ES256, ES384, ES512)

ECDSA algorithms require a valid ECC public key to verify the message. If the key was originally created with the ECC class the PEM encoded PublicKey may be used directly with the Certificate property. An example PEM encoded public certificate created by the ECC class:

-----BEGIN PUBLIC KEY-----
MIIBMjCB7AYHKoZIzj0CATCB4AIBATAsBgcqhkjOPQEBAiEA/////wAAAAEAAAAAAAAAAAAA
AAD///////////////8wRAQg/////wAAAAEAAAAAAAAAAAAAAAD///////////////wEIFrG
NdiqOpPns+u9VXaYhrxlHQawzFOw9jvOPD4n0mBLBEEEaxfR8uEsQkf4vOblY6RA8ncDfYEt
6zOg9KE5RdiYwpZP40Li/hp/m47n60p8D54WK84zV2sxXs7LtkBoN79R9QIhAP////8AAAAA
//////////+85vqtpxeehPO5ysL8YyVRAgEBA0EEIC5rbLp11Mnz6cBXLLriaDIov3rm8RAY
x/OR0bOKiff0cQy+sLVaxjseqFk/+Xvl4ORSv5Z6HdHv5GyEpA0UoA==
-----END PUBLIC KEY-----

Jws jws = new Jws(); jws.Certificate = new Certificate(CertStoreTypes.cstPublicKeyFile, pubKey, "", "*"); jws.InputMessage = signedData; jws.Verify(); string verifiedPayload = jws.OutputMessage;

To use an ECC public key created by other means the ECC class may be used to import the key parameters. Populate the Rx and Ry of the ECC class first to obtain the PEM formatted public key. For instance:

//Import an existing ECC public key Ecc ecc = new Ecc(); byte[] x_bytes = new byte[] { 171, 170, 196, 151, 94, 196, 231, 12, 128, 232, 17, 61, 45, 105, 41, 209, 192, 187, 112, 242, 110, 178, 95, 240, 36, 55, 83, 171, 190, 176, 78, 13 }; byte[] y_bytes = new byte[] { 197, 75, 134, 245, 245, 28, 199, 9, 7, 117, 1, 54, 49, 178, 135, 252, 62, 89, 35, 180, 117, 80, 231, 23, 110, 250, 28, 124, 219, 253, 224, 156 }; ecc.Key.RxB = x_bytes; ecc.Key.RyB = y_bytes; string pubKey = ecc.Key.PublicKey; Jws jws = new Jws(); jws.Certificate = new Certificate(CertStoreTypes.cstPublicKeyFile, pubKey, "", "*"); jws.InputMessage = signedData; jws.Verify(); string verifiedPayload = jws.OutputMessage;

Notes for Unsecured (none)

To parse a JWS token without any security call the Sign method without setting Key or Certificate.

Jws jws = new Jws(); jws.InputMessage = signedData; jws.Verify(); string unsecuredPayload = jws.OutputMessage;

Other Functionality

In addition to standard signing and verifying the class also supports a variety of other features including:

  • Adding custom header parameters with AddHeaderParam
  • Enforcing algorithm restrictions when verifying by setting StrictValidation
  • Inspect the JWS without verifying by calling Parse

Property List


The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

AlgorithmThe algorithm used when signing.
CertificateThe certificate used for signing or verification.
HeaderParamsThe JOSE header parameters.
InputFileThe file to process.
InputMessageThe message to process.
KeyThe secret key for the hash algorithm.
KeyIdThe Id of the key used to sign the message.
OutputFileThe output file when encrypting or decrypting.
OutputMessageThe output message after processing.
OverwriteIndicates whether or not the class should overwrite files.

Method List


The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

AddHeaderParamAdds additional header parameters.
ConfigSets or retrieves a configuration setting.
ParseParses the compact serialized JWS string.
ResetResets the class.
SetInputStreamSets the stream from which the class will read data.
SetOutputStreamSets the stream to which the class will write data.
SignSigns the payload with the specified algorithm.
VerifyVerifies the signature of the JWS token.

Event List


The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

ErrorFired when information is available about errors during data delivery.
HeaderParamFires once for each JOSE header parameter.
SignerInfoFires with information about the signature.

Config Settings


The following is a list of config settings for the class with short descriptions. Click on the links for further details.

AllowedSigningAlgorithmsAllowed signing algorithms when StrictValidation is set to True.
CloseInputStreamAfterProcessWhether to close the input stream after processing.
CloseOutputStreamAfterProcessWhether to close the output stream after processing.
IncludeCertificateFormatThe certificate values to include in the signed message (if any).
IssuerCertsA collection of issuer certificates used with IncludeCertificateFormat.
KeyEncodingThe encoding of the Key value.
RawHeaderHolds the raw JOSE header.
SerializationTypeDetermines the serialization type to use when reading and writing JWS content.
StrictValidationRequires a specific algorithm when verifying signatures.
BuildInfoInformation about the product's build.
GUIAvailableWhether or not a message loop is available for processing events.
LicenseInfoInformation about the current license.
MaskSensitiveWhether sensitive data is masked in log messages.
UseDaemonThreadsWhether threads created by the class are daemon threads.
UseInternalSecurityAPIWhether or not to use the system security libraries or an internal implementation.

Algorithm Property (JWS Class)

The algorithm used when signing.

Syntax


public int getAlgorithm();


public void setAlgorithm(int algorithm);


Enumerated values:
  public final static int jwsHS256 = 0;
  public final static int jwsHS384 = 1;
  public final static int jwsHS512 = 2;
  public final static int jwsRS256 = 3;
  public final static int jwsRS384 = 4;
  public final static int jwsRS512 = 5;
  public final static int jwsES256 = 6;
  public final static int jwsES384 = 7;
  public final static int jwsES512 = 8;
  public final static int jwsPS256 = 9;
  public final static int jwsPS384 = 10;
  public final static int jwsPS512 = 11;
  public final static int jwsES256K = 12;
  public final static int jwsNone = 99;

Default Value

0

Remarks

This property specifies the algorithm to use when signing.

When signing with an HMAC algorithm Key must be specified. When an RSA or ECDSA algorithm is selected Certificate must be set before calling Sign and Certificate must be set before calling Verify. The following values are supported:

AlgorithmDescriptionPrivate Key Location
0 (jwsHS256 - default) HMAC using SHA-256 Key
1 (jwsHS384) HMAC using SHA-384 Key
2 (jwsHS512) HMAC using SHA-512 Key
3 (jwsRS256) RSASSA-PKCS1-v1_5 using SHA-256 Certificate
4 (jwsRS384) RSASSA-PKCS1-v1_5 using SHA-384 Certificate
5 (jwsRS512) RSASSA-PKCS1-v1_5 using SHA-512 Certificate
6 (jwsPS256) RSASSA-PSS using SHA-256 and MGF1 with SHA-256 Certificate
7 (jwsPS384) RSASSA-PSS using SHA-384 and MGF1 with SHA-384 Certificate
8 (jwsPS512) RSASSA-PSS using SHA-512 and MGF1 with SHA-512 Certificate
9 (jwsES256) ECDSA using P-256 and SHA-256 Certificate
10 (jwsES384) ECDSA using P-384 and SHA-384 Certificate
11 (jwsES512) ECDSA using P-521 and SHA-512 Certificate
12 (jwsES256K) ECDSA using secp256k1 curve and SHA-256 Certificate
99 (jwsNone) None (unprotected) Not Applicable

Note: This setting is also applicable when StrictValidation is enabled before calling Verify.

Certificate Property (JWS Class)

The certificate used for signing or verification.

Syntax


public Certificate getCertificate();


public void setCertificate(Certificate certificate);

Remarks

This property specifies a certificate used for signing or verification.

When calling Sign and Algorithm is set to an RSA or ECDSA algorithm this property must be set to a certificate with private key.

When calling Verify and the algorithm used is RSA or ECDSA this property must be set to the public certificate of the signer.

Please refer to the Certificate type for a complete list of fields.

HeaderParams Property (JWS Class)

The JOSE header parameters.

Syntax


public HeaderParamList getHeaderParams();


public void setHeaderParams(HeaderParamList headerParams);

Remarks

This property specifies the JOSE header parameters. This may be populated before calling Sign or Encrypt. This is populated with the parsed header values after calling Verify, Decrypt, or Parse.

This property is not available at design time.

Please refer to the HeaderParam type for a complete list of fields.

InputFile Property (JWS Class)

The file to process.

Syntax


public String getInputFile();


public void setInputFile(String inputFile);

Default Value

""

Remarks

This property specifies the file to be processed. Set this property to the full or relative path to the file which will be processed.

Input and Output Properties

The class will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

InputMessage Property (JWS Class)

The message to process.

Syntax


public byte[] getInputMessage();


public void setInputMessage(byte[] inputMessage);

Default Value

""

Remarks

This property specifies the message to be processed.

Input and Output Properties

The class will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Key Property (JWS Class)

The secret key for the hash algorithm.

Syntax


public byte[] getKey();


public void setKey(byte[] key);

Default Value

""

Remarks

This property holds the secret key used when creating the hash. The key can be arbitrarily long.

Note: This property is only applicable when Algorithm is set to an HMAC algorithm.

It is recommended that the length of the key be equal to or larger than the hash size of the algorithm. Use of keys shorter than the hash size is discouraged.

Sizes (in bytes)

SHA1SHA224SHA256SHA384SHA512MD5RIPEMD160
Recommended Key Size20 28 32 48 64 16 20
Hash Size 20 28 32 48 64 16 20
Block Size 64 64 64 128 128 64 64

Key Length Details

As mentioned above it is recommended to use a key size equal to the hash size. Use of keys larger than the hash size does not typically significantly increase the function strength. Keys of any length are technically valid however see the below processing rules to understand how keys of varying lengths are treated:

  • If the key length is equal to the hash size (recommended) it is used without modification.
  • If the key length is less than the hash size it is used without modification.
  • If the key length is less than or equal to the block size it is used without modification.
  • If the key length is larger than the block size is it first hashed with the same algorithm.

KeyId Property (JWS Class)

The Id of the key used to sign the message.

Syntax


public String getKeyId();


public void setKeyId(String keyId);

Default Value

""

Remarks

This property optionally specifies the Id of the key used to sign the message.

Any string value may be supplied here to help the other party identify the key used to sign the message. This may be set before calling the Sign method.

OutputFile Property (JWS Class)

The output file when encrypting or decrypting.

Syntax


public String getOutputFile();


public void setOutputFile(String outputFile);

Default Value

""

Remarks

This property specifies the file to which the output will be written when Encrypt or Decrypt is called. This may be set to an absolute or relative path.

This property is only applicable to Encrypt and Decrypt.

Input and Output Properties

The class will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

OutputMessage Property (JWS Class)

The output message after processing.

Syntax


public byte[] getOutputMessage();


Default Value

""

Remarks

This property will be populated with the output from the operation if OutputFile and SetOutputStream are not set.

Input and Output Properties

The class will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

This property is read-only and not available at design time.

Overwrite Property (JWS Class)

Indicates whether or not the class should overwrite files.

Syntax


public boolean isOverwrite();


public void setOverwrite(boolean overwrite);

Default Value

False

Remarks

This property indicates whether or not the class will overwrite OutputFile. If Overwrite is False, an error will be thrown whenever OutputFile exists before an operation. The default value is False.

AddHeaderParam Method (Jws Class)

Adds additional header parameters.

Syntax

public void addHeaderParam(String name, String value, int dataType);

Remarks

This method is used to add additional header parameters before calling Sign.

The Name and Value parameters define the name and value of the parameter respectively. The DataType parameter specifies the JSON data type of the value. Possible values for DataType are:

  • 0 (Object)
  • 1 (Array)
  • 2 (String)
  • 3 (Number)
  • 4 (Bool)
  • 5 (Null)
To add additional parameters to the JOSE header use this method. For instance to create this header:

{
  "alg": "HS512",
  "crit": [
    "exp"
  ],
  "exp": 12345687,
  "kid": "myKeyId",
  "type": "JWT"
}

The following code can be used:

jws.Algorithm = JwsAlgorithms.jwsHS512; jws.KeyId = "myKeyId"; jws.KeyB = key; jws.AddHeaderParam("type", "JWT", 2); jws.AddHeaderParam("crit", "[\"exp\"]", 1); jws.AddHeaderParam("exp", "12345687", 3); jws.InputMessage = "test"; jws.Sign(); string signedData = jws.OutputMessage;

Note: when calling Sign the class will automatically add some headers based on properties that are set.

Parameters Automatically Set:

Header ParamProperty
algAlgorithm
kidKeyId

Config Method (Jws Class)

Sets or retrieves a configuration setting.

Syntax

public String config(String configurationString);

Remarks

Config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

Parse Method (Jws Class)

Parses the compact serialized JWS string.

Syntax

public void parse();

Remarks

This method parses, but does not verify, the JWS string.

Take care when using this method as no signature verification is performed. This method may be helpful in cases where information about the signature is contained within the payload, or for any other reason where the signature is not important.

If verification is desired, use Verify instead. It is not necessary to call this method before calling Verify. Verify will both parse and verify the message.

When calling this method the headers and payload are parsed. The HeaderParam and SignerInfo events will fire and the HeaderParams property will be populated. The payload will be written to the specified output location.

Input and Output Properties

The class will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Reset Method (Jws Class)

Resets the class.

Syntax

public void reset();

Remarks

When called, the class will reset all of its properties to their default values.

SetInputStream Method (Jws Class)

Sets the stream from which the class will read data.

Syntax

public void setInputStream(java.io.InputStream inputStream);

Remarks

This method may be used to set a stream from which data will be read.

Input and Output Properties

The class will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

SetOutputStream Method (Jws Class)

Sets the stream to which the class will write data.

Syntax

public void setOutputStream(java.io.OutputStream outputStream);

Remarks

This method may be used to specify a stream to which data will be written.

Input and Output Properties

The class will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

  • SetOutputStream
  • OutputFile
  • OutputMessage: The output data is written to this property if no other destination is specified.

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Sign Method (Jws Class)

Signs the payload with the specified algorithm.

Syntax

public void sign();

Remarks

This method signs the input with the specified Algorithm.

Before calling the Sign method set Algorithm to the algorithm which will be used to sign the message. The result of signing is a compact serialized JWS string. For instance:

eyJhbGciOiJIUzI1NiJ9.dGVzdA.o_JihJlCwvBO1AgY_Ao3_VBivdFmj3ufv3ZWAqYF4Ow

The class is agnostic of the payload that is signed. Any value may be signed. KeyId may be set to include an identifier to help the receiving party identify the key used to sign the message. The following properties are applicable when calling this method:

Input and Output Properties

The class will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Notes for HMAC Algorithms (HS256, HS384, HS512)

When Algorithm is set to a HMAC algorithm Key must be set to a key of appropriate length for the algorithm. The Key should be the same number of bits as the algorithm being used. For instance a 256 bit key would be used for HS256.

The example code below uses the EzRand class to generate a key, but the key may be created using any means. The key must be known by both parties in order for signing and verification to take place.

//Generate a 256 bit (32 byte) key Ezrand ezrand = new Ezrand(); ezrand.RandBytesLength = 32; ezrand.GetNextBytes(); byte[] key = ezrand.RandBytesB; //Sign the payload using HS256 Jws jws = new Jws(); jws.Algorithm = JwsAlgorithms.jwsHS256; jws.InputMessage = "test data"; jws.KeyB = key; jws.Sign(); string signedData = jws.OutputMessage;

To use an existing HMAC key provide the bytes to the Key property. For instance:

//HMAC SHA-256 Key byte[] key = new byte[] { 170, 171, 221, 209, 7, 181, 48, 178, 48, 118, 242, 132, 36, 218, 74, 140, 216, 165, 161, 70, 11, 42, 246, 205, 235, 231, 19, 48, 87, 141, 122, 10 }; //Sign the payload using HS256 Jws jws = new Jws(); jws.Algorithm = JwsAlgorithms.jwsHS256; jws.InputMessage = "test data"; jws.KeyB = key; jws.Sign(); string signedData = jws.OutputMessage;

Notes for RSA Algorithms (RS256, RS384, RS512, PS256, PS384, PS512)

The RSA based algorithms use asymmetric encryption. Signing is done with a private key and verification is done with a public key. The private key may be in PFX or PEM format.

Jws jws = new Jws(); jws.Algorithm = JwsAlgorithms.jwsRS256; jws.Certificate = new Certificate(CertStoreTypes.cstPFXFile, "..\\jwt.pfx", "test", "*"); jws.InputMessage = "test"; jws.Sign(); string signedMessage = jws.OutputMessage;

Notes for ECDSA Algorithms (ES256, ES384, ES512)

ECDSA algorithms require a valid ECC private key to sign. The ECC class can be used to create or import an ECC key into the Certificate format accepted by the JWS class.

//Create an ECC key with SHA-256 Ecc ecc = new Ecc(); ecc.HashAlgorithm = EccHashAlgorithms.ehaSHA256; ecc.CreateKey(); string privKey = ecc.Key.PrivateKey; //Sign the payload using ES256 Jws jws = new Jws(); jws.Algorithm = JwsAlgorithms.jwsES256; jws.Certificate = new Certificate(CertStoreTypes.cstPEMKeyBlob, privKey, "", "*"); jws.InputMessage = "test"; jws.Sign(); string signedMessage = jws.OutputMessage;

To use an existing ECC Key populate the Rx, Ry, and K values of Key property in the ECC class first. For instance:

//Import an existing ECC private key Ecc ecc = new Ecc(); byte[] x_bytes = new byte[] { 171, 170, 196, 151, 94, 196, 231, 12, 128, 232, 17, 61, 45, 105, 41, 209, 192, 187, 112, 242, 110, 178, 95, 240, 36, 55, 83, 171, 190, 176, 78, 13 }; byte[] y_bytes = new byte[] { 197, 75, 134, 245, 245, 28, 199, 9, 7, 117, 1, 54, 49, 178, 135, 252, 62, 89, 35, 180, 117, 80, 231, 23, 110, 250, 28, 124, 219, 253, 224, 156 }; byte[] k_bytes = new byte[] { 81, 65, 201, 24, 235, 249, 162, 148, 169, 150, 109, 181, 61, 238, 145, 122, 31, 30, 151, 94, 239, 90, 222, 217, 63, 103, 54, 2, 176, 232, 248, 168 }; ecc.Key.RxB = x_bytes; ecc.Key.RyB = y_bytes; ecc.Key.KB = k_bytes; string privKey = ecc.Key.PrivateKey; //Sign the payload using ES256 Jws jws = new Jws(); jws.Algorithm = JwsAlgorithms.jwsES256; jws.Certificate = new Certificate(CertStoreTypes.cstPEMKeyBlob, privKey, "", "*"); jws.InputMessage = "test"; jws.Sign(); string signedMessage = jws.OutputMessage;

Notes for Unsecured (none)

To create a JWS token without any security set Algorithm to jwsNone.

Jws jws = new Jws(); jws.Algorithm = JwsAlgorithms.jwsNone; jws.InputMessage = "test"; jws.Sign(); string unsecuredMessage = jws.OutputMessage;

Verify Method (Jws Class)

Verifies the signature of the JWS token.

Syntax

public void verify();

Remarks

This method verifies the signature of the JWS token.

Before calling the Verify method set InputMessage or InputFile to a valid compact serialized JWS string. For instance:

eyJhbGciOiJIUzI1NiJ9.dGVzdA.o_JihJlCwvBO1AgY_Ao3_VBivdFmj3ufv3ZWAqYF4Ow

Key or Certificate should be set to the HMAC key or public certificate respectively. If the correct Key or Certificate is not known ahead of time the KeyId parameter of the SignerInfo event may be used to identify the correct key.

If this method returns without error verification was successful. If verification fails then this method throws an exception. After calling this method the payload will be present in the OutputMessage or file specified by OutputFile and the HeaderParams property will contain the headers. Headers of the parsed message are also available through the HeaderParam event.

The following properties are applicable when calling this method:

Input and Output Properties

The class will determine the source and destination of the input and output based on which properties are set.

The order in which the input properties are checked is as follows:

When a valid source is found the search stops. The order in which the output properties are checked is as follows:

When using streams you may need to additionally set CloseInputStreamAfterProcessing or CloseOutputStreamAfterProcessing.

Notes for HMAC Algorithms (HS256, HS384, HS512)

When verifying a message originally signed with a HMAC algorithm Key must be set to the same key used during signing. The key must be known by both parties in order for signing and verification to take place.

byte[] key = new byte[] { 170, 171, 221, 209, 7, 181, 48, 178, 48, 118, 242, 132, 36, 218, 74, 140, 216, 165, 161, 70, 11, 42, 246, 205, 235, 231, 19, 48, 87, 141, 122, 10 }; Jws jws = new Jws(); jws.KeyB = key; jws.InputMessage = signedData; jws.Verify(); string verifiedPayload = jws.OutputMessage;

Notes for RSA Algorithms (RS256, RS384, RS512, PS256, PS384, PS512)

The RSA based algorithms use asymmetric encryption. Signing is done with a private key and verification is done with a public key. The public key is typically in PEM format.

Jws jws = new Jws(); jws.Certificate = new Certificate("..\\jwt.cer"); jws.InputMessage = signedData; jws.Verify(); string verifiedPayload = jws.OutputMessage;

Notes for ECDSA Algorithms (ES256, ES384, ES512)

ECDSA algorithms require a valid ECC public key to verify the message. If the key was originally created with the ECC class the PEM encoded PublicKey may be used directly with the Certificate property. An example PEM encoded public certificate created by the ECC class:

-----BEGIN PUBLIC KEY-----
MIIBMjCB7AYHKoZIzj0CATCB4AIBATAsBgcqhkjOPQEBAiEA/////wAAAAEAAAAAAAAAAAAA
AAD///////////////8wRAQg/////wAAAAEAAAAAAAAAAAAAAAD///////////////wEIFrG
NdiqOpPns+u9VXaYhrxlHQawzFOw9jvOPD4n0mBLBEEEaxfR8uEsQkf4vOblY6RA8ncDfYEt
6zOg9KE5RdiYwpZP40Li/hp/m47n60p8D54WK84zV2sxXs7LtkBoN79R9QIhAP////8AAAAA
//////////+85vqtpxeehPO5ysL8YyVRAgEBA0EEIC5rbLp11Mnz6cBXLLriaDIov3rm8RAY
x/OR0bOKiff0cQy+sLVaxjseqFk/+Xvl4ORSv5Z6HdHv5GyEpA0UoA==
-----END PUBLIC KEY-----

Jws jws = new Jws(); jws.Certificate = new Certificate(CertStoreTypes.cstPublicKeyFile, pubKey, "", "*"); jws.InputMessage = signedData; jws.Verify(); string verifiedPayload = jws.OutputMessage;

To use an ECC public key created by other means the ECC class may be used to import the key parameters. Populate the Rx and Ry of the ECC class first to obtain the PEM formatted public key. For instance:

//Import an existing ECC public key Ecc ecc = new Ecc(); byte[] x_bytes = new byte[] { 171, 170, 196, 151, 94, 196, 231, 12, 128, 232, 17, 61, 45, 105, 41, 209, 192, 187, 112, 242, 110, 178, 95, 240, 36, 55, 83, 171, 190, 176, 78, 13 }; byte[] y_bytes = new byte[] { 197, 75, 134, 245, 245, 28, 199, 9, 7, 117, 1, 54, 49, 178, 135, 252, 62, 89, 35, 180, 117, 80, 231, 23, 110, 250, 28, 124, 219, 253, 224, 156 }; ecc.Key.RxB = x_bytes; ecc.Key.RyB = y_bytes; string pubKey = ecc.Key.PublicKey; Jws jws = new Jws(); jws.Certificate = new Certificate(CertStoreTypes.cstPublicKeyFile, pubKey, "", "*"); jws.InputMessage = signedData; jws.Verify(); string verifiedPayload = jws.OutputMessage;

Notes for Unsecured (none)

To parse a JWS token without any security call the Sign method without setting Key or Certificate.

Jws jws = new Jws(); jws.InputMessage = signedData; jws.Verify(); string unsecuredPayload = jws.OutputMessage;

Error Event (Jws Class)

Fired when information is available about errors during data delivery.

Syntax

public class DefaultJwsEventListener implements JwsEventListener {
  ...
  public void error(JwsErrorEvent e) {}
  ...
}

public class JwsErrorEvent {
  public int errorCode;
  public String description;
}

Remarks

The Error event is fired in case of exceptional conditions during message processing. Normally the class throws an exception.

The ErrorCode parameter contains an error code, and the Description parameter contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to the Error Codes section.

HeaderParam Event (Jws Class)

Fires once for each JOSE header parameter.

Syntax

public class DefaultJwsEventListener implements JwsEventListener {
  ...
  public void headerParam(JwsHeaderParamEvent e) {}
  ...
}

public class JwsHeaderParamEvent {
  public String name;
  public String value;
  public int dataType;
}

Remarks

When Verify or Parse is called this event will fire once for each JOSE header parameter.

Name is the name of the parameter.

Value is the value of the parameter.

DataType specifies the JSON data type of the value. Possible values are:

  • 0 (Object)
  • 1 (Array)
  • 2 (String)
  • 3 (Number)
  • 4 (Bool)
  • 5 (Null)

SignerInfo Event (Jws Class)

Fires with information about the signature.

Syntax

public class DefaultJwsEventListener implements JwsEventListener {
  ...
  public void signerInfo(JwsSignerInfoEvent e) {}
  ...
}

public class JwsSignerInfoEvent {
  public String keyId;
  public String algorithm;
}

Remarks

This event fires with information about the signature. This may be used to help identify the Key or Certificate to load in order to verify the signature. This event fires when Verify or Parse is called.

KeyId is the Id of the key as supplied by the signer that created the message. This may be empty.

Algorithm is the signature algorithm used to sign the message.

Certificate Type

This is the digital certificate being used.

Remarks

This type describes the current digital certificate. The certificate may be a public or private key. The fields are used to identify or select certificates.

Fields

EffectiveDate
String (read-only)

Default Value: ""

This is the date on which this certificate becomes valid. Before this date, it is not valid. The following example illustrates the format of an encoded date:

23-Jan-2000 15:00:00.

Encoded
String

Default Value: ""

This is the certificate (PEM/Base64 encoded). This field is used to assign a specific certificate. The Store and Subject fields also may be used to specify a certificate.

When Encoded is set, a search is initiated in the current Store for the private key of the certificate. If the key is found, Subject is updated to reflect the full subject of the selected certificate; otherwise, Subject is set to an empty string.

EncodedB
byte[]

Default Value: ""

This is the certificate (PEM/Base64 encoded). This field is used to assign a specific certificate. The Store and Subject fields also may be used to specify a certificate.

When Encoded is set, a search is initiated in the current Store for the private key of the certificate. If the key is found, Subject is updated to reflect the full subject of the selected certificate; otherwise, Subject is set to an empty string.

ExpirationDate
String (read-only)

Default Value: ""

This is the date the certificate expires. After this date, the certificate will no longer be valid. The following example illustrates the format of an encoded date:

23-Jan-2001 15:00:00.

ExtendedKeyUsage
String

Default Value: ""

This is a comma-delimited list of extended key usage identifiers. These are the same as ASN.1 object identifiers (OIDs).

Fingerprint
String (read-only)

Default Value: ""

This is the hex-encoded, 16-byte MD5 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: bc:2a:72:af:fe:58:17:43:7a:5f:ba:5a:7c:90:f7:02

FingerprintSHA1
String (read-only)

Default Value: ""

This is the hex-encoded, 20-byte SHA-1 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: 30:7b:fa:38:65:83:ff:da:b4:4e:07:3f:17:b8:a4:ed:80:be:ff:84

FingerprintSHA256
String (read-only)

Default Value: ""

This is the hex-encoded, 32-byte SHA-256 fingerprint of the certificate. This property is primarily used for keys which do not have a corresponding X.509 public certificate, such as PEM keys that only contain a private key. It is commonly used for SSH keys.

The following example illustrates the format: 6a:80:5c:33:a9:43:ea:b0:96:12:8a:64:96:30:ef:4a:8a:96:86:ce:f4:c7:be:10:24:8e:2b:60:9e:f3:59:53

Issuer
String (read-only)

Default Value: ""

This is the issuer of the certificate. This field contains a string representation of the name of the issuing authority for the certificate.

KeyPassword
String

Default Value: ""

This is the password for the certificate's private key (if any).

Some certificate stores may individually protect certificates' private keys, separate from the standard protection offered by the StorePassword. KeyPassword. This field can be used to read such password-protected private keys.

Note: this property defaults to the value of StorePassword. To clear it, you must set the property to the empty string (""). It can be set at any time, but when the private key's password is different from the store's password, then it must be set before calling PrivateKey.

PrivateKey
String (read-only)

Default Value: ""

This is the private key of the certificate (if available). The key is provided as PEM/Base64-encoded data.

Note: The PrivateKey may be available but not exportable. In this case, PrivateKey returns an empty string.

PrivateKeyAvailable
boolean (read-only)

Default Value: False

This field shows whether a PrivateKey is available for the selected certificate. If PrivateKeyAvailable is True, the certificate may be used for authentication purposes (e.g., server authentication).

PrivateKeyContainer
String (read-only)

Default Value: ""

This is the name of the PrivateKey container for the certificate (if available). This functionality is available only on Windows platforms.

PublicKey
String (read-only)

Default Value: ""

This is the public key of the certificate. The key is provided as PEM/Base64-encoded data.

PublicKeyAlgorithm
String

Default Value: ""

This field contains the textual description of the certificate's public key algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_DH") or an object identifier (OID) string representing the algorithm.

PublicKeyLength
int (read-only)

Default Value: 0

This is the length of the certificate's public key (in bits). Common values are 512, 1024, and 2048.

SerialNumber
String (read-only)

Default Value: ""

This is the serial number of the certificate encoded as a string. The number is encoded as a series of hexadecimal digits, with each pair representing a byte of the serial number.

SignatureAlgorithm
String (read-only)

Default Value: ""

The field contains the text description of the certificate's signature algorithm. The property contains either the name of the algorithm (e.g., "RSA" or "RSA_MD5RSA") or an object identifier (OID) string representing the algorithm.

Store
String

Default Value: "MY"

This is the name of the certificate store for the client certificate.

The StoreType field denotes the type of the certificate store specified by Store. If the store is password protected, specify the password in StorePassword.

Store is used in conjunction with the Subject field to specify client certificates. If Store has a value, and Subject or Encoded is set, a search for a certificate is initiated. Please see the Subject field for details.

Designations of certificate stores are platform dependent.

The following designations are the most common User and Machine certificate stores in Windows:

MYA certificate store holding personal certificates with their associated private keys.
CACertifying authority certificates.
ROOTRoot certificates.

In Java, the certificate store normally is a file containing certificates and optional private keys.

When the certificate store type is PFXFile, this property must be set to the name of the file. When the type is PFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).

StoreB
byte[]

Default Value: "MY"

This is the name of the certificate store for the client certificate.

The StoreType field denotes the type of the certificate store specified by Store. If the store is password protected, specify the password in StorePassword.

Store is used in conjunction with the Subject field to specify client certificates. If Store has a value, and Subject or Encoded is set, a search for a certificate is initiated. Please see the Subject field for details.

Designations of certificate stores are platform dependent.

The following designations are the most common User and Machine certificate stores in Windows:

MYA certificate store holding personal certificates with their associated private keys.
CACertifying authority certificates.
ROOTRoot certificates.

In Java, the certificate store normally is a file containing certificates and optional private keys.

When the certificate store type is PFXFile, this property must be set to the name of the file. When the type is PFXBlob, the property must be set to the binary contents of a PFX file (i.e., PKCS#12 certificate store).

StorePassword
String

Default Value: ""

If the type of certificate store requires a password, this property is used to specify the password needed to open the certificate store.

StoreType
int

Default Value: 0

This is the type of certificate store for this certificate.

The class supports both public and private keys in a variety of formats. When the cstAuto value is used, the class will automatically determine the type. This field can take one of the following values:

0 (cstUser - default)For Windows, this specifies that the certificate store is a certificate store owned by the current user.

Note: This store type is not available in Java.

1 (cstMachine)For Windows, this specifies that the certificate store is a machine store.

Note: This store type is not available in Java.

2 (cstPFXFile)The certificate store is the name of a PFX (PKCS#12) file containing certificates.
3 (cstPFXBlob)The certificate store is a string (binary or Base64-encoded) representing a certificate store in PFX (PKCS#12) format.
4 (cstJKSFile)The certificate store is the name of a Java Key Store (JKS) file containing certificates.

Note: This store type is only available in Java.

5 (cstJKSBlob)The certificate store is a string (binary or Base64-encoded) representing a certificate store in Java Key Store (JKS) format.

Note: this store type is only available in Java.

6 (cstPEMKeyFile)The certificate store is the name of a PEM-encoded file that contains a private key and an optional certificate.
7 (cstPEMKeyBlob)The certificate store is a string (binary or Base64-encoded) that contains a private key and an optional certificate.
8 (cstPublicKeyFile)The certificate store is the name of a file that contains a PEM- or DER-encoded public key certificate.
9 (cstPublicKeyBlob)The certificate store is a string (binary or Base64-encoded) that contains a PEM- or DER-encoded public key certificate.
10 (cstSSHPublicKeyBlob)The certificate store is a string (binary or Base64-encoded) that contains an SSH-style public key.
11 (cstP7BFile)The certificate store is the name of a PKCS#7 file containing certificates.
12 (cstP7BBlob)The certificate store is a string (binary) representing a certificate store in PKCS#7 format.
13 (cstSSHPublicKeyFile)The certificate store is the name of a file that contains an SSH-style public key.
14 (cstPPKFile)The certificate store is the name of a file that contains a PPK (PuTTY Private Key).
15 (cstPPKBlob)The certificate store is a string (binary) that contains a PPK (PuTTY Private Key).
16 (cstXMLFile)The certificate store is the name of a file that contains a certificate in XML format.
17 (cstXMLBlob)The certificate store is a string that contains a certificate in XML format.
18 (cstJWKFile)The certificate store is the name of a file that contains a JWK (JSON Web Key).
19 (cstJWKBlob)The certificate store is a string that contains a JWK (JSON Web Key).
21 (cstBCFKSFile)The certificate store is the name of a file that contains a BCFKS (Bouncy Castle FIPS Key Store).

Note: This store type is only available in Java and .NET.

22 (cstBCFKSBlob)The certificate store is a string (binary or Base64-encoded) representing a certificate store in BCFKS (Bouncy Castle FIPS Key Store) format.

Note: This store type is only available in Java and .NET.

23 (cstPKCS11)The certificate is present on a physical security key accessible via a PKCS#11 interface.

To use a security key, the necessary data must first be collected using the CertMgr class. The ListStoreCertificates method may be called after setting CertStoreType to cstPKCS11, CertStorePassword to the PIN, and CertStore to the full path of the PKCS#11 DLL. The certificate information returned in the CertList event's CertEncoded parameter may be saved for later use.

When using a certificate, pass the previously saved security key information as the Store and set StorePassword to the PIN.

Code Example. SSH Authentication with Security Key: certmgr.CertStoreType = CertStoreTypes.cstPKCS11; certmgr.OnCertList += (s, e) => { secKeyBlob = e.CertEncoded; }; certmgr.CertStore = @"C:\Program Files\OpenSC Project\OpenSC\pkcs11\opensc-pkcs11.dll"; certmgr.CertStorePassword = "123456"; //PIN certmgr.ListStoreCertificates(); sftp.SSHCert = new Certificate(CertStoreTypes.cstPKCS11, secKeyBlob, "123456", "*"); sftp.SSHUser = "test"; sftp.SSHLogon("myhost", 22);

99 (cstAuto)The store type is automatically detected from the input data. This setting may be used with both public and private keys and can detect any of the supported formats automatically.

Subject
String

Default Value: ""

This is the subject of the certificate used for client authentication.

This field will be populated with the full subject of the loaded certificate. When loading a certificate the subject is used to locate the certificate in the store.

If an exact match is not found, the store is searched for subjects containing the value of the property.

If a match is still not found, the property is set to an empty string, and no certificate is selected.

The special value "*" picks a random certificate in the certificate store.

The certificate subject is a comma-separated list of distinguished name fields and values. For instance, "CN=www.server.com, OU=test, C=US, E=support@nsoftware.com". Common fields and their meanings are as follows:

FieldMeaning
CNCommon Name. This is commonly a hostname like www.server.com.
OOrganization
OUOrganizational Unit
LLocality
SState
CCountry
EEmail Address

If a field value contains a comma, it must be quoted.

SubjectAltNames
String (read-only)

Default Value: ""

This field contains comma-separated lists of alternative subject names for the certificate.

ThumbprintMD5
String (read-only)

Default Value: ""

This field contains the MD5 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

ThumbprintSHA1
String (read-only)

Default Value: ""

This field contains the SHA-1 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

ThumbprintSHA256
String (read-only)

Default Value: ""

This field contains the SHA-256 hash of the certificate. It is primarily used for X.509 certificates. If the hash does not already exist, it is automatically computed.

Usage
String

Default Value: ""

This field contains the text description of UsageFlags.

This value will be of one or more of the following strings and will be separated by commas:

  • Digital Signatures
  • Key Authentication
  • Key Encryption
  • Data Encryption
  • Key Agreement
  • Certificate Signing
  • Key Signing

If the provider is OpenSSL, the value is a comma-separated list of X.509 certificate extension names.

UsageFlags
int

Default Value: 0

This field contains the flags that show intended use for the certificate. The value of UsageFlags is a combination of the following flags:

0x80Digital Signatures
0x40Key Authentication (Non-Repudiation)
0x20Key Encryption
0x10Data Encryption
0x08Key Agreement
0x04Certificate Signing
0x02Key Signing

Please see the Usage field for a text representation of UsageFlags.

This functionality currently is not available when the provider is OpenSSL.

Version
String (read-only)

Default Value: ""

This field contains the certificate's version number. The possible values are the strings "V1", "V2", and "V3".

Constructors

public Certificate();

Creates a Certificate instance whose properties can be set. This is useful for use with CERTMGR when generating new certificates.

public Certificate( certificateFile);

Opens CertificateFile and reads out the contents as an X.509 public key.

public Certificate( certificateData);

Parses CertificateData as an X.509 public key.

public Certificate( certStoreType,  store,  storePassword,  subject);

CertStoreType identifies the type of certificate store to use. See StoreType for descriptions of the different certificate stores. Store is a file containing the certificate store. StorePassword is the password used to protect the store. After the store has been successfully opened, the class will attempt to find the certificate identified by Subject . This can be either a complete or a substring match of the X.509 certificate's subject Distinguished Name (DN).

public Certificate( certStoreType,  store,  storePassword,  subject,  configurationString);

CertStoreType identifies the type of certificate store to use. See StoreType for descriptions of the different certificate stores. Store is a file containing the certificate store. StorePassword is the password used to protect the store. ConfigurationString is a newline separated list of name-value pairs that may be used to modify the default behavior. Possible values include "PersistPFXKey", which shows whether or not the PFX key is persisted after performing operations with the private key. This correlates to the PKCS12_NO_PERSIST_KEY CryptoAPI option. The default value is True (the key is persisted). "Thumbprint" - an MD5, SHA-1, or SHA-256 thumbprint of the certificate to load. When specified, this value is used to select the certificate in the store. This is applicable to cstUser, cstMachine, cstPublicKeyFile, and cstPFXFile store types. "UseInternalSecurityAPI" shows whether the platform (default) or the internal security API is used when performing certificate-related operations. After the store has been successfully opened, the class will attempt to find the certificate identified by Subject . This can be either a complete or a substring match of the X.509 certificate's subject Distinguished Name (DN).

public Certificate( certStoreType,  store,  storePassword,  encoded);

CertStoreType identifies the type of certificate store to use. See StoreType for descriptions of the different certificate stores. Store is a file containing the certificate store. StorePassword is the password used to protect the store. After the store has been successfully opened, the class will load Encoded as an X.509 certificate and search the opened store for a corresponding private key.

public Certificate( certStoreType,  storeBlob,  storePassword,  subject);

CertStoreType identifies the type of certificate store to use. See StoreType for descriptions of the different certificate stores. StoreBlob is a string (binary- or Base64-encoded) containing the certificate data. StorePassword is the password used to protect the store. After the store has been successfully opened, the class will attempt to find the certificate identified by Subject . This can be either a complete or a substring match of the X.509 certificate's subject Distinguished Name (DN).

public Certificate( certStoreType,  storeBlob,  storePassword,  subject,  configurationString);

CertStoreType identifies the type of certificate store to use. See StoreType for descriptions of the different certificate stores. StoreBlob is a string (binary- or Base64-encoded) containing the certificate data. StorePassword is the password used to protect the store. After the store has been successfully opened, the class will attempt to find the certificate identified by Subject . This can be either a complete or a substring match of the X.509 certificate's subject Distinguished Name (DN).

public Certificate( certStoreType,  storeBlob,  storePassword,  encoded);

CertStoreType identifies the type of certificate store to use. See StoreType for descriptions of the different certificate stores. Store is a string (binary- or Base64-encoded) containing the certificate store. StorePassword is the password used to protect the store. After the store has been successfully opened, the class will load Encoded as an X.509 certificate and search the opened store for a corresponding private key.

HeaderParam Type

The JOSE header parameter.

Remarks

This type holds the JOSE header parameters. The fields define the name, value, and data type of the parameter.

Fields

DataType
int

Default Value: 2

The data type of the header parameter.

This field specifies the JSON type of the header parameter value. Possible values are:

  • 0 (Object)
  • 1 (Array)
  • 2 (String)
  • 3 (Number)
  • 4 (Bool)
  • 5 (Null)

Name
String

Default Value: ""

The header parameter name.

Value
String

Default Value: ""

The header parameter value.

Constructors

public HeaderParam();

Creates a new header parameter with no name or value.

public HeaderParam( name,  value);

Creates a new header parameter. The DataType of the value will be a String.

public HeaderParam( name,  value,  dataType);

Creates a new header parameter with the specified DataType.

Config Settings (Jws Class)

The class accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

JWS Config Settings

AllowedSigningAlgorithms:   Allowed signing algorithms when StrictValidation is set to True.

This setting specifics a comma separated list of algorithms that are allowed when StrictValidation is set to true. This allows multiple signing algorithms to be considered acceptable during validation. This setting is only applicable when StrictValidation is set to true. Possible values:

  • HS256
  • HS384
  • HS512
  • RS256
  • RS384
  • RS512
  • ES256
  • ES384
  • ES512
  • PS256
  • PS384
  • PS512

Example value: HS512,HS256.

CloseInputStreamAfterProcess:   Whether to close the input stream after processing.

This setting specifies whether the stream set by SetInputStream is closed after processing the message. The default value is True.

CloseOutputStreamAfterProcess:   Whether to close the output stream after processing.

This setting specifies whether the stream set by SetOutputStream is closed after processing the message. The default value is True.

IncludeCertificateFormat:   The certificate values to include in the signed message (if any).

This setting specifies whether information about the Certificate is included in the signed message. When specified, the value here determines the format of the included certificate information. The certificate information is included as a standard JWS header parameter.

Multiple formats may be included in the signed message. The value specified should be the binary 'OR' of one or more of the following values:

Value Description JWS Header Param
0 (0x00 - default) None
1 (0x01) X.509 Certificate Chain x5c
2 (0x02) X.509 Certificate SHA-1 Thumbprint (Base64-URL encoded) x5t
4 (0x04) X.509 Certificate SHA-256 Thumbprint (Base64-URL encoded) x5t#S256

Note: When including the certificate chain (0x01) the public certificate of Certificate property will automatically be included. IssuerCerts may also be set to the public issuer certificates that will be used when building the chain to include.

For instance, to include both the certificate chain and SHA-256 thumbprint of the Certificate set this to 5.

IssuerCerts:   A collection of issuer certificates used with IncludeCertificateFormat.

This setting optionally specifies one or more issuer certificates that may be used by the class when IncludeCertificateFormat is specified. Note that the issuer certificates specified here are used as a store of potential issuer certificates. At runtime the class will inspect the Certificate value and add the relevant issuer certificates that are present in this property.

The format of the value must be one or more PEM encoded certificates with headers and footers. For instance to include 2 issuer certificates the value may be:

-----BEGIN CERTIFICATE-----
MIIBujCCASOgAwIBAgICA+kwDQYJKoZIhvcNAQELBQAwHTEbMBkGA1UEAxMSbnVuaXRDZXJ0
Q2hhaW5Sb290MCAXDTE4MTAxNTA5MDAxN1oYDzIxMTgwOTIxMDkwMDE3WjAmMSQwIgYDVQQD
...
Tr+wi0ouNo7ifWRcE83Z15PhfGn1nkfxMYj4rya5n+V0RVVcgFUdiolCI5o/sYq503a7kH16
JSF5Zw+TiMz/COM8R94=
-----END CERTIFICATE-----

-----BEGIN CERTIFICATE-----
MIIBsTCCARqgAwIBAgICA+gwDQYJKoZIhvcNAQELBQAwHTEbMBkGA1UEAxMSbnVuaXRDZXJ0
Q2hhaW5Sb290MCAXDTE4MTAxNTA5MDAxN1oYDzIxMTgwOTIxMDkwMDE3WjAdMRswGQYDVQQD
...
5u2K9PuJ3ySgL7AvYsqbB/e0/gw8j253SOU+gNTpFahOJsLGEJ43CRtaowkLnWEzs+OPnRfw
iQmqruw=
-----END CERTIFICATE-----

KeyEncoding:   The encoding of the Key value.

This setting specifies the encoding that has been applied to the Key. value prior to providing it to the class. The Key is typically represented as an array of bytes, however in some cases the key value may have been encoded. As a matter of convenience the class will accept the key with an encoding already applied. The class will decode the key value according the to the value specified here before processing. Possible values are:

  • 0 (none - default)
  • 1 (Base64)
  • 2 (Hex)
  • 3 (Base64URL)

RawHeader:   Holds the raw JOSE header.

This setting may be queried after calling Sign or Verify to obtain the raw JOSE header. This returns a JSON string like:

{"alg":"ES384","kid":"myKeyId"}

SerializationType:   Determines the serialization type to use when reading and writing JWS content.

This setting is used to control the serialization type the class uses when reading and writing JWS content. Possible values are:

  • 0 (default): Compact serialization (content is serialized as a single base64url-encoded string).
  • 1: Standard JSON serialization.
  • 2: Flattened JSON serialization.
StrictValidation:   Requires a specific algorithm when verifying signatures.

If set to True the class will validate that the Algorithm in the JWS message matches the value specified in the Algorithm property. If it does not an error is thrown. By default this is False and the algorithm is read and used automatically from the message. Enabling this setting provides a way to require a specific algorithm when calling VerifySignature.

Base Config Settings

BuildInfo:   Information about the product's build.

When queried, this setting will return a string containing information about the product's build.

GUIAvailable:   Whether or not a message loop is available for processing events.

In a GUI-based application, long-running blocking operations may cause the application to stop responding to input until the operation returns. The class will attempt to discover whether or not the application has a message loop and, if one is discovered, it will process events in that message loop during any such blocking operation.

In some non-GUI applications, an invalid message loop may be discovered that will result in errant behavior. In these cases, setting GUIAvailable to false will ensure that the class does not attempt to process external events.

LicenseInfo:   Information about the current license.

When queried, this setting will return a string containing information about the license this instance of a class is using. It will return the following information:

  • Product: The product the license is for.
  • Product Key: The key the license was generated from.
  • License Source: Where the license was found (e.g., RuntimeLicense, License File).
  • License Type: The type of license installed (e.g., Royalty Free, Single Server).
  • Last Valid Build: The last valid build number for which the license will work.
MaskSensitive:   Whether sensitive data is masked in log messages.

In certain circumstances it may be beneficial to mask sensitive data, like passwords, in log messages. Set this to true to mask sensitive data. The default is true.

This setting only works on these classes: AS3Receiver, AS3Sender, Atom, Client(3DS), FTP, FTPServer, IMAP, OFTPClient, SSHClient, SCP, Server(3DS), Sexec, SFTP, SFTPServer, SSHServer, TCPClient, TCPServer.

UseDaemonThreads:   Whether threads created by the class are daemon threads.

If set to True (default), when the class creates a thread, the thread's Daemon property will be explicitly set to True. When set to False, the class will not set the Daemon property on the created thread. The default value is True.

UseInternalSecurityAPI:   Whether or not to use the system security libraries or an internal implementation.

When set to false, the class will use the system security libraries by default to perform cryptographic functions where applicable.

Setting this configuration setting to true tells the class to use the internal implementation instead of using the system security libraries.

This setting is set to false by default on all platforms.

Trappable Errors (Jws Class)

JWS Errors

201   Invalid JWS value. Not recognized as a compact serialized JWS string.
202   Signature verification failed.
203   Key must be specified before attempting this operation.
204   The specified key is too short for the selected algorithm.
205   Certificate must be specified before attempting this operation.
206   Unsupported algorithm.
207   OutputFile already exists and Overwrite is False.
208   Error writing data. See error message for details.