amosavian / jwsetkit

A kit to create, sign and verify a JWT or JWS object

JWSETKit

A library for working with JSON Web Signature (JWS) and JSON Web Token (JWT).

Overview

JSON Web Signature (JWS) represents content secured with digital signatures or Message Authentication Codes (MACs) using JSON-based RFC7159 data structures. The JWS cryptographic mechanisms provide integrity protection for an arbitrary sequence of octets.

JSON Web Token (JWT) is a compact claims representation format intended for space constrained environments such as HTTP Authorization headers and URI query parameters.

This module makes it possible to serialize, deserialize, create, and verify JWS/JWT messages.

Supported Swift Versions

This library was introduced with support for Swift 5.8 or later.

Getting Started

To use JWSETKit, add the following dependency to your Package.swift:

dependencies: [
    .package(url: "https://github.com/amosavian/JWSETKit", .upToNextMinor(from: "0.19.0"))
]

Note that this repository does not have a 1.0 tag yet, so the API is not stable.

You can then add the specific product dependency to your target:

dependencies: [
    .product(name: "JWSETKit", package: "JWSETKit"),
]

Usage

For detailed usage and API documentation, check the documentation.

Comparison To Other Libraries

Features

	JWSETKit	jwt-kit	JOSESwift	Auth0's JWTDecode
JSON Web Signature (JWS)	✅	❌	✅	❌
JWS Multiple Signatures	✅	❌	❌	❌
JWS Unencoded/Detached Payload	✅	❌	❌	❌
JSON Web Token (JWT)	✅	✅	✅	✅
JWT Signature Verfication	✅	✅	✅	❌
JWT Expire/NotBefore Validity	✅	✅	✅	❌
JSON Web Encryption (JWE)	✅	❌	✅	❌
Support CommonCrypto Keys	✅	❌	❌	❌
Support CryptoKit Keys	✅	❌	❌	❌

Supported Algorithms

Signature/HMAC

	JWSETKit	jwt-kit	JOSESwift	Auth0's JWTDecode
HS256	✅	✅	✅	❌
HS384	✅	✅	✅	❌
HS512	✅	✅	✅	❌
RS256	✅	✅	✅	❌
RS384	✅	✅	✅	❌
RS512	✅	✅	✅	❌
ES256	✅	✅	✅	❌
ES384	✅	✅	✅	❌
ES512	✅	✅	✅	❌
PS256	✅	✅	✅	❌
PS384	✅	✅	✅	❌
PS512	✅	✅	✅	❌
PS512	✅	✅	✅	❌
EdDSA	✅	✅	❌	❌
E256K	❌	❌	❌	❌

Key Encryption

	JWSETKit	JOSESwift
RSA1_5	✅	✅
RSA-OAEP	✅	✅
RSA-OAEP-256	✅	✅
A128KW	✅	✅
A192KW	✅	✅
A256KW	✅	✅
dir	✅	✅
ECDH-ES	✅	❌
ECDH-ES+A128KW	✅	❌
ECDH-ES+A192KW	✅	❌
ECDH-ES+A256KW	✅	❌
A128GCMKW	✅	❌
A192GCMKW	✅	❌
A256GCMKW	✅	❌
PBES2-HS256+A128KW	✅	❌
PBES2-HS384+A192KW	✅	❌
PBES2-HS512+A256KW	✅	❌

Content Encryption

	JWSETKit	JOSESwift
A128CBC-HS256	✅	✅
A192CBC-HS384	✅	✅
A256CBC-HS512	✅	✅
A128GCM	✅	❌
A192GCM	✅	❌
A256GCM	✅	❌

jwsetkit's Issues

POV: More use of enum

Is there a reason that causes you to not use enum for types like JSONWebKeyCurve and JSONWebKeyType?
Using enum can bring more compiler safety for cases like keyLengthInBytes and verifySignature.

Wrong alg value

I'm running this code

let jwe = try! JSONWebEncryption(
    content: Data("Live long and prosper.".utf8),
    keyEncryptingAlgorithm: .direct,
    keyEncryptionKey: nil,
    contentEncryptionAlgorithm: .aesEncryptionGCM256,
    contentEncryptionKey: kek

and the header outcome is {"typ":"JWE","alg":"direct","enc":"A256GCM"}
but the correct value for alg is "dir" (at least for my c# backend)