Function decryptAction

command/crypto/jwe/decrypt.go:59–163

(ctx *cli.Context)

}

func decryptAction(ctx *cli.Context) error {
	if err := errs.NumberOfArguments(ctx, 0); err != nil {
		return err
	}

	data, err := utils.ReadAll(os.Stdin)
	if err != nil {
		return err
	}

	key := ctx.String("key")
	jwks := ctx.String("jwks")
	kid := ctx.String("kid")
	passwordFile := ctx.String("password-file")

	obj, err := jose.ParseEncrypted(string(data))
	if err != nil {
		return errors.Wrap(err, "error parsing data")
	}

	alg := jose.KeyAlgorithm(obj.Header.Algorithm)

	var isPBES2 bool
	switch alg {
	case jose.PBES2_HS256_A128KW, jose.PBES2_HS384_A192KW, jose.PBES2_HS512_A256KW:
		isPBES2 = true
	}

	switch {
	case isPBES2 && key != "":
		return errors.Errorf("flag '--key' cannot be used with JWE algorithm '%s'", alg)
	case isPBES2 && jwks != "":
		return errors.Errorf("flag '--jwks' cannot be used with JWE algorithm '%s'", alg)
	case !isPBES2 && key == "" && jwks == "":
		return errs.RequiredOrFlag(ctx, "key", "jwk")
	case key != "" && jwks != "":
		return errs.MutuallyExclusiveFlags(ctx, "key", "jwks")
	case jwks != "" && kid == "":
		return errs.RequiredWithFlag(ctx, "kid", "jwks")
	}

	// Add parse options
	var options []jose.Option
	options = append(options, jose.WithUse("enc"))
	if kid != "" {
		options = append(options, jose.WithKid(kid))
	}

	// Read key from --key or --jwks
	var pbes2Key []byte
	var jwk *jose.JSONWebKey
	switch {
	case key != "":
		jwk, err = jose.ReadKey(key, options...)
	case jwks != "":
		jwk, err = jose.ReadKeySet(jwks, options...)
	case isPBES2:
		var password string