ECDH + JWE encryption using nimbus-jose and Java 6

Question

I have a problem and I would like to know if you can help me.

I need to create an encrypted JWE with elliptic curve.

i am using

jre 1.6.0, nimbus-jose-jwt-8.20-jdk6.jar ,bcprov-jdk15to18-166.jar.

I have created a keystore and a key pair with the EC algorithm and elliptic curve P-512. If I sign the JWT with the private key and then I try to validate it with the public key everything works fine, but apart from signing I need to encrypt to make a JWE in which the payload is not seen.

When trying to encrypt the JWE with the public key it throws the following Exception

Exception in thread "main" java.lang.NoClassDefFoundError: java/util/Objects
at com.nimbusds.jose.jwk.KeyUse.hashCode(KeyUse.java:121)
at java.util.HashMap.put(Unknown Source)
at com.nimbusds.jose.jwk.KeyUseAndOpsConsistency.<clinit>(KeyUseAndOpsConsistency.java:43)
at com.nimbusds.jose.jwk.JWK.<init>(JWK.java:197)
at com.nimbusds.jose.jwk.ECKey.<init>(ECKey.java:706)
at com.nimbusds.jose.jwk.ECKey$Builder.build(ECKey.java:571)
at com.nimbusds.jose.crypto.ECDHEncrypter.encrypt(ECDHEncrypter.java:217)
at com.nimbusds.jose.JWEObject.encrypt(JWEObject.java:370)
at pruebasJwt.inicioJwt.main(inicioJwt.java:373)

this is the code that I use to encrypt:

        //encriptar token
        ECPublicKey publicKey = (ECPublicKey) certificadoBean.getPublicKey();
        Payload payload = new Payload(signedJWT2);
        JWEObject jwe = new JWEObject(jweHeader, payload);                              
        jwe.encrypt(new ECDHEncrypter(publicKey)); //**This is where the exception occurs**
        String jweString = jwe.serialize();
        
        String tokenJwt = signedJWT2.serialize();
        System.err.println(tokenJwt);

I have the libraries well defined in the eclipe classpath.

Although my requirements is JWE encrypted with an elliptic curve, I have created a test certificate RSA and in this way I have been able to generate an encrypted JWE with said certificate without problems.

I have also used a very simple example that they put on the https://connect2id.com/products/nimbus-jose-jwt/examples/jws-with-ec-signature page and it doesn't work for me either. When creating the key pair I get the same exception.

public class JweEC {

    public static void main(String[] args) {
        System.out.println("############ INICIO JWE FIRMADO CON CERTIFICADO CURVA ELIPTICA ##############");
        System.out.println("soporta ES512" + JCASupport.isSupported(JWSAlgorithm.ES512));
        
        //Proveedor de criptografica
        Provider bc = BouncyCastleProviderSingleton.getInstance();
        Security.addProvider(bc);
        System.out.println("soporta ES512" + JCASupport.isSupported(JWSAlgorithm.ES512));
        try {
            
            ECKey ecJWK = new ECKeyGenerator(Curve.P_521)
                    .generate(); **This is where the exception occurs**
                ECKey ecPublicJWK = ecJWK.toPublicJWK();
        }catch (Exception e) {
            // TODO: handle exception
        }

    }

}

The NoClassDefFoundError Exception indicates that the class loader responsible for dynamic class loading cannot find the .class file for the class you are trying to use, but as I said before all my libraries are well included in the classpath.

Could it be that I am missing some liberia to include? I don't know, I'm lost with this problem

Answer 1

I received a response from connect2id telling me that it was a problem as Luke said, there are things encoded with Java 7 and this case was one of them. In the end trying other versions with nimbus-jose-jwt-6.8-jdk6.jar finally everything works as I wanted.

Answer 2

The problem is that nimbus-jose-jwt-8.20-jdk6.jar does not support being run on Java 6, despite the appearance of 'jdk6' in its name.

You are getting the error you are seeing because the hashCode() method of the KeyUse class uses a method in the java.util.Objects utility class, and this class is only available from Java 7 onwards.

I would strongly recommend upgrading from Java 6, to Java 8 at least. Doing so would certainly get around this problem. However, if you are stuck with Java 6, you will have to get in contact with Connect2Id and ask them for support.