生成签名和加密的 JWT

Question

我正在尝试使用 Nimbus JWT 生成签名和加密的 JWT 令牌。

private void generateToken() throws JOSEException, NoSuchAlgorithmException, UnsupportedEncodingException {
    KeyGenerator keyGen = KeyGenerator.getInstance("AES");
    keyGen.init(256);
    SecretKey secretKey = keyGen.generateKey();

    JWSSigner signer = new MACSigner(secretKey);
    JWTClaimsSet claimsSet = new JWTClaimsSet.Builder().subject("subject").build();

    SignedJWT signedJWT = new SignedJWT(new JWSHeader(JWSAlgorithm.HS256), claimsSet);
    signedJWT.sign(signer);

    JWEObject jweObject = new JWEObject(
            new JWEHeader.Builder(JWEAlgorithm.DIR, EncryptionMethod.A256GCM).contentType("JWT").build(),
            new Payload("hello world")
    );
    jweObject.encrypt(new DirectEncrypter(secretKey));
}

运行代码时，我收到以下错误消息

com.nimbusds.jose.JOSEException: Couldn't create AES/GCM/NoPadding cipher: Illegal key size
    at com.nimbusds.jose.crypto.AESGCM.encrypt(AESGCM.java:123)
    at com.nimbusds.jose.crypto.ContentCryptoProvider.encrypt(ContentCryptoProvider.java:187)
    at com.nimbusds.jose.crypto.DirectEncrypter.encrypt(DirectEncrypter.java:141)
    at com.nimbusds.jose.JWEObject.encrypt(JWEObject.java:370)
    at de.example.generateToken(TokenImpl.java:108)
    at de.example.TokenImpl.<init>(TokenImpl.java:68)
    at de.example.TokenTest.create(TokenTest.java:33)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:47)
    at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
    at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:44)
    at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
    at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:271)
    at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:70)
    at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:50)
    at org.junit.runners.ParentRunner$3.run(ParentRunner.java:238)
    at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:63)
    at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:236)
    at org.junit.runners.ParentRunner.access$000(ParentRunner.java:53)
    at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:229)
    at org.junit.runners.ParentRunner.run(ParentRunner.java:309)
    at org.junit.runner.JUnitCore.run(JUnitCore.java:160)
    at com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:69)
    at com.intellij.rt.execution.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:234)
    at com.intellij.rt.execution.junit.JUnitStarter.main(JUnitStarter.java:74)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at com.intellij.rt.execution.application.AppMain.main(AppMain.java:144)
Caused by: java.security.InvalidKeyException: Illegal key size
    at javax.crypto.Cipher.checkCryptoPerm(Cipher.java:1039)
    at javax.crypto.Cipher.implInit(Cipher.java:805)
    at javax.crypto.Cipher.chooseProvider(Cipher.java:864)
    at javax.crypto.Cipher.init(Cipher.java:1396)
    at javax.crypto.Cipher.init(Cipher.java:1327)
    at com.nimbusds.jose.crypto.AESGCM.encrypt(AESGCM.java:119)

虽然生成的密钥是 256 位 AES 密钥，但我真的不明白有什么问题。来自 nimbus 的 example 也是如此。我在这里想念什么吗？

Answer 1

就像用户“leleuj”在https://github.com/pac4j/pac4j/issues/355 上所说的那样，如果您还没有安装它们，您需要：“Java 加密扩展 (JCE) 无限强度管辖策略文件”。 你需要：

1. 下载你安装的java的版本（v7是jce-7，v8是jce-8）
2. 解压
3. 停止所有正在运行的 java 进程
4. 备份您的 local_policy.jar 和 US_export_policy.jar（两者都在 [java_home]/jre/lib/security 中）
5. 将新的复制到 [java_home]/jre/lib/security 中