To use Jose4j library without calculating key length

[sai Lakshmi]

Hi Team,

We use HSM to store secret keys and private keys. We use Jose4j library to perform JWE operations.
We cannot get the actual key out of HSM, instead we get only handle (pointer to the key in HSM). We use LunaProvider to set ProviderContext.
But in this library, we could see the key lengths are calculated.
For example,

JsonWebEncryption senderJwe = new JsonWebEncryption();
senderJwe.setPlaintext(message);// message be some text
senderJwe.setAlgorithmHeaderValue(KeyManagementAlgorithmIdentifiers.A256GCMKW);
senderJwe.setEncryptionMethodHeaderParameter(ContentEncryptionAlgorithmIdentifiers.AES_256_GCM);
senderJwe.setKey(key);// key be some secret key
senderJwe.getCompactSerialization();

We get below error:
org.jose4j.lang.InvalidKeyException: Invalid key for JWE A256GCMKW, expected a 256 bit key but a 64 bit key was provided.
at org.jose4j.jwx.KeyValidationSupport.validateAesWrappingKey(KeyValidationSupport.java:101) ~[jose4j-0.7.6.jar!/:na]
at org.jose4j.jwe.AesGcmKeyEncryptionAlgorithm.validateKey(AesGcmKeyEncryptionAlgorithm.java:128) ~[jose4j-0.7.6.jar!/:na]
at org.jose4j.jwe.AesGcmKeyEncryptionAlgorithm.validateEncryptionKey(AesGcmKeyEncryptionAlgorithm.java:117) ~[jose4j-0.7.6.jar!/:na]
at org.jose4j.jwe.JsonWebEncryption.getCompactSerialization(JsonWebEncryption.java:314)

As we are not fetching actual key out of HSM, we get key length exception.

May I know are there any settings to be done to perform JWE operations without checking key length.

[Brian Campbell]

try senderJwe.setDoKeyValidation(false);