com.tmobile.oss.security.taap.jwe 1.0.12

Field Level Encryption (FLE) – C# version

Source Repository

• https://github.com/tmobile/tmobile-api-security-lib

Setup

• Add “com.tmobile.oss.security.taap.jwe” component from NuGet.org to your .NET Core 3.1 (or greater) project https://www.nuget.org/packages/com.tmobile.oss.security.taap.jwe/

• Get an EC or RSA public key from KeyVault JWKS. The OAuth2JwksService and KeyResolver classes do this for you based on your KeyPreference (see sample code below)

• Encrypt PII data

Example C# Console Code

using com.tmobile.oss.security.taap.jwe;
using Microsoft.Extensions.Logging;
using Microsoft.IdentityModel.Tokens;
using Moq;
using System;
using System.Collections.Generic;
using System.IO;
using System.Net.Http;
using System.Text;
using System.Text.Json;
using System.Threading.Tasks;

...

// On client, encrypt PII data
var oauthClient = "<ClientID>";
var oauthKey = "<ClientKey>";
var oauthUrl = "https://api.somedomain.com/oauth2/v6/tokens";
var keyVaultJwksUrl = "https://api.somedomain.com/customer/v1/jwks/someservice";
var cacheDurationSeconds = 36000; // 1 hour
var httpClient = new HttpClient();
var jwksService = new OAuth2JwksService(oauthClient, oauthKey, oauthUrl, httpClient, keyVaultJwksUrl);
var keyResolver = new KeyResolver(new List<JsonWebKey>(), jwksService, cacheDurationSeconds, KeyPreference.EC);
var logger = new Mock<ILogger<Encryption>>(); // Use your ILogger instance
var encryption = new Encryption(keyResolver, logger.Object);
var phoneCipher = await encryption.EncryptAsync("555-555-5555");


// On server, decrypt value
var privateJwksJson = File.ReadAllText(@"JwksPrivateKeys.json");
var privateJwks = JsonSerializer.Deserialize<Jwks>(privateJwksJson, new JsonSerializerOptions
{
    PropertyNameCaseInsensitive = true
});
var privateJsonWebKeyList = new List<JsonWebKey>();
privateJsonWebKeyList.AddRange(privateJwks.Keys);
keyResolver  = new KeyResolver(privateJsonWebKeyList, jwksService, encryptionOptions.CacheDurationSeconds, KeyPreference.EC);
var logger = new Mock<ILogger<Encryption>>(); // Use your ILogger instance
var encryption = new Encryption(keyResolver, logger.Object);
var phone = await encryption.DecryptAsync(phoneCipher );

For ASP.NET MVC application example, please see this code: https://github.com/tmobile/tmobile-api-security-lib/tree/master/encryption-lib/CS-Encryption-Lib/Example_Asp.Net_Mvc_WebApplication