Hrithik.Security.Jose 1.0.0

Hrithik.Security.Jose

Banking-grade JOSE (JWS + JWE) security library for .NET 8+

Hrithik.Security.Jose is a production-ready implementation of JSON Object Signing and Encryption (JOSE) designed for fintech, banking, and enterprise APIs.

The library enforces secure defaults, explicit validation rules, and deterministic behavior.
It is intentionally opinionated to prevent common JWT/JWE security mistakes.

✨ Key Features

🔐 JWS (JSON Web Signature)

• RS256 and HS256 signing
• Explicit algorithm allow-list (prevents alg:none attacks)
• Mandatory exp (expiration) claim enforcement
• Deterministic clock handling via IClock
• Secure kid-based key resolution
• Tamper-detection and defensive parsing

🔒 JWE (JSON Web Encryption)

• RSA-OAEP key management
• A256CBC-HS512 content encryption (Microsoft-supported & bank-grade)
• Strong payload confidentiality
• Header kid enforcement
• Fully compatible with Azure AD / Entra / Microsoft Identity

🧠 Validation & Security

• Domain-specific exceptions (InvalidTokenException)
• No framework exception leakage
• Clock-skew aware lifetime validation
• Strict parsing and validation rules

🧪 Testing

• Security-negative test coverage (tampering, downgrade, expiry)
• Deterministic crypto tests
• Fully isolated test infrastructure
• All critical paths covered

📦 Installation

dotnet add package Hrithik.Security.Jose
🚀 Quick Start
JWS – Sign and Validate
var signer = new JwsSigner(
    keyProvider,
    new JwsOptions(),
    clock);

var verifier = new JwsVerifier(
    keyProvider,
    tokenValidator,
    clock);

var token = signer.Sign(
    new Dictionary<string, object>
    {
        ["sub"] = "user123",
        ["scope"] = "payments"
    },
    "signing-key-1");

verifier.Validate(token, "signing-key-1");

JWE – Encrypt and Decrypt
var encryptor = new JweEncryptor(keyProvider);
var decryptor = new JweDecryptor(keyProvider);

var encrypted = encryptor.Encrypt(
    "{\"amount\":1000}",
    "enc-key-1");

var payload = decryptor.Decrypt(
    encrypted,
    "enc-key-1");

🔑 Key Management

Consumers must provide their own key source by implementing:

public interface IJoseKeyProvider
{
    SecurityKey GetSigningKey(string keyId);
    SecurityKey GetEncryptionKey(string keyId);
}


This enables seamless integration with:

Azure Key Vault

Hardware Security Modules (HSM)

Cloud KMS providers

On-prem key stores

Bring-Your-Own-Key (BYOK) models

🕒 Clock & Time Safety

All time-sensitive logic uses the IClock abstraction.

This ensures:

Deterministic tests

No reliance on DateTime.UtcNow

Safe token lifetime validation

Predictable behavior in distributed systems

🏦 Security Philosophy

This library is intentionally strict.

❌ No insecure defaults

❌ No silent fallbacks

❌ No implicit algorithm selection

❌ No alg:none

❌ No token acceptance without expiration

Instead:

✅ Explicit policy enforcement

✅ Audit-friendly design

✅ Clear failure modes

✅ Fintech / banking aligned behavior

📚 Standards & Compatibility

RFC 7515 – JSON Web Signature (JWS)

RFC 7516 – JSON Web Encryption (JWE)

RFC 7519 – JSON Web Token (JWT)

Fully compatible with Microsoft Identity & Azure Entra

📄 License

MIT License

## 👤 Author

**Hrithik Kalra**
Fintech & Security Engineering

📧 Email: hrithikkalra11@gmail.com

If you find this package useful, consider supporting its development:

- ☕ Buy Me a Coffee: https://www.buymeacoffee.com/alkylhalid9  
- ❤️ GitHub Sponsors: https://github.com/sponsors/hrithikalra

Support is entirely optional and helps sustain ongoing development and maintenance.

---

## 🔗 Related Packages

This package is part of the **Hrithik.Security** ecosystem:

- **Hrithik.Security.ApiKeyManagement**  
  API key generation, storage, and scope-based authorization

- **Hrithik.Security.RequestSigning**  
  HMAC-based request signing for tamper-proof APIs

- **Hrithik.Security.ReplayProtection**  
  Short-window replay attack prevention

- **Hrithik.Security.RateLimiting**  
  Flexible, API-key–aware rate limiting for ASP.NET Core APIs

These packages are **independent** and can be used together or individually.

⚠️ Disclaimer

This library provides cryptographic primitives and enforcement rules.
Security of the overall system still depends on key management, transport security, and correct integration.

Always follow your organization’s security policies and compliance requirements.