[FEATURE REQ] Improved support for JWS Signing and JWE Decryption for java nimbus jose

[vtapadia]

Is your feature request related to a problem? Please describe.
We use Spring Java + Azure Key Vault for Signing and Decryption. However, the lack of support for the defacto standard library nimbus-jose-jwt causes a bit of barrier to adoption.

Describe the solution you'd like
Mainly there are 2 interfaces that if supported, would work great and standardize the way Signing and Decryption is done.
com.nimbusds.jose.JWEDecrypter
com.nimbusds.jose.JWSSigner

Describe alternatives you've considered
I created my own implementation for use. For signer this is easy..

    @Override
    public Base64URL sign(JWSHeader jwsHeader, byte[] bytes) {
        //Getting the exact key version, I have used keyname/version as the keyID. Wish Azure would also have used the same mechanism for defining key ID. :)
        String[] keyParts = jwsHeader.getKeyID().split("/");
        CryptographyClient cryptographyClient = keyClient.getCryptographyClient(keyParts[0], keyParts[1]);
        SignResult signResult = cryptographyClient.signData(
                SignatureAlgorithm.fromString(jwsHeader.getAlgorithm().getName()),
                bytes);
        return Base64URL.encode(signResult.getSignature());
    }

For Decryption, again created the same decrypter, but it would have been easy had the implementation is available from Azure. I only built it for RSA_OAEP_256 use case, but similar could be done for all the possible flavors

    @Override
    public byte[] decrypt(JWEHeader header, Base64URL encryptedKey, Base64URL iv, Base64URL cipherText, Base64URL authTag) throws JOSEException {
        //Getting the exact key version.
        String keyID = header.getKeyID();
        String[] keyParts = keyID.split("/");
        //Create client for KV for the specific key
        CryptographyClient cryptographyClient = keyClient.getCryptographyClient(keyParts[0], keyParts[1]);
        if (header.getAlgorithm() == JWEAlgorithm.RSA_OAEP_256) {
            //Decrypt the Content Encryption Key from the KV
            DecryptParameters rsaOaep256Parameters = DecryptParameters.createRsaOaep256Parameters(encryptedKey.decode());
            DecryptResult decryptResult = cryptographyClient.decrypt(rsaOaep256Parameters, Context.NONE);

            //Use the Content Encryption key to decrypt the data
            SecretKey secretKey = new SecretKeySpec(decryptResult.getPlainText(), header.getEncryptionMethod().getName());
            return ContentCryptoProvider.decrypt(header, encryptedKey, iv, cipherText, authTag, secretKey, new JWEJCAContext());
        } else {
            throw new RuntimeException("Unsupported Encryption");
        }
    }

Additional context
I think implementation similar for these interfaces should be part of the Java keys library or even a separate project.

Information Checklist
Kindly make sure that you have added all the following information above and checkoff the required fields otherwise we will treat the issuer as an incomplete report

• Description Added
• Expected solution specified

[joshfree]

Thanks for sharing this feedback @vtapadia! @vcolin7 please take a look