#### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index')
### [Abblix\.Jwt\.Encryption](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption 'Abblix\.Jwt\.Encryption')

## IKeyEncryptor\<TJsonWebKey\> Interface

Interface for JWE \(JSON Web Encryption\) key encryption and decryption operations\.
Encrypts and decrypts the Content Encryption Key \(CEK\) using a specific key management algorithm\.
Implements RFC 7516 Section 5 \(Key Encryption\) and RFC 7518 Section 4 \(Key Management Algorithms\)\.

```csharp
public interface IKeyEncryptor<in TJsonWebKey>
    where TJsonWebKey : Abblix.Jwt.JsonWebKey
```
#### Type parameters

###### `TJsonWebKey` {#Abblix.Jwt.Encryption.IKeyEncryptor_TJsonWebKey_.TJsonWebKey}

The specific type of JSON Web Key required by this encryptor implementation\.

### Remarks
The key encryptor handles the "alg" \(algorithm\) parameter in the JWE header, which specifies
how the CEK is encrypted using the recipient's key\. This is separate from the "enc" parameter,
which specifies how the actual content is encrypted using the CEK\.
Common key encryption algorithms include RSA\-OAEP, RSA\-OAEP\-256, RSA1\_5, ECDH\-ES, and AES key wrap\.
### Methods

## IKeyEncryptor\<TJsonWebKey\>\.EncryptKey\(JsonWebTokenHeader, TJsonWebKey, byte\[\]\) Method {#Abblix.Jwt.Encryption.IKeyEncryptor_TJsonWebKey_.EncryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[])}

Encrypts a Content Encryption Key \(CEK\) using the configured key management algorithm\.
Used when creating JWE tokens to protect the CEK with the recipient's public key\.

```csharp
byte[] EncryptKey(Abblix.Jwt.JsonWebTokenHeader header, TJsonWebKey encryptionKey, byte[] keyToEncrypt);
```
#### Parameters

###### `header` [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') {#Abblix.Jwt.Encryption.IKeyEncryptor_TJsonWebKey_.EncryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[]).header}

The JWE header that can be modified to add algorithm\-specific parameters \(e\.g\., "epk" for ECDH\-ES\)\.

###### `encryptionKey` [TJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IKeyEncryptor_TJsonWebKey_#Abblix.Jwt.Encryption.IKeyEncryptor_TJsonWebKey_.TJsonWebKey 'Abblix\.Jwt\.Encryption\.IKeyEncryptor\<TJsonWebKey\>\.TJsonWebKey') {#Abblix.Jwt.Encryption.IKeyEncryptor_TJsonWebKey_.EncryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[]).encryptionKey}

The JSON Web Key containing the public key material for encryption\.

###### `keyToEncrypt` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Encryption.IKeyEncryptor_TJsonWebKey_.EncryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[]).keyToEncrypt}

The randomly generated Content Encryption Key bytes to protect\.

#### Returns
[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')  
The encrypted CEK bytes that will be placed in the JWE "encrypted\_key" field\.
For RSA algorithms, output size equals the RSA key size in bytes\.
For direct key agreement \(ECDH\-ES\), returns empty array per RFC 7518\.

#### Exceptions

[System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException')  
Thrown when the key type is not supported for the configured algorithm\.

[System\.Security\.Cryptography\.CryptographicException](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.cryptographicexception 'System\.Security\.Cryptography\.CryptographicException')  
Thrown when encryption fails \(e\.g\., CEK too large for RSA key size\)\.

## IKeyEncryptor\<TJsonWebKey\>\.TryDecryptKey\(JsonWebTokenHeader, TJsonWebKey, byte\[\], byte\[\]\) Method {#Abblix.Jwt.Encryption.IKeyEncryptor_TJsonWebKey_.TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[],byte[])}

Attempts to decrypt an encrypted Content Encryption Key \(CEK\) using the configured key management algorithm\.
Used when validating JWE tokens where multiple decryption keys may be tried sequentially\.

```csharp
bool TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader header, TJsonWebKey decryptingKey, byte[] encryptedKey, out byte[]? decryptedKey);
```
#### Parameters

###### `header` [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') {#Abblix.Jwt.Encryption.IKeyEncryptor_TJsonWebKey_.TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[],byte[]).header}

The JWE header containing algorithm\-specific parameters \(e\.g\., "epk" for ECDH\-ES\)\.

###### `decryptingKey` [TJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IKeyEncryptor_TJsonWebKey_#Abblix.Jwt.Encryption.IKeyEncryptor_TJsonWebKey_.TJsonWebKey 'Abblix\.Jwt\.Encryption\.IKeyEncryptor\<TJsonWebKey\>\.TJsonWebKey') {#Abblix.Jwt.Encryption.IKeyEncryptor_TJsonWebKey_.TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[],byte[]).decryptingKey}

The JSON Web Key containing the private key material for decryption\.

###### `encryptedKey` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Encryption.IKeyEncryptor_TJsonWebKey_.TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[],byte[]).encryptedKey}

The encrypted CEK bytes from the JWE "encrypted\_key" field\.

###### `decryptedKey` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Encryption.IKeyEncryptor_TJsonWebKey_.TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[],byte[]).decryptedKey}

When this method returns true, contains the decrypted Content Encryption Key\.
When this method returns false, this parameter is null\.

#### Returns
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')  
True if decryption succeeded with the provided key; otherwise, false\.
False typically indicates the wrong private key was used or the data is corrupted\.

### Remarks
This method does not throw exceptions for decryption failures to support trying multiple keys\.
Only cryptographic operation errors \(not authentication failures\) should throw exceptions\.