#### [Abblix\.Jwt](https://www.abblix.com/en/docs/api/abblix-jwt 'index')
### [Abblix\.Jwt\.Encryption](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption 'Abblix\.Jwt\.Encryption')

## IKeyManagementAlgorithm\<TJsonWebKey\> Interface

Interface for JWE \(JSON Web Encryption\) key encryption and decryption operations\.
Encrypts and decrypts the Content Encryption Key \(CEK\) using a specific key management algorithm\.
Implements RFC 7516 Section 5 \(Key Encryption\) and RFC 7518 Section 4 \(Key Management Algorithms\)\.

```csharp
public interface IKeyManagementAlgorithm<in TJsonWebKey>
    where TJsonWebKey : Abblix.Jwt.JsonWebKey
```
#### Type parameters

###### `TJsonWebKey` {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TJsonWebKey}

The specific type of JSON Web Key required by this encryptor implementation\.

### Remarks
The key encryptor handles the "alg" \(algorithm\) parameter in the JWE header, which specifies
how the CEK is encrypted using the recipient's key\. This is separate from the "enc" parameter,
which specifies how the actual content is encrypted using the CEK\.
Common key encryption algorithms include RSA\-OAEP, RSA\-OAEP\-256, RSA1\_5, ECDH\-ES, and AES key wrap\.
### Properties

## IKeyManagementAlgorithm\<TJsonWebKey\>\.Algorithm Property {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.Algorithm}

The JWE key\-management algorithm identifier this encryptor implements \(e\.g\. "RSA\-OAEP\-256"\)\.
Must equal the DI key the encryptor is registered under: discovery enumerates the keyed
registrations and projects this value into the `*_encryption_alg_values_supported` lists,
so a mismatch would advertise an algorithm name the dispatch cannot resolve\.

```csharp
string Algorithm { get; }
```

#### Property Value
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')
### Methods

## IKeyManagementAlgorithm\<TJsonWebKey\>\.EncryptKey\(JsonWebTokenHeader, TJsonWebKey, byte\[\]\) Method {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.EncryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[])}

Encrypts a Content Encryption Key \(CEK\) using the configured key management algorithm\.
Used when creating JWE tokens to protect the CEK with the recipient's public key\.

```csharp
byte[] EncryptKey(Abblix.Jwt.JsonWebTokenHeader header, TJsonWebKey encryptionKey, byte[] keyToEncrypt);
```
#### Parameters

###### `header` [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.EncryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[]).header}

The JWE header that can be modified to add algorithm\-specific parameters \(e\.g\., "epk" for ECDH\-ES\)\.

###### `encryptionKey` [TJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TJsonWebKey 'Abblix\.Jwt\.Encryption\.IKeyManagementAlgorithm\<TJsonWebKey\>\.TJsonWebKey') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.EncryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[]).encryptionKey}

The JSON Web Key containing the public key material for encryption\.

###### `keyToEncrypt` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.EncryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[]).keyToEncrypt}

The randomly generated Content Encryption Key bytes to protect\.

#### Returns
[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')  
The encrypted CEK bytes that will be placed in the JWE "encrypted\_key" field\.
For RSA algorithms, output size equals the RSA key size in bytes\.
For direct key agreement \(ECDH\-ES\), returns empty array per RFC 7518\.

#### Exceptions

[System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException')  
Thrown when the key type is not supported for the configured algorithm\.

[System\.Security\.Cryptography\.CryptographicException](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.cryptographicexception 'System\.Security\.Cryptography\.CryptographicException')  
Thrown when encryption fails \(e\.g\., CEK too large for RSA key size\)\.

## IKeyManagementAlgorithm\<TJsonWebKey\>\.GenerateContentEncryptionKey\(JsonWebTokenHeader, TJsonWebKey, int\) Method {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.GenerateContentEncryptionKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,int)}

Produces the Content Encryption Key the content encryption step will use, before it is
protected by [EncryptKey\(JsonWebTokenHeader, TJsonWebKey, byte\[\]\)](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.EncryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[]) 'Abblix\.Jwt\.Encryption\.IKeyManagementAlgorithm\<TJsonWebKey\>\.EncryptKey\(Abblix\.Jwt\.JsonWebTokenHeader, TJsonWebKey, byte\[\]\)')\. Key\-wrapping and key\-transport algorithms use the
default implementation \- a fresh random CEK\. Algorithms where the CEK is determined by the
key material itself override it: direct encryption \("dir"\) returns the shared symmetric key,
and direct key agreement \(ECDH\-ES\) derives the CEK from the ephemeral\-static agreement,
recording the agreement parameters \(e\.g\. "epk"\) in the header\.

```csharp
byte[] GenerateContentEncryptionKey(Abblix.Jwt.JsonWebTokenHeader header, TJsonWebKey encryptionKey, int keySizeInBytes);
```
#### Parameters

###### `header` [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.GenerateContentEncryptionKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,int).header}

The JWE header; agreement\-based algorithms add their parameters to it\.

###### `encryptionKey` [TJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TJsonWebKey 'Abblix\.Jwt\.Encryption\.IKeyManagementAlgorithm\<TJsonWebKey\>\.TJsonWebKey') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.GenerateContentEncryptionKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,int).encryptionKey}

The JSON Web Key the JWE is being encrypted with\.

###### `keySizeInBytes` [System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.GenerateContentEncryptionKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,int).keySizeInBytes}

The CEK size required by the content encryption algorithm\.

#### Returns
[System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array')  
The CEK to encrypt the JWE payload with\.

## IKeyManagementAlgorithm\<TJsonWebKey\>\.TryDecryptKey\(JsonWebTokenHeader, TJsonWebKey, byte\[\], byte\[\]\) Method {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[],byte[])}

Attempts to decrypt an encrypted Content Encryption Key \(CEK\) using the configured key management algorithm\.
Used when validating JWE tokens where multiple decryption keys may be tried sequentially\.

```csharp
bool TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader header, TJsonWebKey decryptingKey, byte[] encryptedKey, out byte[]? decryptedKey);
```
#### Parameters

###### `header` [JsonWebTokenHeader](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.JsonWebTokenHeader 'Abblix\.Jwt\.JsonWebTokenHeader') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[],byte[]).header}

The JWE header containing algorithm\-specific parameters \(e\.g\., "epk" for ECDH\-ES\)\.

###### `decryptingKey` [TJsonWebKey](https://www.abblix.com/en/docs/api/abblix-jwt/Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TJsonWebKey 'Abblix\.Jwt\.Encryption\.IKeyManagementAlgorithm\<TJsonWebKey\>\.TJsonWebKey') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[],byte[]).decryptingKey}

The JSON Web Key containing the private key material for decryption\.

###### `encryptedKey` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[],byte[]).encryptedKey}

The encrypted CEK bytes from the JWE "encrypted\_key" field\.

###### `decryptedKey` [System\.Byte](https://learn.microsoft.com/en-us/dotnet/api/system.byte 'System\.Byte')[\[\]](https://learn.microsoft.com/en-us/dotnet/api/system.array 'System\.Array') {#Abblix.Jwt.Encryption.IKeyManagementAlgorithm_TJsonWebKey_.TryDecryptKey(Abblix.Jwt.JsonWebTokenHeader,TJsonWebKey,byte[],byte[]).decryptedKey}

When this method returns true, contains the decrypted Content Encryption Key\.
When this method returns false, this parameter is null\.

#### Returns
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')  
True if decryption succeeded with the provided key; otherwise, false\.
False typically indicates the wrong private key was used or the data is corrupted\.

### Remarks
This method does not throw exceptions for decryption failures to support trying multiple keys\.
Only cryptographic operation errors \(not authentication failures\) should throw exceptions\.