throws JOSEException {
// Validate required JWE parts
if (encryptedKey != null) {
throw new JOSEException("Unexpected encrypted key, must be omitted");
}
if (iv == null) {
throw new JOSEException("The initialization vector (IV) must not be null");
}
if (authTag == null) {
throw new JOSEException("The authentication tag must not be null");
}
JWEAlgorithm alg = header.getAlgorithm();
if (! alg.equals(JWEAlgorithm.DIR)) {
throw new JOSEException("Unsupported algorithm, must be \"dir\"");
}
if (! critParamChecker.headerPasses(header)) {
throw new JOSEException("Unsupported critical header parameter");
}
// Compose the AAD
byte[] aad = StringUtils.toByteArray(header.toBase64URL().toString());
// Decrypt the cipher text according to the JWE enc
EncryptionMethod enc = header.getEncryptionMethod();
byte[] plainText;
if (enc.equals(EncryptionMethod.A128CBC_HS256) || enc.equals(EncryptionMethod.A192CBC_HS384) || enc.equals(EncryptionMethod.A256CBC_HS512)) {
plainText = AESCBC.decryptAuthenticated(getKey(), iv.decode(), cipherText.decode(), aad, authTag.decode(), contentEncryptionProvider, macProvider);
} else if (enc.equals(EncryptionMethod.A128GCM) || enc.equals(EncryptionMethod.A192GCM) || enc.equals(EncryptionMethod.A256GCM)) {
plainText = AESGCM.decrypt(getKey(), iv.decode(), cipherText.decode(), aad, authTag.decode(), contentEncryptionProvider);
} else {
throw new JOSEException("Unsupported encryption method, must be A128CBC_HS256, A192CBC_HS384, A256CBC_HS512, A128GCM, A192GCM or A128GCM");
}
// Apply decompression if requested
return DeflateHelper.applyDecompression(header, plainText);