JWE Decrypt not working for RSA algorithm

[Sathyaenn]

Have encrypted JWE Object using below approach. To encrypt used RSA PEM file for encrypt the content.

JweRecipient jweNewRecipient = new JweRecipient(JweAlgorithm.RSA_OAEP_256,rsa);
var jweNewObj = JWE.Encrypt(jseNewSource, new[] { jweNewRecipient }, JweEncryption.A256CBC_HS512);

From encrypted data, have collected "encrypted_key" from the object and retrieved actual symmetric key for the decryption.

While trying to decrypt the content using following approach
jrsakey - Symmetric key value for "encrypted_key".

JWE.Decrypt(jweNewObj, jrsakey);

JWE.Decrypt(jweNewObj,jrsakey, JweAlgorithm.RSA_OAEP_256, JweEncryption.A256CBC_HS512);

JWE.Decrypt(jweNewObj, Convert.FromBase64String(decryptResponse.Result.plain), JweAlgorithm.RSA_OAEP_256, JweEncryption.A256CBC_HS512, null);
Encrypt_Decrypt_Sample_data.txt

for all the approach receiving error. Can you guide me on the decryption part of this.

[dvsekhvalnov]

Hi @Sathyaenn , you error log says you attempted to decrypt with wrong key type.

All RSA* algs expects RSA key. RSA keys are asymmetric. I'm not sure given your example what you are passing as a key, would be helpful if you can post exact code you are using for encoding / decoding.

[Sathyaenn]

For Encoding
PemReader pr = new PemReader(File.OpenText(publicKeySignature));
AsymmetricKeyParameter publicKey = (AsymmetricKeyParameter)pr.ReadObject();
var jweNewObj = "";
using (RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(2048))
{
RSAParameters Key = DotNetUtilities.ToRSAParameters((RsaKeyParameters)publicKey);
rsa.ImportParameters(Key);
JweRecipient jweNewRecipient = new JweRecipient(JweAlgorithm.RSA_OAEP_256,rsa);

                jweNewObj = JWE.Encrypt(jseNewSource, new[] { jweNewRecipient }, JweEncryption.A256CBC_HS512);
            }

For Decode

var newtest = JWE.Decrypt(jweNewObj, Convert.FromBase64String(decryptResponse.Result.plain), JweAlgorithm.A256KW, JweEncryption.A256CBC_HS512);

decryptResponse.Result.plain Value of decryption key

For encryption we have used public key of source machine key value. This will provide encrypted JWE object.

Based on the JWE string "Encrypted Key" value we revoke the decode value string for the machine key file. This value in the form of Symmetric key value for the given machine key file.

Decryption Key for JWE Object
encrypted_key = m4f-0Q6gYuOhpJC4PaSIg84xk6Fa0SvR-sayjQZPpG8WlNbPnRuR-I6g6aFEKWjGysV567fMX9uembExbno7A2u5T-pkiYW14esgipkArdnpKj9aFeXgxhzjKF-BPGvSI6m7OeO10qktBGGvQlaSXcVE4nM86ALCYFT6EQBhePcHb-necM9_OKOjeh9ZNUjSJYBovoAfVsA17mOkP5UDQng6IZEsZI4K8Vzk4zvwnzm2teZsLomTE9b63_t5bsI3HPSAAvWc9BDdhBaFGiNR2x6Y9Oy4v5UPuakNME-e0KM29uRdFuKkhwMnjnq1PxowiprHp-w1IzgHt0aJLSQb3Q

Decryption Key response
{"kid":"83315fc2-6663-403d-850d-1ce2adc1ec53","plain":"hRlHJwqghdJhT+IibshwoUU++NOEwTl1LyymzSrIcQULGqCulOxvJeFZOu5cLCz+j3oA3dRlxc06p4D1Sd6GUQ=="}

Note: Above process works fine in JAVA based approach suing below code snip.

For Encryptoon
JWEObject jweObject = new JWEObject(
new JWEHeader.Builder(JWEAlgorithm.RSA_OAEP_256, EncryptionMethod.A256CBC_HS512)
.contentType("JWT") // required to indicate nested JWT
.build(),
new Payload(jwsString));
// Encrypt with the recipient's public key
jweObject.encrypt(new RSAEncrypter((RSAPublicKey)
getPublicKey()));

For Decryption

JWEObject jweObject = JWEObject.parse(jweString);
SecretKey originalKey = new SecretKeySpec(Base64.decodeBase64(decryptResponse.getPlain()),
algMap.get(encConfig.getContentEncAlg()));
jweObject.decrypt(new DirectDecrypter(originalKey, true));

algMap.get(encConfig.getContentEncAlg()) This value in the form of Symmetric key value for the given machine key file.

[dvsekhvalnov]

Is a value of decryptResponse.Result.plain equals to hRlHJwqghdJhT+IibshwoUU++NOEwTl1LyymzSrIcQULGqCulOxvJeFZOu5cLCz+j3oA3dRlxc06p4D1Sd6GUQ== in your example?

It sounds like string to me. But AES256KW expects byte[] as a key.

Btw do you really need JWE ? It's for RFC 7516 JWE JSON Encoding. Typically it is rare use case. Usually Jose.JWT.Decode() / Encode() is used.

[Sathyaenn]

hRlHJwqghdJhT+IibshwoUU++NOEwTl1LyymzSrIcQULGqCulOxvJeFZOu5cLCz+j3oA3dRlxc06p4D1Sd6GUQ== iis base 64 string of decryptResponse.Result.plain.

While assigning key converting to byte[].

Need a help on the decode method for encrypted JWE Object.

[Sathyaenn]

String values is AES Key value in the form of base 64string

[dvsekhvalnov]

Ok. Can you just post a minimal unit test so i can run?

[Sathyaenn]

Following approach are tried to decode the actual value string
public void DecryptString()
{
string encryptString = @"{""ciphertext"":""oWoZscNk0ysJPkhvv8TZEebH - ofWMccYIgtUkd7hIbZbgX162DpBGIybimd3AtKwhOr_uRjvRa750_L0sQbBkCWLUaG6d5j7 - pxAwvWa837mb517HBVMMYFoM8gtlnqFIbLJfVWH7uDcaWpVVuc9Uwt9axTZK3m_d56BwIVixN - YuP5iLgQgUW3nrA7cy1LrmWu57 - AvmCACq2qmi1oBYquO2njGmYmWqDGH_YND2chZuLWqMHPsJVlWwPAncg3D - h0MtirwKzIaITKU_TUFBxITsjgQ0RzbTfDlS3ZxjiUWpCKw68Wn8hqScUvQfMKgpZQzeqonzsa7PG4W4rrRyGyJu0igyoKkNPxmGY67vX40ccVUWrtyKuLn899qgslhae6MZzYIgKIcT9zLsC3UYj9X_Ptn7AtXsKb77_JZb3qE1Ys36Om - OyAYsFuHpS00vtgZ1xylVIT13zoURH0vpFCRRKbg_SGAXGQVU_UJxcTvOwXJPnmAXxHoR1CQb - PYl9LH3TzbJrUcO0Cbn1lNVwbjEEzmaS8cpA8FFqF - ep - UsVSGmgnPQr1Y_Co2lh9oGaJp3fZe4tTAVoJMBpl5kAXaGm8CKutnfZFFHdQAQgJTIHsxUf6BUzHKzl4Q4C8vQG8QKRWrx8nU05u9ZkOnMXJ1WPDXLkNDb4jXe02wYjNrQTLNwVzDEPXMnwZQr6UpO - QNM609DmbFz94RO0wNyWVLd2V8aKv3b0l3QvqWYyiLWB8ZbNHWw_iRCDq3AmK9KLnyIBxhCJHpyzipn00ExyBOvpQ7D5cyjhSfdWxYbRXBNlf_pS_vDH9P8FIxuTqLV4yGDvuA63jrtDWBGfJB2AZe_QJagHX4wKBbxv - jdMZuHZIRG9aU99vP5KPg3bVOsU7RHN569m - PFkhvGVn9L3KSFDZQr3WpwV84jM_AKdDFLdpJrRpqeQFcqxVY0wndFLGs_N0pnd7WahP2BG_s - a3fiQFKh2v9CV - QSDoef_cLwmv - BuvmtMX26ogxnbmUH3bCGJ88GSv8OlMoSTSI1eMJzP2sO2IVnoqNKbVOiKOywlWeYQlTSuzav_IqDcuDVwzxWt0FnQoSeWPKqUxnv7wqKWXlFDYuN7AZO21GuGdCza_WS0nyto1bKzQmpqtJVY3H3OCujrU_i6O3IY7vzvgim6vX2C4wflkUes10WpLyb9gjmlrWdMEXqDsTybHgXVt5FwvtBgVbLdEB44o - dgNU2_2yJ4r0Ow - HbMfPHGQCEhY2DKNe_OVejQuAEa00fnUJfU8v6_GP8wEMnh - lfCrDiSOnu1oIQfWbzYhLWwYbyquXNWHKELSRUJAU9ZBvyP0ymM60hLKfp8luNi4y - dVJdEiTMZy - c6n8FMxrLsh0enAsFkLUHFjuATsBqBAa6ZC2nHMWN38Igu1 - BdgKPvL5EbexDnaRmOeSIBJtm - SUUSX9RIlB7r28XwXRLZ0YwLLd - zIBPPpgh9D - hCo4RVmjYqadyf7YQGYl8a98r3jQlteECcCwq0 - bQ - 2xEH9LBOQ8bSAhKgN0hg4VBRUoF4BMN6Tbu9ic3ggb4NjaKc9tlwFa7emEEDd12_FD532kczwJ5clSqNh80yEqAXMYES3CJJT6nFRrV4VxSZe9a4_RkDUMGq602aNxsriyYxys4EHv9k4LiTEWM3f6o - 9L3HG6kfKxgHnLDtYUdYfrAiRyHZK9E4EUV6_i6I8xA_8I7MVcHUHnoRHA2S1i8CWBEZveWgSsF8PWTZJqvPpEXTNauaZ9TlxMvQq0UKrVE2BSwag3ScYHfpw - jd5EyQUlH00l6tsLlBj5vdXFjL2zRvZL4XK2dYmIqApZCK45oVMHovHX5FcISSgUyPZn0aHfFcOZw00MYdaaPMICIv4QwMaxbZDHcJm1AA_Juo2PTdu64CQm0m1OlnCZDB4QC2kfpxbwUU37fxzjT77ou9Bb8Wa5SEagBRKTGXtWjhW19Jka4kNpBcGps - OIUolxhNFmuOWZB0V0KnzrASTYbbAG8reXE2M7GowKjvCmq05VKlBjkrI4Bf79lqtj3Ri98mqm6ywZGJlpPE4Pbihnb_WlKkc3rVa6o6WG9arNaKpzYBwDMusdLYkDRsIHLuxJhFlFzluvjnArDCRm9jfMlGURYeI8r1yjps10 - elTqUDM3jZGLcCqQHe0YmAP1fI0AFcsbY96jjdtfU0E5zV3UjwcIOiMMjd4yeBAPBeoxGFiMmQr2lvHu7AIobHiF_jMGz - AAF8Ag8M4bZb6d6EPyNKaj1i1KoOCLi1uoLGE4Xt1tyYS38ePNkjjvmx3np21TewyZPeM8LkZliEy7FwLvspji6wF_T2AVlVkxPqplTxRwhkH3LWmLYZz_doOrcsoR4QJkLjwqrl1I0l3jjLAjehN2swknPuVrPfoKh4A2lziRAxEAKPIaGcUcUccWWksWqNHuCoPx5gKU6pPFWoZbRKm1nPnMOzNiUCoc7JByT - FwfW3a9FuX5sbzq0HC5ghjU - 4UiAAf - 7LTR5kwPoDND2lu5nH2fKfYujIuftAURVexAewDbNzzilcKnZAKVt94J7kTZXDPXufsrXu2pw2eCqdtDWdyKFfSxIszfyuUqNzYRMFhfwvUfxOTiLK2lnMSRb9A8qQLUD1326TdwbSU6BE5a2DiYNoY5DPfd66C2OJwEMgvbNUY4DVZ5rLSh4tvlKmOFrw3gVQdpOa8QlJ2EW - BORd3RFUJsng - d41HHh45hDAc8E - fJrlRiw - GyvwEsCoXl - 2YjNDsnquT0lpjZa8hKzLxPIF4wSPgORHkj7yAeMwDXjt_NSAwl - pvKZw7ADwa7qzZQfLRxNQfZ2Vznw6VgxMCmty65Er6Af6s7sVHpL2W7Z9tsZAUGlT6gfzvm3H - ecv_QFLYCbQL1addRncXn1fkyuUNWUpkhsjG99YpcykcJLeiLJPRXDt8ODCkcHVJuoIGqdbM88BpHU1iUyoxrwS - jJFBBlK6CTG2TFwOfQq89r2M3B - glDP0YwOjpTJ1htUJnm81sOHDJNFSLHmOzctx8c - EX6BEra0HQ68tZl3TH3aAyKOYbwwwJWtmnzBbxTkpev1BkWk - Z1kBrnAOnmpLBDxUqWBLaRQTkuxXTK1USFPyx - b6aOcQVMw432xfjI7gIgORyOF1fRFg2p1HFSjdmiyuLwIFLUFvSsAUj6iKjBBTGQy5jYNDKVejC2FIA - sZWuJ890N3ztBDhyNc""
,""protected"":""eyJlbmMiOiJBMjU2Q0JDLUhTNTEyIn0"",""iv"":""EZ6Bm9SWkg25IVbDhzBooA"", +
""tag"":""dwKCkIHfmCOjEvtTchXjSJCaxk7PsdN9I6KdN3QKbcY"",""header"":{""alg"":""RSA-OAEP-256""}, +
""encrypted_key"":""m4f-0Q6gYuOhpJC4PaSIg84xk6Fa0SvR-sayjQZPpG8WlNbPnRuR-I6g6aFEKWjGysV567fMX9uembExbno7A2u5T-pkiYW14esgipkArdnpKj9aFeXgxhzjKF-BPGvSI6m7OeO10qktBGGvQlaSXcVE4nM86ALCYFT6EQBhePcHb-necM9_OKOjeh9ZNUjSJYBovoAfVsA17mOkP5UDQng6IZEsZI4K8Vzk4zvwnzm2teZsLomTE9b63_t5bsI3HPSAAvWc9BDdhBaFGiNR2x6Y9Oy4v5UPuakNME-e0KM29uRdFuKkhwMnjnq1PxowiprHp-w1IzgHt0aJLSQb3Q""}";

        var decryptKeyBase64 = "hRlHJwqghdJhT+IibshwoUU++NOEwTl1LyymzSrIcQULGqCulOxvJeFZOu5cLCz+j3oA3dRlxc06p4D1Sd6GUQ==";

        var jwkey = new Jwk(Convert.FromBase64String(decryptKeyBase64));

        var decryptValue = JWE.Decrypt(encryptString, jwkey, JweAlgorithm.RSA_OAEP_256, JweEncryption.A256CBC_HS512);

        Console.WriteLine($"Decrypted string :: {decryptValue.Plaintext}");

    }

    public void **DecryptMethod2()**
    {
        string encryptString = "eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2Q0JDLUhTNTEyIiwiemlwIjoiREVGIn0.FThrl_yoXDF-UaVFqOVUEuYzDKwbgAUduO0oZmJQDxGfwz0_U2f92D58K9-OGKx0OFmDkhXMxyomMV9_-TJbEyqhAo2CxIX1BuqoLWRDQyFwvpEBPDbfKPolJ9QdEYz_WxmCqz4mcc_DThnHild2Iwr5oD8YfLvKadeFYmAQ0gK3Lqtdj5hOWEcz04PhQLNzb8mhD23x6V6XA9wf8-KftuxNFBeN4vJWXNm-umg_r56jOjxh7e6fNGHdc9AyG7wBEd9ucBqkrCDYy9nT3723Gn1_XiIx5n8dEDAucEgEs6Mgyj_3XWT-Q7oZ76aHUPPNSXeECAd0Vftt_jtqkVKnNQ.AWY0Vwh89n-kYs4X7L9zuw.Y5Fu6EDmvPHfB3SuRHLmFz7EyKyCF7ylH6xO6tsU6tIZt0MsPjaMNPJKYGNC-mWdz0CJh2Jl53EPVPu4pX8oHIYTrJxwjg4mB0wgxUbh-6UqhjIO8wdsxIskwRd6dTN_39MaYhJUKvFTj10bzMLC19AxpzTmmaXmkwLR5rF9-8E4-lpE0u9Ice-tJcHRBsf2N84aMm_m5wNVxadHx_u4aLH4AuX8-tU1wxgWA2UgdGaeLYVX6mNJVGrT4XUaQD0T35Dwa9v_DB-ynaz5426HwhozYJKuVT_qjI93xgJdfRkav-3Mg-s-RCvvqq892wlpQEi8ItWHHOwkwcec8fMVSNEIj1pH1ZNr4XdhmINOjovTD0O3UxV_6coO3hsjHip0B3cSXP-k6Z8fOaHvbnwZxqXaFdoHh3xBhUcx5Di6tfV0oDJEtjrIZLnRHqO3FMQNSLQCOBSGhoMRblvXx4byBGDil45h99jPjn4fUZ4ThP4S8DnSyc5_fMYU0FVIquFnZ39FWn2nW9GCUyq7JDnFEjPWkqHi3aZg1YFJ0SpPRcrCKxPY12L0YtRy4kOkPyKf4tSkJx6e-MfJsKb74simIweq-bxwdxl93i0BiGfSwYEijGkX02M58X_5X0RomcyA7-XWuUos_yXPe3cxGVgtaERdU78bcqS8xBE7WM6umDuCX2_IUqwL0MZk3OWfMmxPe1FZiBIG50XULQA7qXHZ6DDKI8jtZieuiA0d5iG3VPlw8yTT5FxJf3IEVpOiAyVWEEn4SsI4h_bthJVtAKM0MhyqozfN21U98ovE5vpMVHPOVW51xFtFgROcwmv7kHTqOQsky5kzLfnA8zZXOsdlKKZU2rwbvJLSOETjjEzJcRGy4owknS7dax66kJjxrA6h8yn3nvORlYO5D95szXPwEEFVDeAgZTYvexKR7ouhQL3PBHVb21Gvf4WFYPBeJrRwRHmOowH62CGzQwlEywCLrSz1xcliKlZCLTTVilQdj7rA5e37bKh_ALf5vkPi857CF5Nr0XpTnA7X0QQiCdSeJ2zdme3MZ-ufcZa4yOGd1A0eVLLN909lis5CA8sdeE_R0pb0ZhTVNU-t9NuGmiZ67l_AffCPuR7dCqQ8_75AoGS4Oxy9Vb6qgEPRIczzBRYbyjCNheRzfHR2xHyVsB3pBWCw77wWtH-7CNTJxIQh3Z0Up3h121Z17dJnEdjSftqCelER8KLKNoz6ePui-ROC1VHQ4T6se7EHbriXUZbG0W_G5hhhTm-TcEJehkqESPkTybNTJBPmcjp_gVoZIqwcy7-_GTDHeGzjoikRwJIh9R_bqx-RJTXBqfDdpNK1_uKRrDC5SKNe7HT73NwF-_cgvnT802aSjHMqwI23pp1Q_a66kse_1zV2-eAodxSoJDMpMEsOByjqc9Y-O3HNwVnKTqAZ4mUpLWOMXmqqYtvYsQryXAeThJeHFXfiZlorW2vcsgJiBdvfpTSk9Qzcvvt4PKAD7ArcvKfvc7moeb4VD9gDrjv8qw2ciSw8Px82oBJn-zDlh1tAvxzvxZcAXgociTHkmTKXqKDRhEAIwk5eQu0lal6oHL3Rj7Pozn_GXNuUExxPZ77vJQ_xnZfmVuPV4Q2HNUJIs1dUfHcvoRy7uWAFdBm4s_aqKkb_3fJ5SF-ijluCUd-A0xRJ9wHJvf2G9EnIdjVWBDJLr2tEPQhxRNvRw7RsxsxN5ePfUanWSYnWZQY822zrjJHVpNBN53b5rPq9Lq8TVEkJhEAnnx0GFkEKU6pZRCSDP3WhGzVBUN5ox67Z9UgVQS6VcY_DWfF2l1UwMqQieI4t-VDILTFcsAeUExsZkgjOvodowTiIJfWew8U4sZ8olOu0voX46WgfNKlGNdHKU1Mwve3cT6FnJe2PHRLKnNyPuheUBjuCSh61.caaO2JMufWItGmMouQRLBFnz_bYF4u_A74D0cYXVTKc";
        var decryptKeyBase64 = "f67AJnd+CPT6dNObhQtGeGC0LzcHLaYUmjDYmHhxBWx1sMUoLqpxMHYXGKa7fO5sW+7wlsGbeOYiu1T4oue/5Q==";

        var jwkey = new Jwk(Convert.FromBase64String(decryptKeyBase64));

        var decryptValue = JWT.Decode(encryptString, jwkey, JweAlgorithm.RSA_OAEP_256, JweEncryption.A256CBC_HS512);

        Console.WriteLine($"Decrypted string :: {decryptValue}");

    }

[dvsekhvalnov]

THank, i'll take a look shortly. Sorry end of year, always super busy.

[dvsekhvalnov]

Hey @Sathyaenn , took a look.
In your test, both DecryptMethod2() and DecryptString() attempting to decode RSA_OAEP_256 encrypted token but providing Jwk of Oct type:

// this line constructs Jwk from byte[] array, it will be of type Octet key, used for symmetric encryption
new Jwk(Convert.FromBase64String(decryptKeyBase64));

but RSA_OAEP_256 expects key of RSA type.

Typically you would have something like:

CngKey privateKey = CngKey.Open("decryptionKeyId", CngProvider.MicrosoftSoftwareKeyStorageProvider, CngKeyOpenOptions.MachineKey));

string json = Jose.JWT.Decode(token,privateKey);

// or if you prefer JWK
Jwk rsaKey = new Jwk(
    e: "AQAB",
    n: "qFZv0pea_jn5Mo4qEUmStuhlulso8n1inXbEotd_zTrQp9K0RK0hf7t0K4BjKVhaiqIam4tVVQvkmYeBeYr1MmnO_0N97dMBz_7fmvyv0hgHaBdQ5mR5u3LTlHo8tjRE7-GzZmGs6jMcyj7HbXobDPQJZpqNy6JjliDVXxW8nWJDetxGBlqmTj1E1fr2RCsZLreDOPSDIedG1upz9RraShsIDzeefOcKibcAaKeeVI3rkAU8_mOauLSXv37hlk0h6sStJb3qZQXyOUkVkjXIkhvNu_ve0v7LiLT4G_OxYGzpOQcCnimKdojzNP6GtVDaMPh-QkSJE32UCos9R3wI2Q",
    p: "0qaOkT174vRG3E_67gU3lgOgoT6L3pVHuu7wfrIEoxycPa5_mZVG54SgvQUofGUYEGjR0lavUAjClw9tOzcODHX8RAxkuDntAFntBxgRM-IzAy8QzeRl_cbhgVjBTAhBcxg-3VySv5GdxFyrQaIo8Oy_PPI1L4EFKZHmicBd3ts",
    q: "zJPqCDKqaJH9TAGfzt6b4aNt9fpirEcdpAF1bCedFfQmUZM0LG3rMtOAIhjEXgADt5GB8ZNK3BQl8BJyMmKs57oKmbVcODERCtPqjECXXsxH-az9nzxatPvcb7imFW8OlWslwr4IIRKdEjzEYs4syQJz7k2ktqOpYI5_UfYnw1s",
    d: "lJhwb0pKlB2ivyDFO6thajotClrMA3nxIiSkIUbvVr-TToFtha36gyF6w6e6YNXQXs4HhMRy1_b-nRQDk8G4_f5urd_q-pOn5u4KfmqN3Xw-lYD3ddi9qF0NLeTVUNVFASeP0FFqbPYfdNwD-LyvwjhtT_ggMOAw3mYvU5cBfz6-3uPdhl3CwQFCTgwOud_BA9p2MPMUHG82wMK_sNO1I0TYpjm7TnwNBwiKbMf-i5CKnuohgoYrEDYLeMg3f32eBljlCFNYaoCtT-mr1Ze0OTJND04vbfLotV-BBKulIpbOOSeVpKG7gJxZHmv7in7PE5_WzaxKFVoHW3wR6v_GzQ",
    dp: "KTWmTGmf092AA1euOmRQ5IsfIIxQ5qGDn-FgsRh4acSOGE8L7WrTrTU4EOJyciuA0qz-50xIDbs4_j5pWx1BJVTrnhBin9vNLrVo9mtR6jmFS0ko226kOUpwEVLgtdQjobWLjtiuaMW-_Iw4gKWNptxZ6T1lBD8UWHaPiEFW2-M",
    dq: "Jn0lqMkvemENEMG1eUw0c601wPOMoPD4SKTlnKWPTlQS6YISbNF5UKSuFLwoJa9HA8BifDrD-Mfpo1M1HPmnoilEWUrfwMqqdCkOlbiJQhKY8AZ16QGH50kDXhmVVa8BRWdVQWBTUzWXS5kXMaeskVzextTgymPcOAhXN-ph7MU",
    qi: "sRAPigJpl8S_vsf1zhJTrHM97xRwuB26R6Tm-J8sKRPb7p5xxNlmOBBFvWmWxdto8dBElNlydSZan373yBLxzW-bZgVp-B2RKT1B3WhTYW_Vo5DLhWi84XMncJxH7avtxtF9yksaeKe0e2n3J6TTan53mDg4KF8U0OEO2ciqO9g"
);

Jose.JWT.Decode(token,rsaKey);

May be i misunderstood what you initially tried to do, but that's the thing with your unit tests.