Is JWE with ECDH-ES protected agaist invalid curve attack?

[mirkojoshua]

Hi,
I use this fantastic lib on my project then, first of all, thanks for your work. I need to add the use of JWE with ECDH-ES into my project, and i read about invalid curve attack on JWE with ECDH-ES. Is this lib protected against this kind of attack?

[panva]

Great question!

Is this lib protected against this kind of attack?

Yes it is. All crypto is done using the runtime native crypto lib (openssl or boringssl in electron) which does not allow to instantiate ec keys that are not on their declared curve.

[mirkojoshua]

Great! Thanks!