diff --git a/lib/client.js b/lib/client.js
index <HASH>..<HASH> 100644
--- a/lib/client.js
+++ b/lib/client.js
@@ -623,7 +623,7 @@ class Client {
    * @api private
    */
   joseSecret(alg) {
-    if (String(alg).match(/^A(128|192|256)(GCM)?KW$/)) {
+    if (String(alg).match(/^(?:A|PBES2.+)(\d{3})(GCM)?KW$/)) {
       return this.derivedKey(parseInt(RegExp.$1, 10));
     }
fix PBES2 encryption to use derived symmetrical key too