def spec_compliant_encrypt(claims, jwk, add_header=None, alg='RSA-OAEP',
                           enc='A128CBC-HS256', rng=get_random_bytes):
    """ Encrypts the given claims and produces a :class:`~jose.JWE`

    :param claims: A `dict` representing the claims for this
                   :class:`~jose.JWE`.
    :param jwk: A `dict` representing the JWK to be used for encryption of
                the CEK. This parameter is algorithm-specific.
    :param add_header: Additional items to be added to the header. Additional
                       headers *will* be authenticated.
    :param alg: The algorithm to use for CEK encryption
    :param enc: The algorithm to use for claims encryption
    :param rng: Random number generator. A string of random bytes is expected
                as output.
    : param compression: The compression algorithm to use. Currently supports
                `'DEF'`.
    :rtype: :class:`~jose.JWE`
    :raises: :class:`~jose.Error` if there is an error producing the JWE
    """
    # We need 5 components for JWE token
    # 1. Generate header
    header = dict((add_header or {}).items() + [(HEADER_ENC, enc),
                                                (HEADER_ALG, alg)])
    protected_header = json_encode(header)

    # 2. Generate CEK
    mac_key, enc_key = _generate_encryption_keys(enc, rng)
    encrypted_key = _encrypt_key(mac_key + enc_key, jwk, alg)

    # 3. Generate Initialization Vector
    iv = _generate_iv(enc, rng)

    # 4. Generate payload
    plaintext = json_encode(claims)
    # Compress if needed
    if HEADER_ZIP in header:
        try:
            (compression_func, _) = COMPRESSION[header[HEADER_ZIP]]
        except __HOLE__:
            raise Error(
                'Unsupported compression algorithm: {}'.format(header[HEADER_ZIP]))
        M = compression_func(plaintext)
    else:
        M = plaintext

    # Encrypt payload
    ((cipher, _), key_len), _ = JWA[enc]
    ciphertext = cipher(M, enc_key, iv)

    # 5. Generate authentication tag
    authentication_tag = _generate_authentication_tag(
        mac_key, protected_header, ciphertext, iv, enc
    )

    return JWE(
        *map(
            b64encode_url,
            (protected_header, encrypted_key, iv, ciphertext,
             authentication_tag)
        )
    )
dataset/ETHPy150Open Demonware/jose/jose.py/spec_compliant_encrypt