jwe: fix A*GCMKW to check the key iv/tag rather than content

This was an oversight in the initial implementation -- originally I did
not have the separate iv/keyiv, and when I added keyiv, forgot to update
the checks.

jwe/decrypt.go

@@ -224,11 +224,11 @@ func (d *Decrypter) decryptSymmetricKey(recipientKey, cek []byte) ([]byte, error
 		if pdebug.Enabled {
 			pdebug.Printf("cek len = %d", len(cek))
 		}
-		if len(d.iv) != 12 {
-			return nil, errors.Errorf("GCM requires 96-bit iv, got %d", len(d.iv)*8)
+		if len(d.keyiv) != 12 {
+			return nil, errors.Errorf("GCM requires 96-bit iv, got %d", len(d.keyiv)*8)
 		}
-		if len(d.tag) != 16 {
-			return nil, errors.Errorf("GCM requires 128-bit tag, got %d", len(d.tag)*8)
+		if len(d.keytag) != 16 {
+			return nil, errors.Errorf("GCM requires 128-bit tag, got %d", len(d.keytag)*8)
 		}
 		block, err := aes.NewCipher(cek)
 		if err != nil {

jwx_test.go

@@ -179,9 +179,9 @@ func TestJoseCompatibility(t *testing.T) {
 			{jwa.A256KW, jwa.A256GCM},
 			{jwa.A256KW, jwa.A256CBC_HS512},
 			{jwa.A128GCMKW, jwa.A128GCM},
-			// {jwa.A128GCMKW, jwa.A128CBC_HS256},
+			{jwa.A128GCMKW, jwa.A128CBC_HS256},
 			{jwa.A256GCMKW, jwa.A256GCM},
-			// {jwa.A256GCMKW, jwa.A256CBC_HS512},
+			{jwa.A256GCMKW, jwa.A256CBC_HS512},
 			{jwa.PBES2_HS256_A128KW, jwa.A128GCM},
 			{jwa.PBES2_HS256_A128KW, jwa.A128CBC_HS256},
 			{jwa.PBES2_HS512_A256KW, jwa.A256GCM},