@Override public JWECryptoParts encrypt(final JWEHeader header, final byte[] clearText) throws JOSEException { // Generate ephemeral EC key pair on the same curve as the consumer's public key KeyPair ephemeralKeyPair = generateEphemeralKeyPair(publicKey.getParams()); ECPublicKey ephemeralPublicKey = (ECPublicKey)ephemeralKeyPair.getPublic(); ECPrivateKey ephemeralPrivateKey = (ECPrivateKey)ephemeralKeyPair.getPrivate(); // Add the ephemeral public EC key to the header JWEHeader updatedHeader = new JWEHeader.Builder(header). ephemeralPublicKey(new ECKey.Builder(getCurve(), ephemeralPublicKey).build()). build(); // Derive 'Z' SecretKey Z = ECDH.deriveSharedSecret( publicKey, ephemeralPrivateKey, getJCAContext().getKeyEncryptionProvider()); return encryptWithZ(updatedHeader, Z, clearText, contentEncryptionKey); }