It's not possible to determine $public_key_or_secret by the 'kid' header value. about jose-php HOT 2 CLOSED

Ah, I missed the email notification about this issue.
(I'm getting too much "[jose]" prefixed emails from IETF JOSE ML these days :p)

And now I exactly understood what you needed.
As I understand, the callback for "kid" is not enough. (eg. for whom needs "crit" value)

Let me keep this issue open.
I'll make "parse without decrypt" option later.

from jose-php.

Hi, I just opened a pull request which enable JOSE_JWE::decode($input) without decrypting.
I also removed callback support in JOSE_JWE::decrypt($private_key_or_secret), since it shouldn't needed anymore.

Now what you need is

$jwe = JOSE_JWE::decode($input)

# Check alg, kid, crit etc by yourself here.

$jwe->decrypt($key);

from jose-php.