The JSON Web Encryption RFC 7516 says:
Encrypt the CEK with the recipient's public key using the RSAES-PKCS1-v1_5 [or RSAES-OAEP] algorithm to produce the JWE Encrypted Key.
Assuming a client/server architecture here where the server generates JWE tokens, does this mean that the client must initiate the JWA creation process by creating a public/private key pair and sending the public key to the server? This seems unusual as the general rule of thumb is that the private key encrypts while the public key decrypts?
Can someone help me understand the basic flow for JWA with Key Agreement & Key Wrapping?
