The JSON Web Encryption (JWE) standard defines a number of encryption modes with the same basic form:
- First, the a unique content encryption key (CEK) is generated and used to encrypt the payload with associated data in an AEAD mode (e.g. AES-CBC with HMAC or AES-GCM). If a separate block cipher and MAC are used then the individual keys for each are concatenated to form the CEK.
- Then, the CEK is encrypted with the public key of the recipient (e.g. using RSA with PKCS#1 v1.5 padding) and the result is prepended to the ciphertext.
My question is: while the underlying symmetric cipher provides authenticated encryption, the recipient must decrypt the CEK before they can verify the MAC on the underlying AEAD construction. Does RSA with appropriate padding when used just for key wrapping already provide authenticated encryption?