1
$\begingroup$

As far as I know JWE (JSON Web Encryption) supports both integrity and confidentiality. I agree about the confedintiality because only the recepient with a private key can decrypt a message. What about the integrity? Given that the Content encryption key is encrypted using a public key, anyone (who knows the public key) can generate JWE and receipent won’t know for sure whether its coming from the specific sender.

Can a sender somehow sign the JWE using its own private key (note that this another key pair) so that the recipient can verify the integrity?

Improve this question
$\endgroup$
3
  • 1
    $\begingroup$ To answer my question it is possible to nest JWS and JWE which will provide both confidentiality and integrity. $\endgroup$
    – Abzal Serekov
    Commented Nov 26, 2020 at 23:41
  • 1
    $\begingroup$ Beware that signatures can be replaced by other signatures. In other words, an adversary with a trusted key pair can replace the signature or put a signature on another document with impunity. So it is important if you encrypt-then-sign to only trust one key or a limited set of keys... $\endgroup$
    – Maarten Bodewes ♦
    Commented Nov 27, 2020 at 11:59
  • $\begingroup$ @AbzalSerekov You are allowed to answer your own question. And you should, just ensure that you add a reference for it. $\endgroup$
    – Rohit Gupta
    Commented Mar 25, 2023 at 2:52

1 Answer 1

Reset to default
1
$\begingroup$

In short: JWE ensures confidentiality, while Nested JWS (i.e. in JWE) ensures both integrity and confidentiality (the signature is inside the confidential token).

Improve this answer
$\endgroup$
1
  • 1
    $\begingroup$ Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center. $\endgroup$
    – Community Bot
    Commented Jun 28, 2022 at 0:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.