Questions tagged [jwe]

JWE specifies how to encrypt content and encode associated metadata. It is defined in RFC 7516: JSON Web Encryption (JWE).

Filter by
Sorted by
Tagged with
0
votes
0answers
31 views

Difference between JWE encryption algorithm RSAES-PKCS1-v1_5 and RSAES OAEP [duplicate]

In the specifications of JWE (RFC7516) they specify the values for (asymmetrically) encrypting the symmetric key. In RFC7518 in section 4.1 they list the options, of which two are relevant for my case ...
1
vote
1answer
78 views

Are there any security drawbacks for simply encrypting and MACing my JWS token (JWT)?

This question, while related, doesn't answer the security aspect I have in mind. I understand that signatures make it impossible for the tokens to be modified. But if I want the JWS token content to ...
1
vote
0answers
41 views

Why doesn't the JOSE suite/JWA include ECIES?

The JOSE suite specifics use of RSA-OAEP (for when one party has an RSA key) and ECDH (for when two parties have EC keys) in JWA. Why doesn't it include ECIES? It seems like a way to derive a key ...
3
votes
1answer
1k views

AES 128 GCM - dynamic key with static IV/nonce

I'm working on a project to upgrade an existing system that currently uses RC4 to encrypt a payload with a random session key. The session key is then encrypted with asymmetric public key encryption (...