~/moritzsamrock_

JSON Web Encryption

Also known as:JWE

JSON Web Encryption: Standard format for encrypted and integrity-protected JSON-based messages. Secure implementation depends in particular on suitable algorithms, correct key management, verified implementationsImplementationThe practical realization of a security design, requirement, or control in a system or process., and a controlled chain of trust.

How it works and where it fits

The security of JSON Web Encryption comes from the combination of algorithm, parameters, keys, protocol, and implementation. A mathematically strong primitive can be defeated by an unsuitable mode, weak randomness, incorrect certificate validation, or exposed keys. The intended objective must therefore be explicit: confidentiality, integrity, authenticity, or non-repudiation.

Practical security relevance

In practice, key and certificate management is often more decisive than algorithm choice alone. Generation, storage, distribution, rotation, revocation, and destruction require defined controls and monitoring. Compatible parameters, maintained libraries, migration capability, and a response process for compromised keys are also necessary; proprietary cryptographic constructions should be avoided.

  • JSON Web TokenJSON Web TokenCompact, signable token for transmitting identity and authorization information.: Compact, signable token for transmitting identity and authorization information.
  • EncryptionEncryptionConverts plaintext into unreadable ciphertext using a key.: Converts plaintext into unreadable ciphertext using a key.
  • OAuth 2.0OAuth 2.0Standard for delegated authorization without sharing the user's password.: Standard for delegated authorization without sharing the user’s password.
  • OpenID ConnectOpenID ConnectProtocol for federated login and the transmission of verified identity information.: Protocol for federated login and the transmission of verified identity information.

Related terms