SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>JSON Web Encryption</title>

</head>

<span id="openzim-page-title" class="mw-page-title-main"><span class="mw-page-title-main">JSON Web Encryption</span></span>

</h1>

</header>

/* start https://en.wikipedia.org/ */

.mw-parser-output .infobox-subbox{padding:0;border:none;margin:-3px;width:auto;min-width:100%;font-size:100%;clear:none;float:none;background-color:transparent}.mw-parser-output .infobox-3cols-child{margin:auto}.mw-parser-output .infobox .navbar{font-size:100%}@media screen{html.skin-theme-clientpref-night .mw-parser-output .infobox-full-data:not(.notheme)>div:not(.notheme)[style]{background:#1f1f23!important;color:#f8f9fa}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .infobox-full-data:not(.notheme)>div:not(.notheme)[style]{background:#1f1f23!important;color:#f8f9fa}}@media(min-width:640px){body.skin--responsive .mw-parser-output .infobox-table{display:table!important}body.skin--responsive .mw-parser-output .infobox-table>caption{display:table-caption!important}body.skin--responsive .mw-parser-output .infobox-table>tbody{display:table-row-group}body.skin--responsive .mw-parser-output .infobox-table th,body.skin--responsive .mw-parser-output .infobox-table td{padding-left:inherit;padding-right:inherit}}

/* end https://en.wikipedia.org/ */

</style><table class="infobox hproduct"><caption class="infobox-title fn">JSON Web Encryption</caption><tbody><tr><td colspan="2" class="infobox-subheader">JSON Web Encryption (JWE)</td></tr><tr><th scope="row" class="infobox-label">Abbreviation</th><td class="infobox-data">JWE</td></tr><tr><th scope="row" class="infobox-label">Status</th><td class="infobox-data">Proposed</td></tr><tr><th scope="row" class="infobox-label">Year started</th><td class="infobox-data">16 January 2012<span style="display: none;"> (<span class="bday dtstart published updated itvstart">2012-01-16</span>)</span></td></tr><tr><th scope="row" class="infobox-label">First published</th><td class="infobox-data">16 January 2012<span style="display: none;"> (<span class="bday dtstart published updated itvstart">2012-01-16</span>)</span></td></tr><tr><th scope="row" class="infobox-label">Latest version</th><td class="infobox-data">May 2015</td></tr><tr><th scope="row" class="infobox-label">Organization</th><td class="infobox-data">IETF</td></tr><tr><th scope="row" class="infobox-label">Series</th><td class="infobox-data"><abbr title="JavaScript Object Signing and Encryption">JOSE</abbr></td></tr><tr><th scope="row" class="infobox-label">Authors</th><td class="infobox-data"><style data-mw-deduplicate="TemplateStyles:r1126788409">

/* start https://en.wikipedia.org/ */

.mw-parser-output .plainlist ol,.mw-parser-output .plainlist ul{line-height:inherit;list-style:none;margin:0;padding:0}.mw-parser-output .plainlist ol li,.mw-parser-output .plainlist ul li{margin-bottom:0}

/* end https://en.wikipedia.org/ */

</style><div class="plainlist">

<ul><li>Michael Jones</li>

<li>Joe Hildebrand</li></ul>

</div></td></tr><tr><th scope="row" class="infobox-label">Domain</th><td class="infobox-data"><a href="Encryption" title="Encryption">Encryption</a>, <a href="Authentication" title="Authentication">authentication</a></td></tr><tr><th scope="row" class="infobox-label">Website</th><td class="infobox-data"><span class="url"><a rel="nofollow" class="external text" href="https://datatracker.ietf.org/doc/html/rfc7516">datatracker<wbr>.ietf<wbr>.org<wbr>/doc<wbr>/html<wbr>/rfc7516</a></span></td></tr></tbody></table>

<p><b>JSON Web Encryption</b> (<b>JWE</b>) is an <a href="IETF" class="mw-redirect" title="IETF">IETF</a> standard providing a standardised syntax for the exchange of encrypted data, based on <a href="JSON" title="JSON">JSON</a> and <a href="Base64" title="Base64">Base64</a>.<sup id="cite_ref-Keung2018_1-0" class="reference"><a href="#cite_note-Keung2018-1"><span class="cite-bracket">[</span>1<span class="cite-bracket">]</span></a></sup> It is defined by <style data-mw-deduplicate="TemplateStyles:r1238218222">

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><a href="RFC_(identifier)" class="mw-redirect" title="RFC (identifier)">RFC</a> <a rel="nofollow" class="external text" href="https://www.rfc-editor.org/rfc/rfc7516">7516</a>. Along with <a href="JSON_Web_Signature" title="JSON Web Signature">JSON Web Signature</a> (JWS), it is one of the two possible formats of a JWT (<a href="JSON_Web_Token" title="JSON Web Token">JSON Web Token</a>). JWE forms part of the JavaScript Object Signing and Encryption (JOSE) suite of protocols.<sup id="cite_ref-2" class="reference"><a href="#cite_note-2"><span class="cite-bracket">[</span>2<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="Vulnerabilities">Vulnerabilities</h2></div>

<p>In March 2017, a serious flaw was discovered in many popular implementations of JWE, the <a href="Elliptic-curve_cryptography#Invalid_curve_attack" title="Elliptic-curve cryptography">invalid curve attack</a>.<sup id="cite_ref-3" class="reference"><a href="#cite_note-3"><span class="cite-bracket">[</span>3<span class="cite-bracket">]</span></a></sup>

</p><p>One implementation of an early (pre-finalised) version of JWE also suffered from <a href="Bleichenbacher%E2%80%99s_attack" class="mw-redirect" title="Bleichenbacher’s attack">Bleichenbacher’s attack</a>.<sup id="cite_ref-4" class="reference"><a href="#cite_note-4"><span class="cite-bracket">[</span>4<span class="cite-bracket">]</span></a></sup>

</p>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

<li id="cite_note-Keung2018-1"><span class="mw-cite-backlink"><b><a href="#cite_ref-Keung2018_1-0">^</a></b></span> <span class="reference-text"><cite id="CITEREFNg,_Alex_Chi_Keung2018" class="citation book cs1">Ng, Alex Chi Keung (26 January 2018). <a rel="nofollow" class="external text" href="https://books.google.com/books?id=ipBFDwAAQBAJ&pg=PA215"><i>Contemporary Identity and Access Management Architectures: Emerging Research and Opportunities</i></a>. IGI Global. p. 215. <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>978-1-5225-4829-4</bdi>. <q>JWE is a means of representing encrypted content using JSON data structures.</q></cite></span>

</li>

<li id="cite_note-2"><span class="mw-cite-backlink"><b><a href="#cite_ref-2">^</a></b></span> <span class="reference-text"><cite id="CITEREFFontana2013" class="citation news cs1">Fontana, John (January 21, 2013). <a rel="nofollow" class="external text" href="https://www.zdnet.com/article/developers-getting-json-based-options-for-enterprise-authentication/">"Developers getting JSON-based options for enterprise authentication"</a>. <i>ZDNet</i><span class="reference-accessdate">. Retrieved <span class="nowrap">2018-06-08</span></span>.</cite></span>

</li>

<li id="cite_note-3"><span class="mw-cite-backlink"><b><a href="#cite_ref-3">^</a></b></span> <span class="reference-text"><cite id="CITEREFRashid2017" class="citation news cs1">Rashid, Fahmida (27 March 2017). <a rel="nofollow" class="external text" href="https://www.infoworld.com/article/3184582/security/critical-flaw-alert-stop-using-json-encryption.html">"Critical flaw alert! Stop using JSON encryption"</a>. <i>InfoWorld</i><span class="reference-accessdate">. Retrieved <span class="nowrap">8 June</span> 2018</span>.</cite></span>

</li>

<li id="cite_note-4"><span class="mw-cite-backlink"><b><a href="#cite_ref-4">^</a></b></span> <span class="reference-text"><cite id="CITEREFJagerSchinzelSomorovsky2012" class="citation cs2">Jager, Tibor; Schinzel, Sebastian; Somorovsky, Juraj (2012), "Bleichenbacher's Attack Strikes again: Breaking PKCS#1 v1.5 in XML Encryption", <i>Computer Security – ESORICS 2012</i>, Springer Berlin Heidelberg, pp. <span class="nowrap">752–</span>769, <a href="CiteSeerX_(identifier)" class="mw-redirect" title="CiteSeerX (identifier)">CiteSeerX</a> <span class="id-lock-free" title="Freely accessible"><a rel="nofollow" class="external text" href="https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.696.5641">10.1.1.696.5641</a></span>, <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1007%2F978-3-642-33167-1_43">10.1007/978-3-642-33167-1_43</a>, <a href="ISBN_(identifier)" class="mw-redirect" title="ISBN (identifier)">ISBN</a> <bdi>9783642331664</bdi>, <q>Beyond XML Encryption, the recent JSON Web Encryption (JWE) specification prescribes PKCS#1 v1.5 as a mandatory cipher. This specification is under development and at the time of writing there existed only one implementation following this specification. We verified that this implementation was vulnerable to two versions of the Bleichenbacher's attack: the direct attack based on error messages and the timing-based attack.</q></cite></span>

</li>

</ol></div></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .asbox{position:relative;overflow:hidden}.mw-parser-output .asbox table{background:transparent}.mw-parser-output .asbox p{margin:0}.mw-parser-output .asbox p+p{margin-top:0.25em}.mw-parser-output .asbox-body{font-style:italic}.mw-parser-output .asbox-note{font-size:smaller}.mw-parser-output .asbox .navbar{position:absolute;top:-0.75em;right:1em;display:none}.mw-parser-output :not(p):not(.asbox)+style+.asbox,.mw-parser-output :not(p):not(.asbox)+link+.asbox{margin-top:3em}

/* end https://en.wikipedia.org/ */

</style>

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbox{box-sizing:border-box;border:1px solid #a2a9b1;width:100%;clear:both;font-size:88%;text-align:center;padding:1px;margin:1em auto 0}.mw-parser-output .navbox .navbox{margin-top:0}.mw-parser-output .navbox+.navbox,.mw-parser-output .navbox+.navbox-styles+.navbox{margin-top:-1px}.mw-parser-output .navbox-inner,.mw-parser-output .navbox-subgroup{width:100%}.mw-parser-output .navbox-group,.mw-parser-output .navbox-title,.mw-parser-output .navbox-abovebelow{padding:0.25em 1em;line-height:1.5em;text-align:center}.mw-parser-output .navbox-group{white-space:nowrap;text-align:right}.mw-parser-output .navbox,.mw-parser-output .navbox-subgroup{background-color:#fdfdfd}.mw-parser-output .navbox-list{line-height:1.5em;border-color:#fdfdfd}.mw-parser-output .navbox-list-with-group{text-align:left;border-left-width:2px;border-left-style:solid}.mw-parser-output tr+tr>.navbox-abovebelow,.mw-parser-output tr+tr>.navbox-group,.mw-parser-output tr+tr>.navbox-image,.mw-parser-output tr+tr>.navbox-list{border-top:2px solid #fdfdfd}.mw-parser-output .navbox-title{background-color:#ccf}.mw-parser-output .navbox-abovebelow,.mw-parser-output .navbox-group,.mw-parser-output .navbox-subgroup .navbox-title{background-color:#ddf}.mw-parser-output .navbox-subgroup .navbox-group,.mw-parser-output .navbox-subgroup .navbox-abovebelow{background-color:#e6e6ff}.mw-parser-output .navbox-even{background-color:#f7f7f7}.mw-parser-output .navbox-odd{background-color:transparent}.mw-parser-output .navbox .hlist td dl,.mw-parser-output .navbox .hlist td ol,.mw-parser-output .navbox .hlist td ul,.mw-parser-output .navbox td.hlist dl,.mw-parser-output .navbox td.hlist ol,.mw-parser-output .navbox td.hlist ul{padding:0.125em 0}.mw-parser-output .navbox .navbar{display:block;font-size:100%}.mw-parser-output .navbox-title .navbar{float:left;text-align:left;margin-right:0.5em}body.skin--responsive .mw-parser-output .navbox-image img{max-width:none!important}@media print{body.ns-0 .mw-parser-output .navbox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style></div><div role="navigation" class="navbox" aria-labelledby="Data_exchange_formats144" style="padding:3px"><table class="nowraplinks mw-collapsible autocollapse navbox-inner" style="border-spacing:0;background:transparent;color:inherit"><tbody><tr><th scope="col" class="navbox-title" colspan="2"><div id="Data_exchange_formats144" style="font-size:114%;margin:0 4em"><a href="Data_exchange" title="Data exchange">Data exchange</a> formats</div></th></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Human-readable_medium_and_data" title="Human-readable medium and data">Human<br>readable</a></th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<li><a href="EDIFACT" title="EDIFACT">EDIFACT</a></li>

<ul>

<li><a href="JSON_Web_Token" title="JSON Web Token">Web Token</a></li>

<li><a href="JSON_Web_Signature" title="JSON Web Signature">Web Signature</a></li></ul></li>

<li><a href="Property_list" title="Property list">Property list</a></li>

<li><a href="Rebol" title="Rebol">Rebol</a></li>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Binary_file" title="Binary file">Binary</a></th><td class="navbox-list-with-group navbox-list navbox-even hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<li><a href="Ascii85" title="Ascii85">Ascii85</a></li>

<li><a href="Bencode" title="Bencode">Bencode</a></li>

<ul><li><a href="UBJSON" title="UBJSON">UBJSON</a></li></ul></li>

<li><a href="Cap'n_Proto" title="Cap'n Proto">Cap'n Proto</a></li>

<li><a href="FlatBuffers" title="FlatBuffers">FlatBuffers</a></li>

<li><a href="MessagePack" title="MessagePack">MessagePack</a></li>

<li><a href="Property_list" title="Property list">Property list</a></li>

<li><a href="Protocol_Buffers" title="Protocol Buffers">Protocol Buffers</a></li>

<li><a href="Apache_Thrift" title="Apache Thrift">Thrift</a></li>

<li><a href="Cyphal" title="Cyphal">Cyphal</a> DSDL</li>

<li><a href="Uuencoding" title="Uuencoding">uuencode</a></li>

</div></td></tr><tr><td class="navbox-abovebelow" colspan="2"><div><a href="Comparison_of_data-serialization_formats" title="Comparison of data-serialization formats">Comparison of data-serialization formats</a></div></td></tr></tbody></table></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-01-15" href="https://en.wikipedia.org/wiki/?title=JSON_Web_Encryption&oldid=1269678025">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>