Stack Overflow
Stack Overflow

Questions tagged [jwe]

JSON Web Encryption (JWE; RFC 7516) represents encrypted content using JSON-based data structures.

JSON Web Encryption (JWE) [RFC7516] represents encrypted content using JSON- based data structures [RFC7159]. The JWE cryptographic mechanisms encrypt and provide integrity protection for an arbitrary sequence of octets.

Two closely related serializations for JWEs are defined. The JWE Compact Serialization is a compact, URL-safe representation intended for space constrained environments such as HTTP Authorization headers and URI query parameters. The JWE JSON Serialization represents JWEs as JSON objects and enables the same content to be encrypted to multiple parties. Both share the same cryptographic underpinnings.

Cryptographic algorithms and identifiers for use with this specification are described in the separate JSON Web Algorithms (JWA) [JWA] specification and IANA registries defined by that specification. Related digital signature and MAC capabilities are described in the separate JSON Web Signature (JWS) [JWS] specification.

Names defined by this specification are short because a core goal is for the resulting representations to be compact.

156 questions
1
vote
0 answers

Wrong AES key length using Crypt::JWT

I'm attempting to generate a JWE with (5 parts) using Crypt::JWT. It's my first foray into perl. Following the example from the documentation: use Crypt::JWT qw(encode_jwt); my $claims = { iss => 'some issuer', cd => 'some cd' } my $jws_token…
user88659
  • 23
  • 3
1
vote
1 answer

How does one decrypt an encrypted Access Token? (OpenIddict 3.x)

OpenIddict, from version 3.x, encrypts access tokens by default, but you can disable this functionality. If the encryption is left re-enabled, is it possible for the client to decrypt the token or how would the client or relying party verify the…
tmccal2
  • 11
  • 3
1
vote
1 answer

How can I overwrite the automatically calculated kid when importing a JWK from PEM

I am trying to create a JWE Token using the node-jose library's createEncrypt method. The problem is, I want to set the kid to a certain value. But when importing the key using the jose.JWK.asKey method, it's automatically calculating the kid and…
GAURAV KUMAR JHA
  • 190
  • 1
  • 11
1
vote
1 answer

How to get token from JWE Encrypt method of Jose Sdk

I am new in C# jose jwt. I have been using JWE.Encrypt() method. AnyJson anyJson = new AnyJson(); anyJson.page = 2; anyJson.filters = new Filters(); anyJson.filters.startDate = DateTime.Now.Date; anyJson.filters.endDate = DateTime.Now.Date; string…
Kryp2 Gemini
  • 11
  • 2
1
vote
2 answers

No Java-Jose-package supports my ECDHES Curve-algorithm

I'm trying set up a JWE encrypted with a given JWK using the ECDH-ES Algorithm and the curve brainpoolP256r1. I would really like to use a Jose package, like Nimbus Jose or jose4j. Unfortunately both don't support the brainpool-curve. I've searched…
Apertif
  • 11
  • 2
1
vote
2 answers

Send JWE, as request body, with Retrofit

I am using Retrofit to send request as encrypted JWT (JWE) to an API. My service interface is: interface APICallService { @Headers("Content-Type: application/jwt") @POST("/v1/api/dp_checkkyc") fun…
Sparsh Dutta
  • 2,450
  • 4
  • 27
  • 54
1
vote
1 answer

Cannot resolve symbol 'encrypt' in nimbus-jose-jwt library

I am trying to generate an encrypted JWT in Android using 'nimbus-jose-jwt' library. But when I call the method 'encrypt()' of library, I get the error 'Cannot resolve symbol 'encrypt', even though the source code of library has the method…
Sparsh Dutta
  • 2,450
  • 4
  • 27
  • 54
1
vote
1 answer

Does encrypting JWSs (Signed JWT) protect from finding the signing key?

One of the pros for using encrypted tokens is privacy - token content can't be read. I was wandering if there are other pros. One specific thought relates to signed token (JWS). Can attacker, having many JSWs, find out the signing key? This is…
AlikElzin-kilaka
  • 34,335
  • 35
  • 194
  • 277
1
vote
1 answer

Migrate from JWT to Identity Server 4 without need to re-login website users after deployment

I have an API service that is currently secured using JWT. I'm going to replace JWT with Identity Server 4 and secure my API with Identity Server 4. I had a custom way of generating JWT tokens (JWE). How can I replace JWT with Identity Server 4…
Milad Rashidi
  • 1,296
  • 4
  • 22
  • 40
1
vote
2 answers

How to use RSA as kty jwk parameter (using jose4j)

I am using jose4j to encrypt a String with JWE, following this documentation https://bitbucket.org/b_c/jose4j/wiki/JWE%20Examples In the example, they used {\"kty\":\"oct\",\"k\":\"Fdh9u8rINxfivbrianbbVT1u232VQBZYKx1HGAGPt2I\"} It works well, but…
Sushi
  • 646
  • 1
  • 13
  • 31
1
vote
1 answer

JWE and the key management modes

Wrapping my head around JWE and the key management modes. The point of JWE is to prevent third parties to see/change the token. Only the token issuer and resource server should be able to use it. (Is this correct?) To encrypt the token's payload, we…
whowhenhow
  • 109
  • 1
  • 8
1
vote
1 answer

I have Modulus and Exponent how to generate JWE for some payload using JavaScript

We have a requirement where we will get modulus from service call to be used for encrypting (JWE) some data at client side Example of modulus, and exponent (cannot be changed formats) { "modulus":…
Kiran
  • 1,145
  • 1
  • 8
  • 22
1
vote
0 answers

JWE nimbus-JOSE authenticity and JavaScript counterpart

I have chanced upon this wonderful library for java nimbus-JOSE for the use of JSON Web Encryption. This library is simple and requires few lines for JWE encryption and decryption like below shows JWE Encryption. EncryptedJWT jwt = new…
Kalainde V
  • 55
  • 1
  • 9
1
vote
0 answers

How to pass claims and expiration time to a JWE?

I am playing with node-jose (https://github.com/cisco/node-jose) and it's not helping much. Should I wrap a JWE in a JWT payload (or the opposite) maybe? This is a sample code I am using to make some tests: const jwe = await…
Victor Ferreira
  • 6,151
  • 13
  • 64
  • 120
1
vote
1 answer

Modify the JwtIssuer ClaimsProvider in the custom policy to achieve the JWE in AD B2C

I am using the AD B2C service for the authentication. AD B2C is generating the signed JWT tokens, but the claims information in the JWT token is exposed to the public. If anyone gets the token they can able to see the claims information. In my case…
Saravana Kumar
  • 3,669
  • 5
  • 15
  • 35
1 2 3
…
10 11