We're planning on using JSON Web Tokens (JWT) for our authentication server, and I am currently evaluating which encryption approach to take for the JWE token.
There appear to be two options for managing the symmetric encryption key:
- Issuer/recipient pre-share a symmetric key and encrypt all tokens using that; symmetric key is not included in the message.
- Issuer generates a symmetric key per token, then encrypts the token using the recipient's public key and includes it in the message.
It doesn't seem to me that there's any inherent security advantage of either, as long a strong enough algorithms and large enough key sizes are used.
It looks like the main difference is that in the first case the recipient has to trust the issuer not to leak the pre-shared key, whereas in the second case only the recipient has the necessary decryption key. However, given the payload of this JWE token will be a signed JWS token, the recipient also must have a strong trust relationship with the issuer and must trust them not to leak their own private signing key, so this doesn't seem like a big issue.
Given option 1 produces a much smaller token (due to not having an encrypted symmetric key embedded in it) is there a good reason to prefer option 2?