0

Use of JWS may suffer from flaws when relying on the "alg" attribute as described here: Critical vulnerabilities in JSON Web Token libraries.

The advice is to verify that the signing JWS algorithm is in a list of accepted algorithms. Practically, most JWS libraries have added am "alg" whitelist parameter:

verify(string token, string algorithm, string verificationKey)

They haven't, however, added such a parameter for JWE decryption.

When proceeding with JWE decryption, should I verify after successful decryption that the "alg" and "enc" are in a whitelist of acceptable values? In other words, does JWE decryption suffers the same problems than JWS signature verification?

Improve this question

1 Answer 1

Reset to default
1

Yes.

From JWT BCP:

Libraries MUST enable the caller to specify a supported set of algorithms and MUST NOT use any other algorithms when performing cryptographic operations. The library MUST ensure that the "alg" or "enc" header specifies the same algorithm that is used for the cryptographic operation. Moreover, each key MUST be used with exactly one algorithm, and this MUST be checked when the cryptographic operation is performed.

Improve this answer
4
  • Thnaks, but I'd like to understand what are the security risks: downgrade attack? Or worse like for the JWS ones?
    – Tangui
    Commented Jul 28, 2019 at 8:28
  • Also it says the library must rely on the alg and enc parameters, but what if the JWE is encrypted using a different pair of alg / enc? In JWS one shall no rely on these fields
    – Tangui
    Commented Jul 28, 2019 at 8:29
  • Usoing a library that does not support specifying alg/enc for JWE decryption, I see no other way than checking it after decryption, which contradicts this specification. Are they some specific risks in doing that (side-channel attacks...)?
    – Tangui
    Commented Jul 28, 2019 at 8:31
  • Seems like a recipe for DoS. Just extract the alg and enc headers and check them before calling decrypt (look at the code for your library's decryt function to figure out how).
    – DylanYoung
    Commented Feb 13, 2021 at 20:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .