After reading JSON Web Encryption (JWE) and making a Node JS JWE POC demonstrating key mode using Key Encryption. I'm a bit confused as to how to validate that the sender of the message was in fact, the actual sender (not a man-in-the-middle with access to the public key).

With PGP, public keys are exchanged, and the message is validated against the digital signature. Is it possible to do the same with the JWS and JWE specs? I had a feeling this would somehow be done in the ADD, but doesn't appear to be the case as this is computing the AAD for the purpose of the Auth Tag. Obviously the Public Keys would have to be exchanged for this to work.


With JWS you can use one of the signature schemed supported. Broadly there are three options - HS, RS and PS - HMAC , RSA PKCS 1.5 and RSA PSS respectively.

The payload and protected headers would be signed and the signature would be transmitted. As far as overall security is concerned, be aware of alg:None issues with JWS libraries and the possibility kg replay attacks if exp header isn't included.

  • Thank you for the quick response. I would just like to be clear, you are suggesting we wrap the JWE with a JWS. E.g. ``` JWS: [ JWE: [ Message ] <- encrypted with the Public Key of the Receiver ] <- Signed with the Private Key of the Sender ``` I understand the security risk you raised regarding the attribute alg set to none in the JWS-JOSE. Is there a issue with using RSA-SHA256 as I have done In my example? I can then exchange Public Keys between the two and no need for the cost of a X.509. – Philip A Senger Jan 12 '20 at 21:17
  • 1. Yes you are right about the suggestion. – hax Jan 16 '20 at 13:12
  • 2. alg: None is an issue when the recipient accepts alg: None. The recipient should use libraries which does not fall back to alg:None. – hax Jan 16 '20 at 13:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.