JWE
By the end of this read, readers should be able to explain what is JSON Web Encryption (JWE).
Last updated
By the end of this read, readers should be able to explain what is JSON Web Encryption (JWE).
Last updated
In laymen term, JWE is used to securely sending (secret) information so only the intended recipient can read it. Kind of like a secret message locked in a box and only the person with the right key can open the box to read the message (Basically like every other encryption techniques).
We have learnt so far from the previous git books I had wrote, that JWTs are able to help you in Authentication, they are not stored server side so the tokens must be well protected on the client side when sent to them and received back, so how is this done? JWE provides an additional layer of protection, we know we can easily see the payload of JWTs when they are placed into a JWT decoder either on Burpsuite or online, but what JWE does is that it does an additional encryption on the payload, this way only the intended recipient can decrypt it.
For you to follow along, feel free to copy this JWE and try the steps we write about in this book
Look closer at the token now, notice anything different of it from the original JWT?
The answer is that it has 4 "."
Use ctrl f if you don't believe me
First section: The JWE Protected Header
Second section: The JWE Content Encryption Key
Third section: The JWE Initialization Vector (IV)
Fourth section: The JWE Payload
Fifth section: The JWE Authentication tag
We look closer at the header:
Notice the (typ) header and (cty) header are the same? It is actually not referring to the same thing, the (typ) header refers to this token itself, while the (cty) refers to the information hidden in the encrypted payload. So in this case, it is a nested JWT :)
The method of encryption used by JWE can vary to make it more secured, in this situation, the mode of encryption is actually called Hybrid Encryption. So what it essentially does is it uses symmetric encryption along with asymmetric encryption.
Based on the token example, we see the (enc) header, it states "A256CBC-HS512" which actually translate to symmetric AES-256-CBC using HMAC-SHA-256 for encrypting the content of the payload.
As for the asymmetric encryption you would already have guessed is in the (alg) header. The example uses RSA with OAEP (Optimal Asymmetric Encryption Padding).
Of course these are not the best algorithm, and there exist better algorithms out there.
A Content Encryption Key (CEK) is used to encrypt the JWE payload during the symmetric encryption phase, this key must be different for each token and generated for a single use only, never to be reused.
It is used when encrypting the plain text, this part must be a unique random value, if not used, it will be replaced with an empty section like "xxxxx.xxxxx..xxxxx.xxxxx"
This is the payload section where the symmetric key encrypted content goes through another round of encryption using the Asymmetric key in the example, our example, the encryption would be RSA with OAEP.
This is the final piece to a JWE, it is created during authenticated encryption to allow the verifier to prove integrity of the cipher text and the header. It is created during encryption and used to validate during decryption.
If unused, like the Initialization Vector, it will also be an empty section.
Security: It ensures that only the intended recipient can read the message.
Integrity: The message cannot be altered without detection, since only the server should have the private key.
Confidentiality: Sensitive information stays private.
What are the use cases of JWE? (Name 1)
Should you and can you store sensitive information in JWE?
What are some ways you would implement JWE securely in a E-commerce environment?
https://auth0.com/docs/secure/tokens/access-tokens/json-web-encryption
https://www.scottbrady91.com/jose/json-web-encryption https://jwt.io/
Author 🐱👤
