One document matched: draft-ietf-jose-json-web-encryption-01.xml


<?xml version="1.0" encoding="US-ASCII"?>
<!DOCTYPE rfc SYSTEM "rfc2629.dtd">
<?xml-stylesheet type='text/xsl' href='http://xml.resource.org/authoring/rfc2629.xslt' ?>

<?rfc toc="yes"?>
<?rfc tocompact="yes"?>
<?rfc tocdepth="4"?>
<?rfc tocindent="yes"?>
<?rfc symrefs="yes"?>
<?rfc sortrefs="yes"?>
<?rfc comments="yes"?>
<?rfc inline="yes"?>
<?rfc compact="yes"?>
<?rfc subcompact="no"?>

<rfc category="std" ipr="trust200902" docName="draft-ietf-jose-json-web-encryption-01">

  <front>
    <title abbrev="JWE">JSON Web Encryption (JWE)</title>

    <author fullname="Michael B. Jones" initials="M.B." surname="Jones">
      <organization>Microsoft</organization>
      <address>
        <email>mbj@microsoft.com</email>
        <uri>http://self-issued.info/</uri>
      </address>
    </author>

    <author fullname="Eric Rescorla" initials="E." surname="Rescorla">
      <organization>RTFM, Inc.</organization>
      <address>
        <email>ekr@rtfm.com</email>
      </address>
    </author>

    <author fullname="Joe Hildebrand" initials="J." surname="Hildebrand">
      <organization>Cisco Systems, Inc.</organization>
      <address>
        <email>jhildebr@cisco.com</email>
      </address>
    </author>

    <date day="12" month="March" year="2012" />

    <area>Security</area>
    <workgroup>JOSE Working Group</workgroup>

    <keyword>RFC</keyword>
    <keyword>Request for Comments</keyword>
    <keyword>I-D</keyword>
    <keyword>Internet-Draft</keyword>
    <keyword>JavaScript Object Notation</keyword>
    <keyword>JSON</keyword>
    <keyword>JSON Web Token</keyword>
    <keyword>JWT</keyword>
    <keyword>JSON Web Signature</keyword>
    <keyword>JWS</keyword>
    <keyword>JSON Web Encryption</keyword>
    <keyword>JWE</keyword>
    <keyword>JSON Web Key</keyword>
    <keyword>JWK</keyword>
    <keyword>JSON Web Algorithms</keyword>
    <keyword>JWA</keyword>

    <abstract>
      <t>
	JSON Web Encryption (JWE) is a means of representing encrypted
	content using JSON data structures.
	Cryptographic algorithms and identifiers used with this
	specification are enumerated in the separate
	JSON Web Algorithms (JWA) specification.
	Related digital signature and HMAC capabilities are described
	in the separate JSON Web Signature (JWS) specification.
      </t>
    </abstract>

    <note title="Requirements Language">
      <t>
	The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
	NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and
	"OPTIONAL" in this document are to be interpreted as described
	in <xref target="RFC2119">RFC 2119</xref>.
      </t>
    </note>
  </front>

  <middle>
    <section title="Introduction">
      <t>
	JSON Web Encryption (JWE) is a compact encryption format
	intended for space constrained environments such as HTTP
	Authorization headers and URI query parameters.  It provides a
	wrapper for encrypted content using JSON <xref
	target="RFC4627">RFC 4627</xref> data structures.  The JWE
	encryption mechanisms are independent of the type of content
	being encrypted.
	Cryptographic algorithms and identifiers used with this
	specification are enumerated in the separate
	JSON Web Algorithms (JWA) <xref target="JWA" /> specification.
	Related digital signature and HMAC capabilities are described
	in the separate JSON Web Signature (JWS) <xref target="JWS" />
	specification.
      </t>
    </section>

    <section title="Terminology">
      <t>
	<list style="hanging">

          <t hangText="JSON Web Encryption (JWE)">
	    A data structure representing an encrypted version of a
	    Plaintext.  The structure consists of four parts: the JWE
	    Header, the JWE Encrypted Key, the JWE Ciphertext, and
	    the JWE Integrity Value.
	  </t>

	  <t hangText="Plaintext">
	    The bytes to be encrypted - a.k.a., the message.
	  </t>

	  <t hangText="Ciphertext">
	    The encrypted version of the Plaintext.
	  </t>

	  <t hangText="Content Encryption Key (CEK)">
	    A symmetric key used to encrypt the Plaintext for the
	    recipient to produce the Ciphertext.
	  </t>

	  <t hangText="Content Integrity Key (CIK)">
	    A key used with an HMAC function to ensure the integrity
	    of the Ciphertext and the parameters used to create it.
	  </t>

	  <t hangText="Content Master Key (CMK)">
	    A randomly generated key from which the CEK and CIK are
	    derived, which is encrypted to the recipient as the JWE
	    Encrypted Key.
	  </t>

          <t hangText="JWE Header">
	    A string representing a JSON object that describes the
	    encryption operations applied to create the JWE Encrypted
	    Key and the JWE Ciphertext.
	  </t>
          <t hangText="JWE Encrypted Key">
	    The Content Encryption Key (CEK) is encrypted with the
	    intended recipient's key and the resulting encrypted
	    content is recorded as a byte array, which is referred to
	    as the JWE Encrypted Key.
	  </t>
          <t hangText="JWE Ciphertext">
	    A byte array containing the Ciphertext.
	  </t>
	  <t hangText="JWE Integrity Value">
	    A byte array containing a HMAC value that ensures the
	    integrity of the Ciphertext and the parameters used to
	    create it.
	  </t>

          <t hangText="Encoded JWE Header">
	    Base64url encoding of the bytes of the
	    UTF-8 <xref target="RFC3629">RFC 3629</xref>
	    representation of the JWE Header.
	  </t>
          <t hangText="Encoded JWE Encrypted Key">
	    Base64url encoding of the JWE Encrypted Key.
	  </t>
          <t hangText="Encoded JWE Ciphertext">
	    Base64url encoding of the JWE Ciphertext.
	  </t>
	  <t hangText="Encoded JWE Integrity Value">
	    Base64url encoding of the JWE Integrity Value.
	  </t>

	  <t hangText="Header Parameter Names">
	    The names of the members within the JWE Header.
	  </t>
	  <t hangText="Header Parameter Values">
	    The values of the members within the JWE Header.
	  </t>

	  <t hangText="JWE Compact Serialization">
	    A representation of the JWE as the concatenation of the
	    Encoded JWE Header, the Encoded JWE Encrypted Key, the
	    Encoded JWE Ciphertext, and the Encoded JWE Integrity
	    Value in that order, with the four strings being separated
	    by period ('.') characters.
	  </t>

	  <t hangText="AEAD Algorithm">
	    An Authenticated Encryption with Associated Data (AEAD)
	    <xref target="RFC5116"/> encryption algorithm is one that
	    provides an integrated content integrity check.  AES
	    Galois/Counter Mode (GCM) is one such algorithm.
	  </t>

          <t hangText="Base64url Encoding">
	    For the purposes of this specification, this term always
	    refers to the URL- and filename-safe Base64 encoding
	    described in <xref target="RFC4648">RFC 4648</xref>,
	    Section 5, with the (non URL-safe) '=' padding characters
	    omitted, as permitted by Section 3.2.  (See Appendix B of
	    <xref target="JWS" /> for notes on implementing base64url
	    encoding without padding.)
	  </t>
        </list>
      </t>
    </section>

    <section title="JSON Web Encryption (JWE) Overview">

      <t>
	JWE represents encrypted content using JSON data
	structures and base64url encoding.  The representation
	consists of four parts: the JWE Header, the JWE Encrypted Key,
	the JWE Ciphertext, and the JWE Integrity Value.
	In the Compact Serialization, the four parts are
	base64url-encoded for transmission, and represented
	as the concatenation of the encoded strings in that order,
	with the four strings being separated by period ('.')
	characters.
	(A JSON Serialization for this information is defined in the separate
	JSON Web Encryption JSON Serialization (JWE-JS) <xref target="JWE-JS" />
	specification.)
      </t>
      <t>
	JWE utilizes encryption to ensure the confidentiality of the
	contents of the Plaintext.  JWE adds a content
	integrity check if not provided by the underlying encryption
	algorithm.
      </t>

      <section title="Example JWE with an Integrated Integrity Check" anchor="ExampleAEADJWE">

	<t>
	  The following example JWE Header declares that:
	  <list style="symbols">
	    <t>
	      the Content Master Key is encrypted to the recipient
	      using the RSA-PKCS1_1.5 algorithm to produce the JWE
	      Encrypted Key,
	    </t>
	    <t>
	      the Plaintext is encrypted using the AES-256-GCM
	      algorithm to produce the JWE Ciphertext,
	    </t>
	    <t>
	      the specified 64-bit Initialization Vector with the
	      base64url encoding <spanx
	      style="verb">__79_Pv6-fg</spanx> was used, and
	    </t>
	    <t>
	      a JSON Web Key (JWK) representation of the public key
	      used to encrypt the JWE is located at <spanx
	      style="verb">https://example.com/public_key.jwk</spanx>.
	    </t>
	  </list>
	</t>

	<figure><artwork><![CDATA[{"alg":"RSA1_5",
 "enc":"A256GCM",
 "iv":"__79_Pv6-fg",
 "jku":"https://example.com/public_key.jwk"}]]></artwork></figure>

	<t>
	  Base64url encoding the bytes of the UTF-8 representation of
	  the JWE Header yields this Encoded JWE Header value
	  (with line breaks for display purposes only):
	</t>

	<figure><artwork><![CDATA[eyJhbGciOiJSU0ExXzUiLA0KICJlbmMiOiJBMjU2R0NNIiwNCiAiaXYiOiJfXzc5
X1B2Ni1mZyIsDQogImprdSI6Imh0dHBzOi8vZXhhbXBsZS5jb20vcHVibGljX2tl
eS5qd2sifQ]]></artwork></figure>

	<t>
	  TBD: Finish this example by showing generation of a Content
	  Master Key (CMK), saying that the CMK is used as the CEK
	  and there is no separate integrity check since
	  AES GCM is an AEAD algorithm,
	  using the CEK to encrypt the Plaintext
	  to produce the Ciphertext,
	  using the recipient's key to encrypt the CMK to produce the
	  JWE Encrypted Key, base64url encoding these values,
	  and assembling the result.
	</t>

	<t>
	  Concatenating these parts in the order
	  Header.EncryptedKey.Ciphertext.IntegrityValue with period
	  characters between the parts yields this complete JWE
	  representation (with line breaks for display purposes only):
	</t>

	<figure><artwork><![CDATA[eyJhbGciOiJSU0ExXzUiLA0KICJlbmMiOiJBMjU2R0NNIiwNCiAiaXYiOiJfXzc5
X1B2Ni1mZyIsDQogImprdSI6Imh0dHBzOi8vZXhhbXBsZS5jb20vcHVibGljX2tl
eS5qd2sifQ
.
TBD_encrypted_key_value_TBD
.
TBD_ciphertext_value_TBD
.
]]></artwork></figure>

      </section>

      <section title="Example JWE with a Separate Integrity Check" anchor="ExampleNonAEADJWE">

	<t>
	  The following example JWE Header declares that:
	  <list style="symbols">
	    <t>
	      the Content Master Key is encrypted to the recipient
	      using the RSA-PKCS1_1.5 algorithm to produce the JWE
	      Encrypted Key,
	    </t>
	    <t>
	      the Plaintext is encrypted using the AES-256-CBC
	      algorithm to produce the JWE Ciphertext,
	    </t>
	    <t>
	      the JWE Integrity Value safeguarding the integrity of the
	      Ciphertext and the parameters used to create it was
	      computed with the HMAC SHA-256 algorithm,
	    </t>
	    <t>
	      the specified 64-bit Initialization Vector with the
	      base64url encoding <spanx
	      style="verb">Mz-mW_4JHfg</spanx> was used, and
	    </t>
	    <t>
	      the thumbprint of the X.509 certificate that corresponds
	      to the key used to encrypt the JWE has the base64url
	      encoding <spanx
	      style="verb">7noOPq-hJ1_hCnvWh6IeYI2w9Q0</spanx>.
	    </t>
	  </list>
	</t>

	<figure><artwork><![CDATA[{"alg":"RSA1_5",
 "enc":"A256CBC",
 "int":"HS256",
 "iv":"Mz-mW_4JHfg",
 "x5t":"7noOPq-hJ1_hCnvWh6IeYI2w9Q0"}]]></artwork></figure>

	<t>
	  Because AES CBC is not an AEAD algorithm (and so provides
	  no integrated content integrity check), a separate integrity
	  check value is used.
	</t>

	<t>
	  Base64url encoding the bytes of the UTF-8 representation of
	  the JWE Header yields this Encoded JWE Header value
	  (with line breaks for display purposes only):
	</t>

	<figure><artwork><![CDATA[eyJhbGciOiJSU0ExXzUiLA0KICJlbmMiOiJBMjU2Q0JDIiwNCiAiaW50IjoiSFMy
NTYiLA0KICJpdiI6Ik16LW1XXzRKSGZnIiwNCiAieDV0IjoiN25vT1BxLWhKMV9o
Q252V2g2SWVZSTJ3OVEwIn0]]></artwork></figure>

	<t>
	  TBD: Finish this example by showing generation of a Content
	  Master Key (CMK), showing the derivation of the CEK and the
	  CEK from the CMK, using the CEK to encrypt the Plaintext to
	  produce the Ciphertext, using the recipient's key to encrypt
	  the CMK to produce the JWE Encrypted Key, showing the
	  computation of the JWE Integrity Value, base64url encoding
	  these values, and assembling the result.
	</t>

	<figure><artwork><![CDATA[eyJhbGciOiJSU0ExXzUiLA0KICJlbmMiOiJBMjU2Q0JDIiwNCiAiaW50IjoiSFMy
NTYiLA0KICJpdiI6Ik16LW1XXzRKSGZnIiwNCiAieDV0IjoiN25vT1BxLWhKMV9o
Q252V2g2SWVZSTJ3OVEwIn0
.
TBD_encrypted_key_value_TBD
.
TBD_ciphertext_value_TBD
.
TBD_integrity_value_TBD]]></artwork></figure>

      </section>
    </section>

    <section title="JWE Header">

      <t>
	The members of the JSON object represented by the JWE Header
	describe the encryption applied to the Plaintext and optionally
	additional properties of the JWE.
	The Header Parameter Names within this object MUST be unique.
	Implementations MUST understand the
	entire contents of the header; otherwise, the JWE MUST be
	rejected.
      </t>

      <section title="Reserved Header Parameter Names" anchor="ReservedHeaderParameterName">
	<t>
	  The following header parameter names are reserved.  All the
	  names are short because a core goal of JWE is for the
	  representations to be compact.
	</t>

	<texttable title="Reserved Header Parameter Definitions" anchor="HeaderParameterTable">

	  <ttcol align="left">Header Parameter Name</ttcol>
	  <ttcol align="left">JSON Value Type</ttcol>
	  <ttcol align="left">Header Parameter Syntax</ttcol>
	  <ttcol align="left">Header Parameter Semantics</ttcol>

	  <c>alg</c>
	  <c>string</c>
	  <c>StringOrURI</c>
	  <c>
	    The <spanx style="verb">alg</spanx> (algorithm) header
	    parameter identifies the cryptographic algorithm used to
	    secure the JWE Encrypted Key.  A list of defined encryption
	    <spanx style="verb">alg</spanx> values is presented in
	    Section 4, Table 2 of the
	    JSON Web Algorithms (JWA) <xref target="JWA" /> specification.
	    The processing of the <spanx style="verb">alg</spanx>
	    (algorithm) header parameter requires that the value MUST
	    be one that is both supported and for which there exists a
	    key for use with that algorithm associated with the
	    intended recipient.  The <spanx style="verb">alg</spanx>
	    value is case sensitive.
	    This header parameter is REQUIRED.
	  </c>

	  <c>enc</c>
	  <c>string</c>
	  <c>StringOrURI</c>
	  <c>
	    The <spanx style="verb">enc</spanx> (encryption
	    method) header parameter identifies the symmetric
	    encryption algorithm used to secure the Ciphertext.  A
	    list of defined <spanx style="verb">enc</spanx> values is
	    presented in
	    Section 4, Table 3 of the
	    JSON Web Algorithms (JWA) <xref target="JWA" /> specification.
	    The processing of the <spanx style="verb">enc</spanx>
	    (encryption method) header parameter requires that the
	    value MUST be one that is supported.  The <spanx
	    style="verb">enc</spanx> value is case sensitive.  This
	    header parameter is REQUIRED.
	  </c>

	  <c>int</c>
	  <c>string</c>
	  <c>StringOrURI</c>
	  <c>
	    The <spanx style="verb">int</spanx> (integrity algorithm) header
	    parameter identifies the cryptographic algorithm used to
	    safeguard the integrity of the Ciphertext and the
	    parameters used to create it.
	    The <spanx style="verb">int</spanx> parameter uses the
	    same values as the JWS <spanx style="verb">alg</spanx>
	    parameter; a list of defined JWS <spanx
	    style="verb">alg</spanx> values is presented in Section 3,
	    Table 1 of the JSON Web Algorithms (JWA) <xref
	    target="JWA" /> specification.
	    This header parameter is REQUIRED when an AEAD algorithm
	    is not used to encrypt the Plaintext and MUST NOT be
	    present when an AEAD algorithm is used.
	  </c>

	  <c>iv</c>
	  <c>string</c>
	  <c>String</c>
	  <c>
	    Initialization Vector (<spanx style="verb">iv</spanx>)
	    value for algorithms requiring it, represented as a
	    base64url encoded string.
	    This header parameter is OPTIONAL.
	  </c>

	  <c>epk</c>
	  <c>object</c>
	  <c>JWK Key Object</c>
	  <c>
	    Ephemeral Public Key (<spanx style="verb">epk</spanx>)
	    value created by the originator for the use in ECDH-ES
	    <xref target="RFC6090">RFC 6090</xref>
	    encryption.  This key is represented in the same manner as
	    a JSON Web Key <xref target="JWK" /> JWK Key Object value,
	    containing <spanx style="verb">crv</spanx> (curve), <spanx
	    style="verb">x</spanx>, and <spanx style="verb">y</spanx>
	    members.  The inclusion of the JWK Key Object <spanx
	    style="verb">alg</spanx> (algorithm) member is OPTIONAL.
	    This header parameter is OPTIONAL.
	  </c>

	  <c>zip</c>
	  <c>string</c>
	  <c>String</c>
	  <c>
	    Compression algorithm (<spanx style="verb">zip</spanx>)
	    applied to the Plaintext before encryption, if any.
	    This specification defines the value <spanx
	    style="verb">GZIP</spanx> to refer to the encoding format
	    produced by the file compression program "gzip" (GNU zip)
	    as described in <xref target="RFC1952" />; this format is
	    a Lempel-Ziv coding (LZ77) with a 32 bit CRC.
	    If no <spanx
	    style="verb">zip</spanx> parameter is present, or its
	    value is <spanx style="verb">none</spanx>, no compression
	    is applied to the Plaintext before encryption.  The <spanx
	    style="verb">zip</spanx> value is case sensitive.  This
	    header parameter is OPTIONAL.
	  </c>

	  <c>jku</c>
	  <c>string</c>
	  <c>URL</c>
	  <c>
	    The <spanx style="verb">jku</spanx> (JSON Web Key URL)
	    header parameter is an absolute URL that refers to a
	    resource for a set of JSON-encoded public keys, one of
	    which corresponds to the key that was used to encrypt the
	    JWE.
	    The keys MUST be encoded as described in the JSON Web Key
	    (JWK) <xref target="JWK" /> specification.
	    The protocol used to acquire the resource MUST provide
	    integrity protection.  An HTTP GET request to retrieve the
	    certificate MUST use TLS <xref target="RFC2818">RFC
	    2818</xref> <xref target="RFC5246">RFC 5246</xref> with
	    server authentication <xref target="RFC6125">RFC
	    6125</xref>.
	    This header parameter is OPTIONAL.
	  </c>

	  <c>kid</c>
	  <c>string</c>
	  <c>String</c>
	  <c>
	    The <spanx style="verb">kid</spanx> (key ID) header
	    parameter is a hint indicating which key was used to
	    encrypt the JWE.  This
	    allows originators to explicitly signal a change of key to
	    recipients.  The interpretation of the
	    contents of the <spanx style="verb">kid</spanx> parameter
	    is unspecified.
	    This header parameter is OPTIONAL.
	  </c>

	  <c>jpk</c>
	  <c>object</c>
	  <c>JWK Key Object</c>
	  <c>
	    The <spanx style="verb">jpk</spanx> (JSON Public Key)
	    header parameter is a public key that corresponds to the
	    key that was used to encrypt the JWE.
	    This key is represented in the same manner as a JSON Web
	    Key <xref target="JWK" /> JWK Key Object value.
	    This header parameter is OPTIONAL.
	  </c>

	  <c>x5u</c>
	  <c>string</c>
	  <c>URL</c>
	  <c>
	    The <spanx style="verb">x5u</spanx> (X.509 URL) header
	    parameter is an absolute URL that refers to a resource for
	    the X.509 public key certificate or certificate chain
	    corresponding to the key used to encrypt the JWE.
	    The identified resource MUST provide a representation of
	    the certificate or certificate chain that conforms to
	    <xref target="RFC5280">RFC 5280</xref> in PEM encoded form
	    <xref target="RFC1421">RFC 1421</xref>.
	    The certificate containing the public key of the entity
	    encrypting the JWE MUST be the first certificate.  This
	    MAY be followed by additional certificates, with each
	    subsequent certificate being the one used to certify the
	    previous one.
	    The protocol used to acquire the resource MUST provide
	    integrity protection.  An HTTP GET request to retrieve the
	    certificate MUST use TLS <xref target="RFC2818">RFC
	    2818</xref> <xref target="RFC5246">RFC 5246</xref> with
	    server authentication <xref target="RFC6125">RFC
	    6125</xref>.
	    This header parameter is OPTIONAL.
	  </c>

	  <c>x5t</c>
	  <c>string</c>
	  <c>String</c>
	  <c>
	    The <spanx style="verb">x5t</spanx> (x.509 certificate
	    thumbprint) header parameter provides a base64url encoded
	    SHA-1 thumbprint (a.k.a. digest) of the DER encoding of
	    the X.509 certificate that corresponds to the key that was
	    used to encrypt the JWE.
	    This header parameter is OPTIONAL.
	  </c>

	  <c>x5c</c>
	  <c>array</c>
	  <c>ArrayOfStrings</c>
	  <c>
	    The <spanx style="verb">x5c</spanx> (x.509 certificate
	    chain) header parameter contains the X.509 public key
	    certificate or certificate chain corresponding to the key
	    used to encrypt the JWE.
	    The certificate or certificate chain is represented as an
	    array of certificate values.  Each value is a
	    base64-encoded (not base64url encoded) DER/BER PKIX
	    certificate value.
	    The certificate containing the public key of the entity
	    encrypting the JWE MUST be the first certificate.  This
	    MAY be followed by additional certificates, with each
	    subsequent certificate being the one used to certify the
	    previous one.
	    The recipient MUST verify the certificate chain according
	    to <xref target="RFC5280"/> and reject the JWE if any
	    validation failure occurs.
	    This header parameter is OPTIONAL.
	  </c>

	  <c>typ</c>
	  <c>string</c>
	  <c>String</c>
	  <c>
	    The <spanx style="verb">typ</spanx> (type) header
	    parameter is used to declare the type of the encrypted
	    content.
	    The <spanx style="verb">typ</spanx> value is case sensitive.
	    This header parameter is OPTIONAL.
	  </c>

	</texttable>

	<t>
	  Additional reserved header parameter names MAY be defined
	  via the IANA JSON Web Encryption Header Parameters registry,
	  as per <xref target="IANA" />.  The syntax values used above
	  are defined as follows:
	</t>

	<texttable title="Header Parameter Syntax Definitions" anchor="SyntaxDefinitions">
	  <ttcol align="left">Syntax Name</ttcol>
	  <ttcol align="left">Syntax Definition</ttcol>

	  <c>String</c>
	  <c>
	    Any string value MAY be used.
	  </c>

	  <c>StringOrURI</c>
	  <c>
	    Any string value MAY be used but a value containing a ":"
	    character MUST be a URI as defined in <xref
	    target="RFC3986">RFC 3986</xref>.
	  </c>

	  <c>URL</c>
	  <c>
	    A URL as defined in <xref target="RFC1738">RFC 1738</xref>.
	  </c>

	  <c>ArrayOfStrings</c>
	  <c>
	    An array of string values.
	  </c>

	</texttable>

      </section>

      <section title="Public Header Parameter Names" anchor="PublicHeaderParameterName">

        <t>
	  Additional header parameter names can be defined by those
	  using JWE. However, in order to prevent collisions, any new
	  header parameter name or algorithm value SHOULD either be
	  defined in the IANA JSON Web Encryption Header Parameters
	  registry or be defined as a URI that contains a collision
	  resistant namespace.  In each case, the definer of the name
	  or value needs to take reasonable precautions to make sure they
	  are in control of the part of the namespace they use to
	  define the header parameter name.
	</t>
	<t>
	  New header parameters should be introduced sparingly since
	  an implementation that does not understand a parameter MUST
	  reject the JWE.
	</t>
      </section>

      <section title="Private Header Parameter Names" anchor="PrivateHeaderParameterName">

	<t>
	  A producer and consumer of a JWE may agree to any header
	  parameter name that is not a Reserved Name <xref
	  target="ReservedHeaderParameterName"></xref> or a Public
	  Name <xref
	  target="PublicHeaderParameterName"></xref>. Unlike Public
	  Names, these private names are subject to collision and
	  should be used with caution.
	</t>
	<t>
	  New header parameters should be introduced sparingly, as
	  they can result in non-interoperable JWEs.
	</t>

      </section>
    </section>

    <section anchor="sec.encryption" title="Message Encryption">
      <t>
	The message encryption process is as follows.  The order of
	the steps is not significant in cases where there are no
	dependencies between the inputs and outputs of the steps.
      </t>

      <t><list style="numbers">
	  <t>
	    Generate a random Content Master Key (CMK). The CMK MUST
	    have a length at least equal to that of the larger of the
	    required encryption or integrity keys and MUST be
	    generated randomly.  See <xref target="RFC4086">RFC
	    4086</xref> for considerations on generating random
	    values.
	  </t>
	  <t>
	    Encrypt the CMK for the recipient (see <xref
	    target="sec.encrypt_cmk"/>) and let the result be the
	    JWE Encrypted Key.
	  </t>
	  <t>
	    Base64url encode the JWE Encrypted Key to create the
	    Encoded JWE Encrypted Key.
	  </t>
	  <t>
	    Generate a random Initialization Vector (IV) (if required
	    for the algorithm).
	  </t>
	  <t>
	    If not using an AEAD algorithm, run the key derivation
	    algorithm (see <xref target="sec.key_derivation"/>) to
	    generate the Content Encryption Key (CEK) and the Content
	    Integrity Key (CIK); otherwise (when using an AEAD
	    algorithm), set the CEK to be the CMK.
	  </t>
	  <t>
	    Compress the Plaintext if a <spanx
	    style="verb">zip</spanx> parameter was included.
	  </t>
	  <t>
	    Serialize the (compressed) Plaintext into a bitstring M.
	  </t>
	  <t>
	    Encrypt M using the CEK and IV to form the bitstring C.
	  </t>
	  <t>
	    Base64url encode C to create the Encoded JWE Ciphertext.
	  </t>
	  <t>
	    Create a JWE Header containing the encryption
	    parameters used.
	    Note that white space is explicitly allowed
	    in the representation and no canonicalization need be performed
	    before encoding.
	  </t>
	  <t>
	    Base64url encode the bytes of the UTF-8 representation of
	    the JWE Header to create the Encoded JWE Header.
	  </t>
	  <t>
	    If not using an AEAD algorithm, run the integrity
	    algorithm (see <xref target="sec.integrity"/>) using the
	    CIK to compute the JWE Integrity Value; otherwise (when
	    using an AEAD algorithm), set the JWE Integrity Value to
	    be the empty byte string.
	  </t>
	  <t>
	    Base64url encode the JWE Integrity Value to create the
	    Encoded JWE Integrity Value.
	  </t>
	  <t>
	    The four encoded parts, taken together, are the result.
	    The Compact Serialization of this result is the
	    concatenation of the Encoded JWE Header, the Encoded JWE
	    Encrypted Key, the Encoded JWE Ciphertext, and the Encoded
	    JWE Integrity Value in that order, with the four strings
	    being separated by period ('.') characters.
	  </t>
	</list></t>
    </section>

    <section anchor="sec.decryption" title="Message Decryption">
      <t>
	The message decryption process is the reverse of the
	encryption process.  The order of the steps is not significant
	in cases where there are no dependencies between the inputs
	and outputs of the steps.  If any of these steps fails, the
	JWE MUST be rejected.
      </t>

      <t>
	<list style="numbers">
	  <t>
	    Parse the four parts of the input (which are separated by
	    period characters when using the JWE Compact
	    Serialization) into the Encoded JWE Header, the Encoded
	    JWE Encrypted Key, the Encoded JWE Ciphertext, and the
	    Encoded JWE Integrity Value.
	  </t>
	  <t>
	    The Encoded JWE Header, the Encoded JWE Encrypted Key, the
	    Encoded JWE Ciphertext, and the Encoded JWE Integrity
	    Value MUST be successfully base64url decoded following the
	    restriction that no padding characters have been used.
	  </t>
          <t>
	    The resulting JWE Header MUST be completely valid
	    JSON syntax conforming to <xref target="RFC4627">RFC
	    4627</xref>.
	  </t>
          <t>
	    The resulting JWE Header MUST be validated to only include
	    parameters and values whose syntax and semantics are both
	    understood and supported.
	  </t>
	  <t>
	    Verify that the JWE Header references a key known to the
	    recipient.
	  </t>
	  <t>
	    Decrypt the JWE Encrypted Key to produce the Content
	    Master Key (CMK).
	  </t>
	  <t>
	    If not using an AEAD algorithm, run the key derivation
	    algorithm (see <xref target="sec.key_derivation"/>) to
	    generate the Content Encryption Key (CEK) and the Content
	    Integrity Key (CIK); otherwise (when using an AEAD
	    algorithm), set the CEK to be the CMK.
	  </t>
	  <t>
	    If not using an AEAD algorithm, run the integrity
	    algorithm (see <xref target="sec.integrity"/>) using the
	    CIK to compute an integrity value for the input received.
	    This computed value MUST match the received JWE
	    Integrity Value; otherwise (when using an AEAD algorithm),
	    the received JWE Integrity Value MUST be empty.
	  </t>
	  <t>
	    Decrypt the binary representation of the JWE Ciphertext
	    using the CEK.
	  </t>
	  <t>
	    Remove the Initialization Vector (IV) value from
	    the decrypted result (if an IV was used).
	  </t>
	  <t>
	    Uncompress the result of the previous step, if a <spanx
	    style="verb">zip</spanx> parameter was included.
	  </t>
	  <t>
	    Output the resulting Plaintext.
	  </t>
	</list>
      </t>
    </section>

    <section anchor="sec.key_derivation" title="Key Derivation">
      <t>
	The key derivation process converts the CMK into a CEK and a
	CIK. It assumes as a primitive a Key Derivation Function (KDF)
	which notionally takes three arguments:

	<list style="hanging">
	  <t hangText="MasterKey:">The master key used to compute the
	  individual use keys</t>

	  <t hangText="Label:">The use key label, used to differentiate
	  individual use keys</t>

	  <t hangText="Length:">The length of the desired use key</t>
	</list>

	The only KDF used in this document is the Concat KDF, as
	defined in <xref target="NIST-800-56A" />, where the Digest
	Method is SHA-256, the SuppPubInfo parameter is the Label, and
	the remaining OtherInfo parameters are the empty bit string.
      </t>
      <t>
	To compute the CEK from the CMK, the ASCII label "Encryption"
	is used.
      </t>
      <t>
	To compute the CIK from the CMK, the ASCII label "Integrity"
	is used.
      </t>

      <t>When AEAD algorithms are used the KDF element MUST NOT be
      present. When they are not used, it MUST be present.</t>
    </section>

    <section anchor="sec.encrypt_cmk" title="CMK Encryption">
      <t>
	JWE supports two forms of CMK encryption:
      </t>
      <t>
	<list style="symbols">
	  <t>
	    Asymmetric encryption under the recipient's public key.
	  </t>
	  <t>
	    Symmetric encryption under a shared key.
	  </t>
	</list>
      </t>

      <section anchor="sec.asymmetric_encryption"
	       title="Asymmetric Encryption">
	<t>
	  In the asymmetric encryption mode, the CMK is encrypted
	  under the recipient's public key. The asymmetric encryption
	  modes defined for use with this in this specification are
	  listed in
	  Section 4, Table 2 of the
	  JSON Web Algorithms (JWA) <xref target="JWA" /> specification.
	</t>
      </section>

      <section anchor="sec.symmetric_encryption"
	       title="Symmetric Encryption">
	<t>
	  In the symmetric encryption mode, the CMK is encrypted under
	  a symmetric key shared between the sender and receiver.
	  <!-- All such modes MUST provide integrity for the CMK. -->
	  The symmetric encryption modes defined for use with this in
	  this specification are listed in
	  Section 4, Table 2 of the
	  JSON Web Algorithms (JWA) <xref target="JWA" /> specification.
	  For GCM, the random 64-bit IV is prepended to the ciphertext.
	</t>
      </section>
    </section>

    <section anchor="sec.integrity" title="Integrity Value Calculation">
      <t>
	When a non-AEAD algorithm is used (an algorithm without an
	integrated content check), JWE adds an explicit integrity
	check value to the representation.  This value is computed in
	the manner described in the JSON Web Signature (JWS) <xref
	target="JWS" /> specification, with these modifications:

	<list style="symbols">
	  <t>
	    The algorithm used is taken from the <spanx
	    style="verb">int</spanx> (integrity algorithm) header
	    parameter rather than the <spanx style="verb">alg</spanx>
	    header parameter.
	  </t>
	  <t>
	    The algorithm MUST be an HMAC algorithm
	    (normally HMAC SHA-256).
	  </t>
	  <t>
	    The JWS Secured Input used is the concatenation of the
	    Encoded JWE Header, a period ('.') character, the Encoded
	    JWE Encrypted Key, a period ('.') character, and the
	    Encoded JWE Ciphertext.
	  </t>
	  <t>
	    The CIK is used as the HMAC key.
	  </t>
	</list>

	The computed JWS Signature value is the resulting integrity value.
      </t>
    </section>

    <section title="Encrypting JWEs with Cryptographic Algorithms" anchor="Encrypting">

      <t>
	JWE uses cryptographic algorithms to encrypt the Content
	Encryption Key (CMK) and the Plaintext.  The
	JSON Web Algorithms (JWA) <xref target="JWA" />
	specification enumerates a set of cryptographic algorithms and
	identifiers to be used with this specification.
	Specifically, Section 4, Table 2 enumerates a set of
	<spanx style="verb">alg</spanx> (algorithm) header parameter values
	and Section 4, Table 3 enumerates a set of
	<spanx style="verb">enc</spanx> (encryption method) header parameter values
	intended for use this specification.
	It also describes the semantics and operations that are
	specific to these algorithms and algorithm families.
      </t>
      <t>
	Public keys employed for encryption can be identified using the
	Header Parameter methods described in <xref
	target="ReservedHeaderParameterName" /> or can be distributed
	using methods that are outside the scope of this
	specification.
      </t>

    </section>

    <section title="IANA Considerations" anchor="IANA">
      <t>
	This specification calls for:

        <list style="symbols">

          <t>
	    A new IANA registry entitled "JSON Web Encryption Header
	    Parameters" for reserved header parameter names is defined
	    in <xref target="ReservedHeaderParameterName"></xref>.
	    Inclusion in the registry is RFC Required in the <xref
	    target="RFC5226">RFC 5226</xref> sense for reserved JWE
	    header parameter names that are intended to be
	    interoperable between implementations.  The registry will
	    just record the reserved header parameter name and a
	    pointer to the RFC that defines it. This specification
	    defines inclusion of the header parameter names defined in
	    <xref target="HeaderParameterTable"></xref>.
	  </t>
        </list>
      </t>
    </section>

    <section title="Security Considerations" anchor="Security">
      <t>
	TBD: Lots of work to do here. We need to remember to look into
	any issues relating to security and JSON parsing. One wonders
	just how secure most JSON parsing libraries are. Were they
	ever hardened for security scenarios? If not, what kind of
	holes does that open up? Also, we need to walk through the
	JSON standard and see what kind of issues we have especially
	around comparison of names.  For instance, comparisons of
	header parameter names and other parameters must occur after
	they are unescaped. Need to also put in text about: Importance
	of keeping secrets secret. Rotating keys. Strengths and
	weaknesses of the different algorithms.
      </t>
      <t>
	TBD: Need to put in text about why strict JSON validation is
	necessary.  Basically, that if malformed JSON is received then
	the intent of the sender is impossible to reliably discern.
	One example of malformed JSON that MUST be rejected is
	an object in which the same member name occurs multiple times.
      </t>
      <t>
	TBD: We need a section on generating randomness in browsers
	- it's easy to screw up.
      </t>

      <t>
	When utilizing TLS to retrieve information, the authority
	providing the resource MUST be authenticated and the
	information retrieved MUST be free from modification.
      </t>

      <section title="Unicode Comparison Security Issues">

        <t>
	  Header parameter names in JWEs are Unicode strings.  For
	  security reasons, the representations of these names must be
	  compared verbatim after performing any escape processing (as
	  per <xref target="RFC4627">RFC 4627</xref>, Section 2.5).
	</t>
        <t>
	  This means, for instance, that these JSON strings must
	  compare as being equal ("enc", "\u0065nc"), whereas these
	  must all compare as being not equal to the first set or to
	  each other ("ENC", "Enc", "en\u0043").
	</t>
	<t>
	  JSON strings MAY contain characters outside the Unicode
	  Basic Multilingual Plane.  For instance, the G clef
	  character (U+1D11E) may be represented in a JSON string as
	  "\uD834\uDD1E".  Ideally, JWE implementations SHOULD ensure
	  that characters outside the Basic Multilingual Plane are
	  preserved and compared correctly; alternatively, if this is
	  not possible due to these characters exercising limitations
	  present in the underlying JSON implementation, then input
	  containing them MUST be rejected.
	</t>

      </section>
    </section>

    <section title="Open Issues and Things To Be Done (TBD)" anchor="TBD">

      <t>
	The following items remain to be done in this draft:

	<list style="symbols">

	  <t>
	    EDITORIAL: Give each header parameter definition its own
	    section.  This will let them appear in the index, will
	    give space for examples when needed, and will get rid of
	    the way-too-cramped tables.
	  </t>
	  <t>
	    Consider adding the DEFLATE compression algorithm (which
	    omits the ZLIB header and checksum fields) and so produces
	    smaller results than <spanx style="verb">GZIP</spanx>.
	  </t>
	  <t>
	    Provide a more robust description of the use of the
	    Initialization Vector (IV), including listing which
	    algorithms require an IV.  (This list may belong in the
	    JWA spec.)
	    The current statement "For GCM, the random 64-bit IV is
	    prepended to the ciphertext" in the Symmetric Encryption
	    section is almost certainly out of place and
	    insufficiently general.
	  </t>
	  <t>
	    Finish the Security Considerations section.
	  </t>
	  <t>
	    Consider which of the open issues from the JWS and JWT specs
	    also apply here.
	  </t>
	  <t>
	    Should the JWE Encrypted Key be moved to the header (which
	    would add about 20 bytes to every JWE) or left in a
	    separate period-separated segment to prevent double base64
	    encoding?
	  </t>
	</list>
      </t>
    </section>
  </middle>

  <back>
    <references title="Normative References">
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.1421.xml' ?>
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.1738.xml' ?>
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.1952.xml' ?>
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.2119.xml' ?>
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.2818.xml' ?>
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.3629.xml' ?>
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.3986.xml' ?>
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.4086.xml' ?>
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.4627.xml' ?>
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.4648.xml' ?>
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.5116.xml' ?>
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.5226.xml' ?>
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.5246.xml' ?>
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.5280.xml' ?>
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.6090.xml' ?>
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.6125.xml' ?>

      <reference anchor="NIST-800-38D">
        <front>
          <title>Recommendation for Block Cipher Modes of Operation:
	  Galois/Counter Mode (GCM) and GMAC</title>
          <author>
            <organization>National Institute of Standards and Technology (NIST)
            </organization>
          </author>
          <date month="December" year="2001" />
        </front>
        <seriesInfo name="NIST" value="PUB 800-38D" />
      </reference>

      <reference anchor="NIST-800-56A">
        <front>
          <title>Recommendation for Pair-Wise Key Establishment Schemes Using Discrete Logarithm Cryptography (Revised)</title>
          <author>
            <organization>National Institute of Standards and Technology (NIST)
            </organization>
          </author>
          <date month="March" year="2007" />
        </front>
        <seriesInfo name="NIST" value="PUB 800-56A" />
      </reference>

      <reference anchor="JWS">
        <front>
          <title>JSON Web Signature (JWS)</title>

	  <author fullname="Michael B. Jones" initials="M.B." surname="Jones">
	    <organization>Microsoft</organization>
	    <address>
	      <email>mbj@microsoft.com</email>
	      <uri>http://self-issued.info/</uri>
	    </address>
	  </author>

	  <author fullname="John Bradley" initials="J." surname="Bradley">
	    <organization>independent</organization>
	    <address>
	      <email>ve7jtb@ve7jtb.com</email>
	    </address>
	  </author>

	  <author fullname="Nat Sakimura" initials="N." surname="Sakimura">
	    <organization>Nomura Research Institute</organization>
	    <address>
	      <email>n-sakimura@nri.co.jp</email>
	    </address>
	  </author>

	  <date day="16" month="January" year="2012" />
        </front>
        <format target="http://tools.ietf.org/html/draft-ietf-jose-json-web-signature" type="HTML" />
      </reference>

      <reference anchor="JWK">
        <front>
	  <title>JSON Web Key (JWK)</title>

	  <author fullname="Michael B. Jones" initials="M.B." surname="Jones">
	    <organization>Microsoft</organization>
	    <address>
	      <email>mbj@microsoft.com</email>
	      <uri>http://self-issued.info/</uri>
	    </address>
	  </author>

	  <date day="12" month="March" year="2012" />
        </front>
        <format target="http://tools.ietf.org/html/draft-ietf-jose-json-web-key" type="HTML" />
      </reference>

      <reference anchor="JWA">
        <front>
	  <title>JSON Web Algorithms (JWA)</title>

	  <author fullname="Michael B. Jones" initials="M.B." surname="Jones">
	    <organization>Microsoft</organization>
	    <address>
	      <email>mbj@microsoft.com</email>
	      <uri>http://self-issued.info/</uri>
	    </address>
	  </author>

	  <date day="16" month="January" year="2012" />
        </front>
        <format target="http://tools.ietf.org/html/draft-ietf-jose-json-web-algorithms" type="HTML" />
      </reference>

    </references>

    <references title="Informative References">
      <?rfc include='http://xml.resource.org/public/rfc/bibxml/reference.RFC.5652.xml' ?>
      <?rfc include="http://xml.resource.org/public/rfc/bibxml4/reference.W3C.CR-xmlenc-core1-20110303.xml" ?>
      <?rfc include="http://xml.resource.org/public/rfc/bibxml3/reference.I-D.draft-rescorla-jsms-00.xml" ?>

      <reference anchor="JWE-JS">
        <front>
          <title abbrev="JWE JSON Serialization (JWE-JS)">JSON Web Encryption JSON Serialization (JWE-JS)</title>

	  <author fullname="Michael B. Jones" initials="M.B." surname="Jones">
	    <organization>Microsoft</organization>
	    <address>
	      <email>mbj@microsoft.com</email>
	      <uri>http://self-issued.info/</uri>
	    </address>
	  </author>

	  <date day="12" month="March" year="2012" />
        </front>
        <format target="http://tools.ietf.org/html/draft-jones-json-web-encryption-json-serialization" type="HTML" />
      </reference>

      <reference anchor="JSE">
        <front>
          <title>JSON Simple Encryption</title>

	  <author fullname="John Bradley" initials="J." surname="Bradley">
	    <organization>independent</organization>
	  </author>

	  <author fullname="Nat Sakimura (editor)" initials="N. " surname="Sakimura (editor)">
	    <organization>Nomura Research Institute</organization>
	  </author>

          <date month="September" year="2010" />
        </front>
        <format target="http://jsonenc.info/enc/1.0/" type="HTML" />
      </reference>

    </references>

    <section title="JWE Examples" anchor="JWEExamples">

      <t>
	This section provides several examples of JWEs.
      </t>

      <section title="JWE Example using TBD Algorithm" anchor="TBDExample">
	<section title="Encrypting">
	  <t>
	    TBD: Demonstrate encryption steps with this algorithm
	  </t>
	</section>
	<section title="Decrypting">
	  <t>
	    TBD: Demonstrate decryption steps with this algorithm
	  </t>
	</section>
      </section>

    </section>

    <section title="Acknowledgements" anchor="Acknowledgements">

      <t>
	Solutions for encrypting JSON content were also explored by
	<xref target="JSE">JSON Simple Encryption</xref> and
	<xref target="I-D.rescorla-jsms">JavaScript Message Security
	Format</xref>, both of which significantly influenced this draft.
	This draft attempts to explicitly reuse as many of the relevant concepts from
	<xref target="W3C.CR-xmlenc-core1-20110303">XML Encryption 1.1</xref>
	and <xref target="RFC5652">RFC 5652</xref> as possible,
	while utilizing simple compact JSON-based data structures.
      </t>
      <t>
	Special thanks are due to John Bradley and Nat Sakimura for
	the discussions that helped inform the content of this
	specification and to Eric Rescorla and Joe Hildebrand for
	allowing the reuse of text from <xref
	target="I-D.rescorla-jsms"/> in this document.
      </t>

    </section>

    <section title='Document History'>
      <t>
        -01
        <list style='symbols'>
          <t>
           Added an integrity check for non-AEAD algorithms.
          </t>
	  <t>
	    Added <spanx style="verb">jpk</spanx> and <spanx
	    style="verb">x5c</spanx> header parameters for including
	    JWK public keys and X.509 certificate chains directly in
	    the header.
	  </t>
	  <t>
	    Clarified that this specification is defining the JWE
	    Compact Serialization.  Referenced the new JWE-JS spec,
	    which defines the JWE JSON Serialization.
	  </t>
	  <t>
	    Added text "New header parameters should be introduced
	    sparingly since an implementation that does not understand
	    a parameter MUST reject the JWE".
	  </t>
	  <t>
	    Clarified that the order of the encryption and decryption
	    steps is not significant in cases where there are no
	    dependencies between the inputs and outputs of the steps.
	  </t>
	  <t>
	    Made other editorial improvements suggested by JOSE
	    working group participants.
	  </t>
        </list>
      </t>
      <t>
        -00
        <list style='symbols'>
          <t>
            Created the initial IETF draft based upon
            draft-jones-json-web-encryption-02 with no normative
            changes.
          </t>
	  <t>
	    Changed terminology to no longer call both digital
	    signatures and HMACs "signatures".
	  </t>
        </list>
      </t>
    </section>     

  </back>
</rfc>

PAFTECH AB 2003-20262026-04-22 20:40:57