Tag: JWE
-
Signed, encrypted, or both? Choosing what a JWT should be
A signed token proves who wrote it. An encrypted token hides what it says. They answer different questions, and the answer is not always “both”.
-
AES-GCM, and the one thing you must never do with it
Galois Counter Mode gives you encryption and authentication in one pass. Reuse a nonce once and you lose both, permanently.
-
Wrapping a key is not the same as encrypting it
AES Key Wrap exists because encrypting a key has requirements that encrypting a message does not. RFC 3394 and RFC 5649, in practice.
-
Understanding JSON Web Tokens: encrypting with JWE
Encryption hides the payload from everyone but its recipient. Five parts instead of three, two keys instead of one, and a vocabulary worth learning once.
-
AEAD without the tag: a ChaCha20-Poly1305 story
The authentication tag was computed, then dropped. What remained looked like an AEAD and authenticated nothing. GHSA-6vvh-pxr4-25r7.
-
One number, one denial of service: PBES2 and p2c
A password-based algorithm lets the token say how many iterations to run. Nothing said it had to be a reasonable number. GHSA-3prj-6hqw-cm82.
-
A padding oracle in RSA1_5, and what constant-time rejection means
Distinguishing a bad padding from a good one is enough to decrypt without the key. Bleichenbacher, twenty-seven years later, and the fix that looks like doing nothing.