JWS and JWE

The Corppass Authorization API leverages JSON Web Signature (JWS) and JSON Web Encryption (JWE) to secure data integrity, authenticity, and confidentiality during token exchanges.

JSON Web Signature (JWS)

JWS ensures the integrity and authenticity of a payload by digitally signing it. A JWS consists of three components, each base64url-encoded and concatenated with periods (.):

1. Header: Contains metadata such as the signing algorithm (alg) and key identifier (kid).

2. Payload: Contains the data or claims to be signed.

3. Signature: A cryptographic signature ensuring the payload and header have not been tampered with.

JWS Structure Example

<Header>.<Payload>.<Signature>

JWS Header Example

{ 
  "alg": "ES256", 
  "kid": "d591e152-886e-46cc-aa70-36a4431162a6", 
  "typ": "JWT" 
}

JSON Web Encryption (JWE)

JWE secures the confidentiality of data by encrypting it. A JWE consists of five base64url-encoded parts, separated by periods (.):

1. Protected Header: Contains metadata about the encryption algorithm (alg) and encryption key.

2. Encrypted Key: The key used to encrypt the payload.

3. Initialisation Vector (IV): Ensures randomness in encryption.

4. Cipher Text: The encrypted payload.

5. Authentication Tag: Ensures integrity of the encrypted data.

JWE Structure Example

<Protected Header>.<Encrypted Key>.<IV>.<Ciphertext>.<Authentication Tag>

JWE Header Example

{ 
  "alg": "ECDH-ES+A256KW", 
  "kid": "nxiJJNNVxxnTkU2wL65TI2PkILIJOURSTQSABLuH2kE", 
  "enc": "A256CBC-HS512", 
  "typ": "JWT" 
}