Subject: [jose] Can we do partial encryption/signing of the message payload...?

From: Prabath Siriwardena <[email-masked]>
Date: Sat, 7 Jun 2014 11:38:58 +0530

Going through the JWS specification I found that we can sign different
parts of the JWS header... and kept some unsigned..

Going through the JWE specification I found that we can encrypt the content
encryption key for different recipients using different keys...

Something not clear to me is.. can we sign/encrypt just parts of the JSON
payload ? (this is analogous to the partial encryption/signature in
WS-Security)...

Appreciate a lot your thoughts...

Thanks & Regards,
Prabath

Twitter : @prabath
LinkedIn : http://www.linkedin.com/in/prabathsiriwardena

Mobile : +94 71 809 6732

http://blog.facilelogin.com
http://blog.api-security.org

---

From: Mike Jones <[email-masked]>
Date: Sat, 7 Jun 2014 06:46:13 +0000

The whole payload is signed - the whole plaintext is encrypted.
________________________________
From: Prabath Siriwardena<mailto:[email-masked]>
Sent: ‎6/‎6/‎2014 11:09 PM
To: [email-masked]<mailto:[email-masked]>; Mike Jones<mailto:[email-masked]>
Subject: [jose] Can we do partial encryption/signing of the message payload...?

Going through the JWS specification I found that we can sign different parts of the JWS header... and kept some unsigned..

Going through the JWE specification I found that we can encrypt the content encryption key for different recipients using different keys...

Something not clear to me is.. can we sign/encrypt just parts of the JSON payload ? (this is analogous to the partial encryption/signature in WS-Security)...

Thanks & Regards,
Prabath

Twitter : @prabath

Mobile : +94 71 809 6732

---

From: Prabath Siriwardena <[email-masked]>
Date: Sat, 7 Jun 2014 12:36:16 +0530

Thanks..! That implies JWS/JWE do not support partial patload encryption /
signature..? Any thoughts why it was not considered...?

Thanks & regards,
-Prabath

On Sat, Jun 7, 2014 at 12:16 PM, Mike Jones <[email-masked]>
wrote:

>  ------------------------------
> From: Prabath Siriwardena <[email-masked]>
> To: [email-masked]; Mike Jones <[email-masked]>
>  Going through the JWE specification I found that we can encrypt the
> content encryption key for different recipients using different keys...
>
>  Something not clear to me is.. can we sign/encrypt just parts of the
> JSON payload ? (this is analogous to the partial encryption/signature in
> WS-Security)...
>

-- 
Thanks & Regards,
Prabath

Twitter : @prabath

Mobile : +94 71 809 6732

---

From: Breno de Medeiros <[email-masked]>
Date: Sat, 7 Jun 2014 10:39:51 +0200

Because it adds an incredible amount of complexity.

The solution for partial encryption or signature in JWT is encapsulation.
For instance you could make an encrypted JWT a payload field of a plaintext
JWT.  This leads to much cleaner security semantics, fewer chances of
security bugs and cleaner specifications at a modest cost to efficiency.
On Jun 7, 2014 9:06 AM, "Prabath Siriwardena" <[email-masked]> wrote:

>> Sent: 6/6/2014 11:09 PM
> _______________________________________________
> jose mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/jose
>
>