If I sign-then-encrypt a JWT, how does a 3rd party validate that the JWE message is valid?

Archimedes Trajano

8/25/23, 11:27 PM

Since it is preferred to sign-then-encrypt I was wondering how can another party validate that the message is valid?

The use case I had was the following...

Client authenticates and gets the access token, the access token is a signed JWT from authorization server
Client verifies that the JWT is signed by a key that the client recognizes
Client sends requests with the JWT passed on the header as Bearer token.
when server receives the request, it does a quick check to see if JWT is signed by a key that the resource server recognizes.

Now I want to change that so that the client doesn't need to see the content.

Client authenticates and gets the access token, the access token is JWE from authorization server. Encrypted with public key of resource server.
IS THIS POSSIBLE? Client verifies that the JWE is signed by a key that the client recognizes
Client sends requests with the JWE passed on the header as Bearer token.
IS THIS POSSIBLE? Resource Server verifies that the JWE is signed by a key that the resource server recognizes
Resource server decrypts the JWE to get the JWT claims.

Given the use case above, it makes more sense to encrypt-then-sign, or sign-encrypt-then-sign.

0 + 0

encryption

jwt

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: If I sign-then-encrypt a JWT, how does a 3rd party validate that the JWE message is valid?

TH: หากฉันลงชื่อแล้วเข้ารหัส JWT บุคคลที่สามจะตรวจสอบว่าข้อความ JWE นั้นถูกต้องได้อย่างไร

RO: Dacă semnez, apoi criptez un JWT, cum validează o terță parte că mesajul JWE este valid?

RU: Если я подпишу, а затем зашифрую JWT, как третья сторона подтвердит правильность сообщения JWE?

VI: Nếu tôi đăng nhập rồi mã hóa JWT, làm cách nào để bên thứ ba xác thực rằng thông báo JWE hợp lệ?

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.