Signing is not hiding
04Integrity and confidentiality solve different problems; nesting can combine them.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 11.2 ↗
RFC 7519 · § 11.2EXAMPLE
4 / 4
04
Encrypt the signed token.
The outer encryption protects the inner signed token.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
A signed payload can remain readable.
- A JWS protects integrity through a signature or MAC, depending on its algorithm.
- A JWE protects the plaintext through encryption and authenticated integrity.
- For combined signing and encryption, this RFC normally recommends signing first and then encrypting.
The examples simplify the wire representation. Follow the linked specification and application profile for implementation.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy