Nested tokens need every check
03An outer encrypted token does not excuse skipping the inner signature verification.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 3.3 ↗
RFC 8725 · § 3.3EXAMPLE
3 / 3
03
Invalid inner signature
Reject even when the outer encrypted envelope was valid.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Validate every applicable cryptographic operation.
- Validate every applicable cryptographic operation.
- If any required operation fails, reject the token.
- Only the plaintext resulting from successful validation becomes eligible for application checks.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy