JWS 2 (20.01.2023 3M)

Question 1

What parts does JWS consist of?

Answer 1

1. JOSE Header
2. JWS Payload
3. JWS Signature

Question 2

What parts does JOSE Header consist of?

Answer 2

In case of JWS Compact Serializtion JOSE Header = JWS Protected Header. And JWS Unprotected Header is not used at all.

In case of JWS Json Serialization logically JOSE Header is union of members of JWS Protected Header and JWS Unprotected Header. But technically JWS Protected Header and JWS Unprotected Header are stored as separate structures.

Question 3

What is the difference between JWS Unprotected Header and JWS Protected Header? Do all serialization support both headers?

Answer 3

1. The difference is JWS Protected Header is a part of signing data along with JWS Payload. When JWS Unprotected Header is not.
2. No, JWS Unprotected Header is supported only by JWS JSON Serialization.

Question 4

What is JWS signing input?

Answer 4

The input to the digital signature or MAC computation. Its value is ASCII(BASE64URL(UTF8(JWS Protected Header)) || ‘.’ || BASE64URL(JWS Payload))

Question 5

Give JWS Compact Serialization Overview.

Answer 5

In the JWS Compact Serialization, no JWS Unprotected Header is used. In this case, the JOSE Header and the JWS Protected Header are the same.

In the JWS Compact Serialization, a JWS is represented as the concatenation:

BASE64URL(UTF8(JWS Protected Header)) || ‘.’ ||
BASE64URL(JWS Payload) || ‘.’ ||
BASE64URL(JWS Signature)

Question 6

Give JWS JSON Serialization Overview. Tell about JOSE Header, about representation and representation members.

Answer 6

In the JWS JSON Serialization, one or both of the JWS Protected Header and JWS Unprotected Header MUST be present. In this case, the members of the JOSE Header are the union (logically) of the members of the JWS Protected Header and the JWS Unprotected Header values that are present.

In the JWS JSON Serialization, a JWS is represented as a JSON object
containing some or all of these four members:

1. “protected”, with the value BASE64URL(UTF8(JWS Protected Header))
2. “header”, with the value JWS Unprotected Header
3. “payload”, with the value BASE64URL(JWS Payload)
4. “signature”, with the value BASE64URL(JWS Signature)

Notice that “header” is only one not BASE64URL value and it is JSON object.
The example above is flattened JSON Serialization, which may be used only to convey a single signrature.

But you can use multiple signatures then members will be:
1. “payload”, with the value BASE64URL(JWS Payload)
2. “signatures” array of objects with members:
2.1 “protected”, with the value BASE64URL(UTF8(JWS Protected Header))
2.2 “header”, with the value JWS Unprotected Header
2.3 “signature”, with the value BASE64URL(JWS Signature)

As you can see there is a JOSE Header for every signature

Question 7

Must JWS Payload be JSON value?

Answer 7

JWS Payload can be any sequence of octets that need not be a representation of a JSON object.