IETF JOSE Working Group

IETF JOSE Working Group
Name	JOSE Working Group
Parent	Internet Engineering Task Force
Status	Completed / Active
Chair	Multiple
Area	Security Area
Charter	JSON Object Signing and Encryption specifications

IETF JOSE Working Group

The IETF JOSE Working Group produced a suite of specifications for representing JSON-based cryptography primitives and data structures used in transport layer security and application layer protocols. The group defined interoperable formats for digital signatures, message authentication codes, and encryption that are widely used across web applications, mobile applications, and cloud computing platforms. Its deliverables influenced implementations in OAuth 2.0, OpenID Connect, SAML, and other identity management and federation systems.

Introduction

The JOSE Working Group within the Internet Engineering Task Force developed standards for JSON-based security objects to support signing, encryption, and key representation across protocols such as OAuth 2.0 and OpenID Connect. Its work intersects with the IETF Security Area and was coordinated alongside efforts from the W3C, OASIS, and various industry consortia. JOSE outputs provide canonical forms and processing rules intended to facilitate interoperability among implementations from vendors including Microsoft, Google, Apple Inc., and Amazon (company).

History and Charter

The charter for the working group originated in response to practical needs identified by authors of RFC 6749 and the broader RESTful API ecosystem, requesting a standardized way to carry cryptographic tokens in JSON format. Charter discussions involved contributors affiliated with organizations such as Mozilla, Facebook, PayPal, and academic institutions including MIT and Stanford University. The working group’s milestones correspond with publication of foundational RFCs and close collaboration with the OAuth Working Group and the JSON WG of the IETF Applications Area. Leadership rotated among engineers from CISCO Systems, RSA Security, and independent authors connected to Internet Society activities.

Work Items and Specifications

Major work items produced canonical specifications for signed and encrypted JSON structures and key representations. Primary deliverables include the specifications that define JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), and JSON Web Algorithms (JWA). These RFCs describe parameter sets, header semantics, and serialization options used by protocols such as SAML 2.0 integrations and JWT token issuance by Identity Providers. The specs address compact serialization for constrained environments like Internet of Things gateways and full JSON serialization for enterprise scenarios. Extensions and related documents include guidance on key discovery, representations for X.509 certificates, and interoperability clarifications requested by implementers from Dropbox, Salesforce, and Stripe.

Implementation and Adoption

Implementations of JOSE specifications exist in multiple programming ecosystems, with libraries provided for JavaScript, Java (programming language), Python (programming language), Go (programming language), Ruby (programming language), and C#. Major identity frameworks such as Keycloak, Auth0, and Okta incorporate JOSE formats for token handling, while cloud providers like Google Cloud Platform, Microsoft Azure, and Amazon Web Services expose JWK endpoints for key management. The formats are used in federated login flows with GitHub, LinkedIn, and Twitter integrations and underpin API authorization in platforms built by Salesforce and Spotify.

Security Considerations

The working group’s documents include detailed security considerations covering algorithm agility, header parameter integrity, and canonicalization pitfalls that affected earlier ad hoc JSON token formats. Recommendations address algorithm downgrade attacks observed in production deployments at companies such as Yahoo! and techniques for mitigating cross-protocol vulnerabilities similar to those studied in OAuth 2.0 Threat Model and Security Considerations. The specs encourage explicit algorithm negotiation to avoid risks documented by researchers at University of California, Berkeley and Imperial College London, and interoperability tests were informed by security advisories from CERT Coordination Center and vendor incident reports.

Interactions with Other IETF Working Groups

JOSE coordinated closely with several IETF efforts: the OAuth Working Group for token profiles and threat modeling, the JSON Web Token (JWT) community for profile definitions, and the TLS Working Group for recommendations about transport-layer key usage. The group also liaised with the IETF Applications Area and the IETF Security Area to align with policies from the Internet Architecture Board and operational guidance from the Operations and Management Area. Cross-community interactions extended to the W3C Web Cryptography API design team, the IETF JSON WG, and the OAuth 2.0 Maintenance Working Group to ensure consistent use of JOSE artifacts across protocols used by Mozilla, Google, Apple Inc., and enterprise adopters.

Category:Internet Engineering Task Force working groups