JSON Web Algorithms

JSON Web Algorithms
Name	JSON Web Algorithms
Abbreviation	JWA
Status	Published
Organization	IETF
Related	JSON Web Signature, JSON Web Encryption, JSON Web Key

JSON Web Algorithms

JSON Web Algorithms are a set of standardized cryptographic algorithm identifiers and parameter conventions used with JSON-based security specifications. They define how cryptographic operations are named, parameterized, and negotiated for use with formats such as JSON Web Signature, JSON Web Encryption, and JSON Web Key. The definitions are maintained to enable consistent implementation across software libraries, platforms, and protocols developed by standards bodies and companies.

Overview

JSON Web Algorithms provides a registry of algorithm identifiers and associated parameters that are referenced by specifications like JSON Web Signature, JSON Web Encryption, and JSON Web Key. Implementers in projects such as OpenSSL, Mozilla, Microsoft, and Google rely on the registry alongside guidelines from the Internet Engineering Task Force and working groups. The registry supports interoperability between libraries such as BoringSSL, LibreSSL, and platform runtimes including Node.js and Java, and is often cited in deployments involving Amazon Web Services, Microsoft Azure, and Google Cloud.

Algorithm Families

The specification groups identifiers into algorithm families for symmetric, asymmetric, and key management purposes. Symmetric message authentication algorithms include HMAC variants associated with names that map to hash functions standardized by organizations like NIST and IETF working groups. Asymmetric signature families incorporate RSA, ECDSA, and newer schemes with parameters influenced by standards from ISO and bodies that produced the Elliptic Curve Digital Signature Algorithm used in protocols such as TLS and SSH. Key management and encryption families cover RSA-OAEP, AES key wrap modes, and Authenticated Encryption with Associated Data modes like AES-GCM, which are referenced in implementations by vendors such as Cisco, Juniper, and F5 Networks.

Registered Identifiers and Parameters

The registry enumerates short string identifiers that represent algorithms and additional parameters such as curve names, key templates, and content encryption modes. Curve names in the registry reference elliptic curves standardized by standards organizations including NIST and SECG, and implemented in libraries such as OpenSSL, BoringSSL, and libgcrypt. Hash function identifiers map to functions defined in publications by NIST and by the IETF Hash Function Working Group and are used by products from Intel, ARM, and AMD that provide hardware acceleration. Key operation parameters reference usage constraints that align with practices from certification bodies like FIPS and Common Criteria.

Security Considerations

Security guidance in the specification addresses selection of algorithms and parameters to avoid vulnerabilities documented in advisories from CERT, US-CERT, and vendor security pages for Microsoft, Apple, and Google. The document warns about algorithm agility to mitigate risks from advances reported in research from academic institutions such as MIT, Stanford, and ETH Zurich, and in cryptanalysis published in venues like CRYPTO and EUROCRYPT. Recommendations relate to deprecation timelines that mirror processes used by organizations including NIST, IETF, and ISO, and echo responses to incidents like protocol downgrade attacks discussed in analyses by security firms such as Mandiant and CrowdStrike.

Implementation and Interoperability

Interoperability is supported through test vectors and interoperability events coordinated by standards groups and open source communities including the IETF, OWASP, and the Cloud Native Computing Foundation. Reference implementations exist in libraries such as jose4j, Nimbus JOSE+JWT, Google Tink, and libraries maintained by Apache Software Foundation projects and the Linux Foundation. Platform integrations appear in web servers like Apache HTTP Server and NGINX and in application frameworks including Spring, Express, and Django. Compliance and compatibility testing is carried out by vendors such as Red Hat, IBM, and Oracle to ensure conformance across operating systems like Linux, Windows, and macOS.

Use Cases and Applications

The algorithm identifiers are used in authentication and authorization systems built with OAuth and OpenID Connect, in federated identity deployments at organizations such as Facebook, Twitter, and LinkedIn, and in payment systems compliant with standards promulgated by EMV and PCI Security Standards Council. They are also used in secure messaging products by companies like WhatsApp, Signal Foundation projects, and enterprise platforms from Salesforce and SAP. Cloud-native services across AWS, Azure, and Google Cloud use the conventions for API authentication, service-to-service encryption, and key management workflows that integrate with hardware security modules from vendors such as Thales and Entrust.

History and Standardization

The registry and algorithm definitions were developed in IETF working groups and published as part of a suite of specifications influenced by prior work on XML Signature and CMS from W3C and IETF S/MIME efforts. Key contributions and reviews came from engineers at companies including Microsoft, Google, PayPal, and Amazon, and academic reviewers from institutions such as Carnegie Mellon University and University of Cambridge. Over time, the registry has evolved through IETF revision processes and IANA registries, reflecting deprecation and additions that parallel cryptographic transitions advocated by NIST and other national standards bodies.

Category:Cryptography standards