All about Security Tokens

(xTniUDNbjkfsoipfaf ) !!!!

Hello Everyone , hope you are doing good , today’s blog covers about security perspective of tokens .

Security is something you can’t compromise at any pont of time especially in today’s world where technology is reaching heights , its getting more difficult to maintain security and integrity of data .

Specially your finances and bank credentials are some of the very important things that once stolen can create a havoc for you , most companies dealing with financial sectors have different approaches for security and data integrity but the one technology that always stays a strong one is JWT ; JSON Web Tokens.

Client server architecture is one of the most renowed archhitecture of all times , so let’s stick to this architecture to undertsand things in detail. Inorder to maintain integrity security of communication between both parties is must . JWT has 2 major functionalities

1) JWS ; Json web Signature

2) JWE ; Json Web Encryption

(I) JWS

Json Web Signature is an encryption pattern where you encrypt your data along with specific signature .JWS Consist of 3 parts ;

1.Header

2.Payload

3.Signature

Header contains the metadata about the payload and signature , it could be the algorithm you use or key id

Payload is the actual data which also consist if timestamp details and other custom details as well

Signature is usually a sum up of ‘Header’ and ‘Payload’ ehich are further hashed using some renowed algorithms , so whenever any changes are made in the Header/Payload section the signature will fail

Encryption Algorithm ( base64UrlEncode(Header) + “.” + base64UrlEncode(payload) )

(II) JWE

Json Web Encryption is used to encrypt the payload and consist of 5 sections

Header ; Header consist of various subparts of which

1. Header

2. Encrypted Key

3. Initialization vector

4. Cipher text

5. Tag

Header

alg(RSA-OAEP) : Algorithm which is used to Encrypt Content Encryption key .

enc(A128CBC-HS256) : Algorithm used to encrypt the payload to produce cipher text and authentication tag

Encrypted Key

The Content Encrypted Key is encrypted using intended user/recipient's key , the result produced is stored in a byte array .

To encrypt the CEK both “alg” & “enc” are required.

Initialization Vector

Initialization vector is 24 Bit field which is used typically to avoid encryption of same text , to maintain unique value. If your symmetric encryption algo doesn’t need it , you can simply keep an empty octet sequence .

Cipher Text

consist of (Payload + Initialization vector) encrpyted using encryption algorithm and CEK(Content Encryption key)

Tag

This tag is created for validation and is created during Encryption . If your symmetric algorithm doesn’t use this the octet can be kept empty .

(III) What is Difference between JWS & JWE ?

JWS(json Web Service) is nothing but a JWT(json web token) which consist of header , payload and signature , but anyone can decrypt the payload , causing leakage of any sensitive data if payload is carrying . That just means anyone can decrypt your payload and retrieve the sensitive information , so JWS being such secure has this loophole . To overcome this there is JWE(Json web enyption) which basically encrypts your payload and the only intended recipent can read it , thus security of sensitive information is maintained .

🌸Stay tuned for more such content , in next blog we will see how we can use security with AWS Cloud . Don’t forget to leave a clap if this helped you !🌸Rashi Chaubal .