4. Cryptographic Algorithms for Key Management

JWE uses cryptographic algorithms to encrypt or determine the Content Encryption Key (CEK).

4.1 "alg" Header Parameter Values for JWE

Key management algorithms supported by JWE (summary):

Algorithm ID	Key Management Algorithm	Additional Header Params	Implementation Requirements
RSA1_5	RSAES-PKCS1-v1_5	-	Recommended-
RSA-OAEP	RSAES OAEP (default parameters)	-	Recommended+
RSA-OAEP-256	RSAES OAEP (SHA-256)	-	Optional
A128KW / A192KW / A256KW	AES Key Wrap	-	Recommended
dir	Direct use of shared symmetric key	-	Recommended
ECDH-ES	ECDH key agreement	epk, apu, apv	Recommended+
ECDH-ES+A128KW/A192KW/A256KW	ECDH + AES Key Wrap	epk, apu, apv	Recommended/Optional
A128GCMKW / A192GCMKW / A256GCMKW	AES GCM Key Wrap	iv, tag	Optional
PBES2-HS256/384/512+A128/192/256KW	Password-based key encryption	p2s, p2c	Optional

Notes:

• "+" indicates the requirement may be strengthened in future versions
• "-" indicates the requirement may be weakened in future versions
• All algorithms except "dir" and "ECDH-ES" generate a JWE Encrypted Key

4.2-4.8 Algorithm Detailed Descriptions

4.2 RSA Key Encryption (RSAES-PKCS1-v1_5)

• Algorithm ID: RSA1_5
• Minimum key size: 2048 bits

4.3 RSA-OAEP Key Encryption

• RSA-OAEP: Uses SHA-1 and MGF1
• RSA-OAEP-256: Uses SHA-256 and MGF1
• Minimum key size: 2048 bits

4.4 AES Key Wrap

• A128KW: 128-bit key
• A192KW: 192-bit key
• A256KW: 256-bit key
• Uses AES Key Wrap algorithm defined in RFC 3394

4.5 Direct Encryption (dir)

• Directly uses a pre-shared symmetric key as the CEK
• Does not produce a JWE Encrypted Key

4.6 ECDH-ES Key Agreement

• Uses Elliptic Curve Diffie-Hellman Ephemeral Static key agreement
• Additional header parameters:
  • epk (Ephemeral Public Key): Ephemeral public key
  • apu (Agreement PartyUInfo): Party U information
  • apv (Agreement PartyVInfo): Party V information
• Uses Concat KDF for key derivation

4.7 AES GCM Key Encryption

• Uses AES GCM algorithm for key wrapping
• Additional header parameters:
  • iv (Initialization Vector): Initialization vector
  • tag (Authentication Tag): Authentication tag

4.8 PBES2 Password-Based Key Encryption

• Uses PBES2 (Password-Based Encryption Scheme 2)
• Combines HMAC-SHA2 and AES Key Wrap
• Additional header parameters:
  • p2s (PBES2 Salt Input): Salt input
  • p2c (PBES2 Count): Iteration count

---

Implementation Recommendations:

• Prefer using ECDH-ES and RSA-OAEP
• Avoid algorithms with known weaknesses (such as RSA1_5)
• Choose key sizes appropriate for your application

---