Update: [JSON_Web_Token_Cheat_Sheet] Token Infirmation DisclosureUpdate: [JSON_Web_Token_Cheat_Sheet]

[randomstuff]

What is missing or needs to be updated?

The Token Disclosure section of the JWT cheat sheet mentions encryption of the JWT with AEAD.

The example encrypts the raw token using AES-GCM.

Several things are somewhat weird / not clear:

• it is not clear is we are talking about encryption during transmission on the token or at rest encryption;
• it is not talking about using en encrypted JWT (JWE).

Aead aead = AeadFactory.getPrimitive(keysetHandle);
byte[] cipheredToken = aead.encrypt(jwt.getBytes(), null);
return DatatypeConverter.printHexBinary(cipheredToken);

The implementation might be OK for at-rest encryption (but is not specific to JWTs).

The implementation is weird if we are talking about transferring the JWT. In this case, we expect to use a JWE.

How should this be resolved?

I would probably remove this section nearly entirely and mention using encrypted JWE (JWE) in this case.

[shishir-cyber]

Hi @randomstuff , I would like to work on this if it gets acknowledged. Given my prior work on the same cheat sheet (#2242, #2258), I'm familiar with the file and the conventions. My plan would be to remove the current Token Ciphering implementation section and replace it with a concise note explaining the at-rest vs in-transit distinction and pointing to JWE (RFC 7516) as the standard approach for JWT confidentiality during transmission.

[randomstuff]

I @shishir-cyber, actually I have started working on a PR which deals with that and other things. I'll let you know if that does not land 😄