JSON 웹 암호화
JSON Web EncryptionJSON Web Encryption(JWE)은 JSON과 Base64를 기반으로 암호화된 데이터의 교환을 위한 표준화된 구문을 제공하는 IETF 표준이다.[1]에 의해 정의된다. RFC7516.JSON Web Signature(JWS)와 함께 JWT(JSON Web Token)의 가능한 두 가지 형식 중 하나이다.JWE는 JAJ(JavaScript Object Signing and Encryption) 프로토콜 제품군의 일부를 형성한다.[2]
취약성
2017년 3월, JWE의 많은 인기 있는 구현에서 심각한 결함이 발견되었다.[3]
JWE의 초기 버전(사전 완성)의 구현도 블레센바허의 공격에 시달렸다.[4]
참조
- ^ Ng, Alex Chi Keung (26 January 2018). Contemporary Identity and Access Management Architectures: Emerging Research and Opportunities. IGI Global. p. 215. ISBN 978-1-5225-4829-4.
JWE is a means of representing encrypted content using JSON data structures.
- ^ Fontana, John (January 21, 2013). "Developers getting JSON-based options for enterprise authentication ZDNet". ZDNet. Retrieved 2018-06-08.
- ^ Rashid, Fahmida (27 March 2017). "Critical flaw alert! Stop using JSON encryption". InfoWorld. Retrieved 8 June 2018.
- ^ Jager, Tibor; Schinzel, Sebastian; Somorovsky, Juraj (2012), "Bleichenbacher's Attack Strikes again: Breaking PKCS#1 v1.5 in XML Encryption", Computer Security – ESORICS 2012, Springer Berlin Heidelberg, pp. 752–769, CiteSeerX 10.1.1.696.5641, doi:10.1007/978-3-642-33167-1_43, ISBN 9783642331664,
Beyond XML Encryption, the recent JSON Web Encryption (JWE) specification prescribes PKCS#1 v1.5 as a mandatory cipher. This specification is under development and at the time of writing there existed only one implementation following this specification. We verified that this implementation was vulnerable to two versions of the Bleichenbacher’s attack: the direct attack based on error messages and the timing-based attack.
