JOSE

JOSE is the IETF family of standards - JWS, JWE, JWK, JWA - for signing and encrypting data in JSON format.

JOSE (JSON Object Signing and Encryption) is the umbrella name the IETF gave to a group of related standards for protecting data written in JSON, rather than in older binary formats such as CMS (Cryptographic Message Syntax). The IETF's JOSE working group was chartered to develop a secure object format based on JSON, to simplify adding object-based security to applications that already work with JSON. JOSE is not itself one specification: it is the family name, and each member of the family covers one job - signing, encrypting or describing keys and algorithms.

Four specifications sit under the JOSE name:

• JSON Web Signature (JWS): protects integrity and authenticity - it proves data has not been altered and shows who signed it.
• JSON Web Encryption (JWE): protects confidentiality - it hides the payload so only the intended recipient can read it.
• JSON Web Key (JWK): represents a cryptographic key itself - public or private, RSA or elliptic curve - as a JSON object, so keys can be published or exchanged in the same format as everything else.
• JSON Web Algorithms (JWA): names the cryptographic algorithms that JWS and JWE are allowed to use, and how their identifiers appear in a header.

JSON Web Token (JWT) is built on top of this set rather than being part of it: a JWT is a set of claims carried inside a JWS or JWE container. That combination is what actually shows up in OAuth 2.0 access tokens and OpenID Connect ID tokens, and it is also the base that wallet-oriented formats such as SD-JWT build further on.

Note: JOSE is often used loosely as if it were a single format you could point to. It never issues a certificate or a signature by itself - what a system actually implements is JWS, JWE, JWK or JWA, each with its own header, algorithm list and encoding rules.