Authenticated encryption encrypts plaintext into ciphertext while producing an authentication tag. The tag protects both the ciphertext and additional data that remains unencrypted. section 7.2.2
This is useful when data must remain confidential but selected metadata must stay readable. In JWE, the JOSE protected header serves as associated data: the tag validates that neither the ciphertext nor protected header was modified. section 7.2.2
A JWE representation includes:
- A protected JOSE header describing the encryption. section 7.2.2
- An encrypted key, initialization vector, ciphertext, and authentication tag. section 7.2.2
{
"protected":"<the integrity-protected JOSE header>",
"encrypted_key":"<the encrypted key>",
"iv":"<the initialization vector>",
"ciphertext":"<the ciphertext>",
"tag":"<the authentication tag>"
}
Inspect the structured JWE object and identify its protected header, encrypted key, initialization vector, ciphertext, and tag. section 7.2.2
