JSON Web Algorithms (JWA) is an IETF registry standard that assigns consistent string identifiers to cryptographic algorithms. Standardized names let applications built by different teams select compatible algorithms instead of guessing whether names such as “AES-128-GCM” and “AES-GCM-128” mean the same thing. section 11.2
JWA covers digital signatures, message authentication codes, key management, and encryption. IANA maintains the registry, which can grow as new algorithm names are registered. section 11.2
JWA identifiers also connect the standards in the JOSE suite:
- JWK represents secret, public, and private keys as JSON objects and uses JWA identifiers. section 11.1
- JWS uses JWA algorithm names to protect data from tampering, but its payload remains readable. section 11.1 section 11.4.1
- JWE uses JWA and JWK to represent data that requires both tamper protection and confidentiality. section 11.1
Reading JWA identifiers
“A256GCM” means AES with a 256-bit key in Galois/Counter mode. “A192CBC-HS512” combines AES with a 192-bit cipher-block-chaining mode and an HMAC based on SHA-512. “ES384” identifies ECDSA using the NIST P-384 curve and SHA-384. In a JWS header, "alg": "HS256" selects HMAC with SHA-256. section 11.2 section 11.4.1
Figure 11.1 Relationships between the standards that are part of the JOSE suite. JOSE enables interoperability between applications that want to exchange encrypted or signed data using the JSON data format. JOSE standards are used extensively by popular security protocols such as OIDC for single sign-on.
Use the JOSE standards relationship diagram to see how JWA identifiers support keys, signed data, and encrypted data across interoperable JSON-based security protocols. section 11.1
