RFC 7515

Q: What does the Introduction section cover in RFC 7515 — JWS?

The Introduction section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 7515 — JWS. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the JWS Serializations section cover in RFC 7515 — JWS?

The JWS Serializations section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 7515 — JWS. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the JWS Header Parameters section cover in RFC 7515 — JWS?

The JWS Header Parameters section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 7515 — JWS. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Signature Algorithms for 5G section cover in RFC 7515 — JWS?

The Signature Algorithms for 5G section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 7515 — JWS. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Security Considerations section cover in RFC 7515 — JWS?

The Security Considerations section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 7515 — JWS. This content is part of the BLACKLABS RFC Reference Library.

BLACKLABS

JSON Web Signature (JWS)

Standards Track

May 2015

Abstract: JWS represents content secured with digital signatures or MACs using JSON-based data structures. It is the integrity protection mechanism for JWT access tokens in 5G SBA and for HTTP message signing on SBI interfaces.

Canonical source: https://www.rfc-editor.org/rfc/rfc7515 | IETF Datatracker

1. Introduction

▶

JWS provides a standard for digitally signing or MAC-protecting arbitrary content using JSON. It is the signature layer used by JWT and is fundamental to the JOSE (JSON Object Signing and Encryption) framework.

In 5G, JWS secures NRF-issued access tokens (signed JWTs) and is used in SEPP N32-f message protection for application-layer signing of forwarded SBI messages.

2. JWS Serializations

▶

Serialization	Format	5G Usage
Compact	BASE64URL(Header).BASE64URL(Payload).BASE64URL(Signature)	JWT access tokens (Authorization header)
JSON (Flattened)	JSON object with protected, payload, signature fields	N32-f message protection
JSON (General)	JSON object with signatures array for multiple signers	Rare — multi-party scenarios

3. JWS Header Parameters

▶

Parameter	Type	Description
alg	String	Signature algorithm (MUST) — e.g., ES256, RS256
kid	String	Key ID for key lookup from JWK Set
x5c	Array	X.509 certificate chain for key discovery
x5t#S256	String	SHA-256 thumbprint of the signing certificate
typ	String	Media type — 'JWT' for access tokens
cty	String	Content type of the payload

4. Signature Algorithms for 5G

▶

Algorithm	JWA Name	Description	5G Profile
ECDSA P-256	ES256	ECDSA with SHA-256	SHOULD (preferred)
ECDSA P-384	ES384	ECDSA with SHA-384	MAY
RSASSA-PKCS1-v1_5	RS256	RSA with SHA-256	MUST support
RSASSA-PSS	PS256	RSA-PSS with SHA-256	SHOULD
HMAC	HS256	Symmetric MAC	NOT for access tokens

5. Security Considerations

▶

MUST reject JWS with 'alg: none' — critical vulnerability if accepted
Key confusion attacks: validate that key type matches algorithm (e.g., don't use RSA key for HMAC)
JWS protects integrity only — payload is NOT encrypted (use JWE for confidentiality)
Algorithm agility: implementations should support algorithm migration without downtime