title: Validating issuer of a security token encrypted with JSON Web Encryption (JWE)?
body: <p>I've been reading the JSON Web Encryption (JWE) specification, with the <a href="https://datatracker.ietf.org/doc/html/draft-ietf-jose-json-web-encryption-08" rel="nofollow noreferrer">latest draft being 08</a>, as we're looking at supporting JSON Web Tokens (JWT) in our authentication server.</p>
  <p>Using the asymmetric encryption method it defines, the symmetric key (content master key) is encrypted using the recipients public key. This makes sense so that only the recipient can decrypt it and also be sure that the token was intended for them.</p>
  <p>Normally I'd also expect to also see something that proves who the token is <em>from</em>, e.g. a signature created using the issuer's private key which can be verified using their public key. However, the signatures also appear to be derived from either the content master key or the recipient's public key, with no mention of the issuer's private key.</p>
  <p>Without this, it seems to me like - as long as the format of token that was expected was known - anybody who has the recipient's public key (i.e. anybody) could generate a valid token; not just a trusted authentication server.</p>
  <p>I'm not an expert on cryptography (far from it) so I'm sure I'm missing something here. How does the recipient verify that an asymmetrically encrypted token has come from a trusted issuer?</p>
  <p>Given that the JSON Web Signatures (JWS) specification <em>does</em> define signatures that use the issuer's private key and can be validated with their public key, I'm wondering whether the idea is that the payload of the JWE token should be a JWS token?</p>