@@ -152,21 +152,42 @@ var config = JweConfigBuilder.AJweEncryptionConfig()
152152
153153###### Supported Encryption Algorithms
154154
155- The library supports the following JWE encryption algorithms:
155+ The library supports the following JWE encryption algorithms according to [ RFC 7516 ] ( https://datatracker.ietf.org/doc/html/rfc7516 ) :
156156
157- ** AES-GCM (Galois/Counter Mode ):**
157+ ** Key Encryption Algorithms ( ` alg ` header ):**
158158
159- - ` A128GCM ` - AES-128 with GCM mode
160- - ` A192GCM ` - AES-192 with GCM mode
161- - ` A256GCM ` - AES-256 with GCM mode (default)
159+ | Algorithm | Description | Key Size |
160+ | -----------| -------------| ----------|
161+ | ` RSA-OAEP ` | RSAES using Optimal Asymmetric Encryption Padding (OAEP) with SHA-1 and MGF1 | 2048+ bits |
162+ | ` RSA-OAEP-256 ` | RSAES-OAEP using SHA-256 and MGF1 with SHA-256 | 2048+ bits |
162163
163- ** AES-CBC with HMAC (Cipher Block Chaining with HMAC authentication ):**
164+ ** Content Encryption Algorithms ( ` enc ` header ):**
164165
165- - ` A128CBC-HS256 ` - AES-128-CBC with HMAC-SHA256
166- - ` A192CBC-HS384 ` - AES-192-CBC with HMAC-SHA384
167- - ` A256CBC-HS512 ` - AES-256-CBC with HMAC-SHA512
166+ | Algorithm | Description | Key Size | Authentication |
167+ | -----------| -------------| ----------| ----------------|
168+ | ` A128GCM ` | AES-128 with Galois/Counter Mode | 128 bits | Built-in |
169+ | ` A192GCM ` | AES-192 with Galois/Counter Mode | 192 bits | Built-in |
170+ | ` A256GCM ` | AES-256 with Galois/Counter Mode (default) | 256 bits | Built-in |
171+ | ` A128CBC-HS256 ` | AES-128-CBC with HMAC-SHA256 | 256 bits (128+128) | HMAC-SHA256 |
172+ | ` A192CBC-HS384 ` | AES-192-CBC with HMAC-SHA384 | 384 bits (192+192) | HMAC-SHA384 |
173+ | ` A256CBC-HS512 ` | AES-256-CBC with HMAC-SHA512 | 512 bits (256+256) | HMAC-SHA512 |
168174
169- The encryption algorithm is determined by the ` enc ` header parameter in the JWE header.
175+ ** Algorithm Selection:**
176+
177+ The encryption algorithm is determined by the ` enc ` parameter in the JWE header. For example:
178+
179+ ``` json
180+ {
181+ "alg" : " RSA-OAEP-256" ,
182+ "enc" : " A256GCM" ,
183+ "kid" : " 761b003c1eade3a5490e5000d37887baa5e6ec0e226c07706e599451fc032a79"
184+ }
185+ ```
186+
187+ ** GCM vs CBC-HMAC:**
188+
189+ - ** AES-GCM (Recommended):** Provides both encryption and authentication in a single operation. Default choice for new implementations.
190+ - ** AES-CBC-HMAC:** Provides encryption via CBC mode and authentication via HMAC. Requires two separate operations and proper HMAC verification configuration.
170191
171192###### Configuring CBC-HMAC Verification
172193
0 commit comments