RFC 7515 Quiz

Q1: What does a valid JWS cryptographically protect?

Multiple Choice

A. Every JSON member surrounding the JWS object B. The encoded protected header and payload used as the JWS signing input C. The trustworthiness of every claim in the payload

**Explanation:** A: Only the JWS signing input is covered, not arbitrary enclosing data. B: The signature or MAC is computed over the protected-header and payload representation. C: Cryptographic integrity does not decide whether application claims are acceptable.

Q2: Where must a security-relevant JOSE header parameter be placed when its integrity matters?

Multiple Choice

A. In the JWS Protected Header B. Only in the JWS Unprotected Header C. Only in an unsigned outer JSON object

**Explanation:** A: Protected-header bytes are included in the signing input. B: Unprotected header parameters are not integrity protected. C: An outer object is not covered unless the application explicitly includes it in the signed payload.

Q3: What is the role of the JWS "kid" header parameter?

Multiple Choice

A. It proves that the named key belongs to the signer B. It selects the only algorithm a verifier may accept C. It is a hint for identifying the key to use

**Explanation:** A: A key identifier does not establish ownership or trust. B: Algorithm policy and key identification are separate decisions. C: RFC 7515 defines kid as a hint and leaves its structure unspecified.

Q4: A JWS uses an algorithm that verifies mathematically but is disabled by local policy. Should it be accepted?

Multiple Choice

A. Yes, successful cryptographic verification overrides every local algorithm restriction B. No, verification success is insufficient when the algorithm is unacceptable C. Yes, whenever kid is present and resolves to a known verification key

**Explanation:** A: RFC 7515 requires the algorithm to be acceptable to the application. B: A JWS is valid only after both cryptographic validation and application acceptance checks. C: A key hint cannot authorize a disallowed algorithm.

Q5: A protected header contains an extension listed in "crit" that the verifier does not understand. What should happen?

Multiple Choice

A. Reject the JWS B. Ignore only that extension and verify the signature C. Move the extension into the unprotected header

**Explanation:** A: Every parameter named by crit must be understood and processed. B: Ignoring an unknown critical parameter defeats the purpose of crit. C: A verifier cannot rewrite the sender's protected header without invalidating the signing input.

Q6: Which statement distinguishes Compact Serialization from JSON Serialization?

Multiple Choice

A. Compact Serialization supports a per-signature unprotected header B. Compact Serialization carries multiple signatures over one payload C. JSON Serialization can represent unprotected headers and multiple signatures

**Explanation:** A: Compact Serialization has no JWS Unprotected Header. B: Multiple signatures are provided by the general JSON serialization. C: These are capabilities of the JWS JSON serialization rather than the compact form.

Q7: A general JWS JSON object contains three signatures and the application requires two specific signers. What validation rule applies?

Multiple Choice

A. Any one valid signature always satisfies every application B. Validate the two required signers according to the application's rule C. Accept the first signature without checking the others

**Explanation:** A: RFC 7515 requires at least one but permits applications to require particular or multiple signatures. B: The application decides which signature values must validate and can require more than the base minimum. C: Array position does not define the application's signer policy.

Q8: A verifier fetches a JWK Set from a "jku" URL. Which check is still required?

Multiple Choice

A. Use TLS and validate the server identity B. Trust any key whose kid matches C. Disable certificate validation because the JWS has a signature

**Explanation:** A: RFC 7515 requires integrity-protected retrieval and validated TLS server identity. B: Matching a hint does not establish a trusted key source. C: An attacker-controlled key source could provide a matching key and signature.

Q9: What does successful JWS validation not establish by itself for an Agent Card?

Multiple Choice

A. That the signing input matches the signature under the selected key B. That protected header changes would invalidate the signature C. That the signer is authorized for the advertised agent and the card is current

**Explanation:** A: This is the core cryptographic result of successful validation. B: Protected-header content participates in the signing input. C: Authority, issuer binding, audience, and freshness require application-profile rules.

Q10: How should an A2A profile use JWS safely?

Multiple Choice

A. Allow each receiver to infer signed fields and trusted keys independently B. Define the payload, protected headers, algorithms, key trust, and claim validation C. Treat a valid signature as authorization for every endpoint

**Explanation:** A: Independent inference produces incompatible and potentially unsafe acceptance decisions. B: JWS supplies the cryptographic container while the application profile defines acceptance semantics. C: JWS validity does not grant cross-resource authorization.

JWS protection, serialization, and validation boundaries

References

Q1: What does a valid JWS cryptographically protect?

Q2: Where must a security-relevant JOSE header parameter be placed when its integrity matters?

Q3: What is the role of the JWS "kid" header parameter?

Q4: A JWS uses an algorithm that verifies mathematically but is disabled by local policy. Should it be accepted?

Q5: A protected header contains an extension listed in "crit" that the verifier does not understand. What should happen?

Q6: Which statement distinguishes Compact Serialization from JSON Serialization?

Q7: A general JWS JSON object contains three signatures and the application requires two specific signers. What validation rule applies?

Q8: A verifier fetches a JWK Set from a "jku" URL. Which check is still required?

Q9: What does successful JWS validation not establish by itself for an Agent Card?

Q10: How should an A2A profile use JWS safely?