This is the definitive version of this document. Edits resulting from consultations have been applied.
Conformance
As well as sections marked as non-normative, all authoring guidelines, diagrams, examples, and notes in this specification are non-normative. Everything else in this specification is normative.
The key word MUST in this document
is to be interpreted as described in
BCP 14
[RFC2119] [RFC8174]
when, and only when, it appears in all
capitals, as shown here.
Abstract
This document is part of the Nederlandse API Strategie.
Before reading this document it is advised to gain knowledge of the informative documents, in particular the Architecture.
This ADR Module contains the requirements for ADR REST-API encryption based on JWE.
1. Introduction
This module specifies the use of JWE for HTTP payload encryption.
This module is applicable when there is a need for end to end message payload confidentiality between client application and server application.
In a complex IT landscape the path between client and server can go over several intermediary components/systems in which case end to end confidentiality can be especially relevant. (In this case TLS is terminated in each step on the path and does not protect the http-message in transport fully end to end).
A specific example is when there is confidential data that is processed and routed by an intermediary organization which is not allowed to access the contents of the message.
2. Normative Design Rules
2.1 Summary
Design rules are technical rules, which should be tested automatically.
