JSON Web Signature (JWS)

Note

IETF specification defining JSON Web Signature (JWS), representing content secured by digital signatures or message authentication codes using JSON structures.

Summary

Purpose

IETF RFC 7515 (May 2015) defines JSON Web Signature (JWS):

The cryptographic algorithms that can be used are described in a separate specification RFC 7515, Abstract. A JWS includes a header (JOSE Header) whose parameters describe the signature and its properties RFC 7515, § 4. JOSE Header. The acts in the corpus that cite it mainly refer to three of these parameters, which designate the signer’s certificate: x5u, x5c and x5t#S256.

Who it applies to

The RFC itself imposes nothing under eIDAS. Four acts in the corpus refer to it, with different scopes.

• PID in SD-JWT VC format. Providers of person identification data (PID) ensure that the PID issued comply with the annex to Implementing Regulation 2024/2977 Art. 3(3). For the SD-JWT VC format, the protected header of the PID signature contains the x5u and x5t#S256 parameters specified in the RFC Annex.
• Register of relying parties. The information in the national registers of wallet-relying parties carries the signature or seal of the registrar, in accordance with section 1 of Annex II to Implementing Regulation 2025/848 Art. 3(5). That section cites JSON and “IETF 7515” for JSON Web Signatures; the single common API is signed in accordance with these requirements Annex II.
• Qualified electronic ledgers. The annex to Implementing Regulation 2025/2531 requires providers of qualified electronic ledgers to establish the origin of records; for this purpose they use advanced electronic signatures or seals based on qualified certificates, created by the users of the service, in accordance with listed standards, including JAdES (ETSI TS 119 182-1 V1.2.1) adapted on the x5c parameter List of technical specifications and reference standards for qualified distributed electronic ledgers. Under Regulation 910/2014, an electronic ledger is presumed to comply with the requirements laid down in paragraph 1 of the same article where it meets the standards, specifications and procedures referred to in paragraph 3 Art. 45l(2); these are the ones in the annex Art. 1.
• Formats recognised by the public sector. Member States that require an advanced electronic signature or seal recognise those whose format complies with Annex I to Implementing Regulation 2026/248 Art. 1(1) Art. 3(1). That annex takes up JAdES (TS 119 182-1 V1.2.1) with the same adaptation on x5c Annex I. These two paragraphs only apply from 23 February 2027 Art. 6.

Key points

• x5c, optional in the RFC, mandatory in adapted JAdES. For the RFC, this parameter contains the certificate (or certificate chain) of the signing key, and its use is optional RFC 7515, § 4.1.6. "x5c" (X.509 Certificate Chain) Header Parameter. Implementing Regulations 2025/2531 and 2026/248 require its presence in the JAdES signature, as a signed or unsigned header parameter, with the semantics and syntax of clause 4.1.6 of the RFC List of technical specifications and reference standards for qualified distributed electronic ledgers Annex I.
• Chain validation. The recipient must validate the chain in accordance with RFC 5280, and the first certificate is that of the signing key RFC 7515, § 4.1.6. "x5c" (X.509 Certificate Chain) Header Parameter.
• x5u. This parameter is a URI that points to the certificate or the chain; the retrieval protocol must provide integrity protection RFC 7515, § 4.1.5. "x5u" (X.509 URL) Header Parameter.
• x5t#S256. This is the SHA-256 thumbprint of the certificate; its use is optional in the RFC RFC 7515, § 4.1.8. "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Header, but the act places it in the protected header of SD-JWT VC PID Annex.

Clauses referred to by the acts

• Clause 4.1.6 (x5c): Implementing Regulations 2025/2531 and 2026/248, through the adaptation of clause 5.1.8 of specification ETSI TS 119 182-1; for 2025/2531, through requirement REQ-7.5-03 added to standard ETSI EN 319 401 V3.1.1, whose adapted normative references insert RFC 7515 List of technical specifications and reference standards for qualified distributed electronic ledgers Annex I.
• x5u and x5t#S256 parameters: reference without a clause number, Implementing Regulation 2024/2977 Annex.
• General reference to “IETF 7515”, Implementing Regulation 2025/848 Annex II.

Links

• Acts that refer to it: Implementing Regulations 2024/2977 Implementing Regulation (EU) 2024/2977 — consolidated version of 11/08/2026, 2025/848 Implementing Regulation (EU) 2025/848 — consolidated version of 11/08/2026, 2025/2531 Implementing Regulation (EU) 2025/2531 and 2026/248 Implementing Regulation (EU) 2026/248.
• Intermediate standards: ETSI TS 119 182-1 (JAdES) ETSI TS 119 182-1 V1.2.1; ETSI EN 319 401 V3.1.1, for Implementing Regulation 2025/2531 ETSI EN 319 401 V3.1.1.
• Related standards: RFC 7519, JWT RFC 7519; RFC 5280 RFC 5280.
• Learning path: step 4, trust services and step 3, the European wallet.

Written by Asphalia.