Diagram: Difference between revisions
Jump to navigation
Jump to search
| Line 92: | Line 92: | ||
PG --> EC2C | PG --> EC2C | ||
@enduml | @enduml | ||
</kroki> | |||
==Encrypt » E2E » JWE== | |||
<kroki lang="mermaid"> | |||
sequenceDiagram | |||
autonumber | |||
participant FE as Frontend (Browser) | |||
participant BE as Backend (API Server) | |||
Note over BE: Backend owns EC key pair<br/>Private key stays server-side | |||
FE->>BE: GET /public-key | |||
BE-->>FE: EC Public Key (P-256) | |||
Note over FE: Cache backend public key | |||
FE->>FE: Create JSON payload | |||
FE->>FE: Generate ephemeral EC key pair | |||
FE->>FE: Derive shared secret (ECDH) | |||
FE->>FE: Derive AES key (HKDF) | |||
FE->>FE: Encrypt payload (AES-256-GCM) | |||
FE->>FE: Build JWE (ECDH-ES + A256GCM) | |||
FE->>BE: POST /api (JWE payload) over HTTPS | |||
BE->>BE: Parse JWE | |||
BE->>BE: Derive shared secret (ECDH) | |||
BE->>BE: Decrypt payload (AES-256-GCM) | |||
BE->>BE: Process request | |||
BE->>BE: Encrypt response as JWE | |||
BE-->>FE: JWE response over HTTPS | |||
FE->>FE: Decrypt JWE response | |||
</kroki> | </kroki> | ||
Revision as of 03:39, 13 January 2026
Example
Cloudflare » BlockDiagram
Cloudflare » PlantUML
Encrypt » E2E » JWE
References
|
References | ||
|---|---|---|