From d49181f6a55afbddd0c90fe22063445b86be8afe Mon Sep 17 00:00:00 2001 From: Matthias Wiesen Date: Fri, 3 Jul 2026 20:30:27 +0200 Subject: [PATCH] fix: correct JWE algorithm typo A265GCM -> A256GCM and RFC 7519 -> 7159 label A265GCM is not a registered JWE algorithm; A256GCM (AES-256-GCM) is clearly intended, matching the surrounding prose and all examples. Section 3 mislabels the JSON RFC as 7519 (which is JWT) while linking to 7159; fix the label to match the link. Co-Authored-By: Claude Sonnet 5 --- SPXP-Spec.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/SPXP-Spec.md b/SPXP-Spec.md index ec0499c..ecd8ede 100644 --- a/SPXP-Spec.md +++ b/SPXP-Spec.md @@ -32,7 +32,7 @@ Data is exchanged between participating clients and servers via HTTP, preferably servers are encouraged to use the latest versions of these protocols, e.g. HTTP/2 and HTTP/3, and to prefer IPv6. ## 3 Transport encoding of structured data -Data is encoded as JSON according to [RFC 7519 “The JavaScript Object Notation (JSON) Data Interchange +Data is encoded as JSON according to [RFC 7159 “The JavaScript Object Notation (JSON) Data Interchange Format”](https://tools.ietf.org/html/rfc7159). Please note that this standard defines the HTTP `Content-Type` header to be `application/json` with no `charset` parameter. Clients must always use UTF-8 character encoding, irrespective of any `charset` incorrectly sent by the server. @@ -593,7 +593,7 @@ Private data is supported for: ### 11.2 Supported algorithm and encoding The only supported encryption method is direct encryption with 256 bit AES in Galois/Counter Mode, identified as -`"alg": "dir", "enc": "A265GCM"` by JWE. This requires a new random initialisation vector `iv` for each private block. +`"alg": "dir", "enc": "A256GCM"` by JWE. This requires a new random initialisation vector `iv` for each private block. ### 11.3 Object merging rules A source object `src` is merged into a target object `dst` as follows: @@ -958,7 +958,7 @@ Example: The connection package must be signed by the issuer. It is then encrypted according to [RFC 7516 “JSON Web Encryption (JWE)”](https://tools.ietf.org/html/rfc7516) using the _ephemeral connection establishment key_. The only supported encryption method is direct encryption with 256 bit AES in Galois/Counter Mode, identified as `"alg": "dir", "enc": -"A265GCM"` by JWE. This requires a new random initialisation vector `iv` for each package. +"A256GCM"` by JWE. This requires a new random initialisation vector `iv` for each package. ### 14.4 Preparing a Connection The initiator prepares the connection by sending the reader key, optional publishing key and encrypted connection @@ -1037,7 +1037,7 @@ Example: The connection request object must always be signed by the requester. It is then encrypted according to [RFC 7516 “JSON Web Encryption (JWE)”](https://tools.ietf.org/html/rfc7516) using the Elliptic Curve Diffie-Hellman Ephemeral Static key agreement on the X25519 curve and content encrypted with 256 bit AES in Galois/Counter Mode, identified by -JWE as `"alg": "ECDH-ES", "enc": "A265GCM"`. +JWE as `"alg": "ECDH-ES", "enc": "A256GCM"`. ### 14.6 Token acquisition Since the content of the connection request message is not accessible by the profile server, this process can easily be