Glossary
The acronyms, in plain language
Alice produces an artifact, Bob receives it. Every term below is a part of that handoff. No account needed here.
Classic flow · signing
Alice signs, Bob verifies
signs claims with her private key
JWS · header.payload.signature
fetches her public key from the JWKS URL
recomputes the signature - a changed byte cannot match
PASS
Bob knows Alice wrote it and nobody edited it. Anyone can still read it.
Classic flow · encryption
Alice encrypts, only Bob can read
encrypts with Bob’s public key, signs with hers
armored .asc over SFTP or email
decrypts with his private key - no one else can
checks Alice’s signature inside the envelope
PASS
Secrecy from encryption, authorship from the signature: that is sign + encrypt.
For the ways these go wrong rather than what they are, see the test tokens a signature stripped, a payload tampered with, an alg of none - each with the outcome your service should reach.
JOSE
token · family
JavaScript Object Signing and Encryption
The family name for JWT, JWS, JWE and JWK. If Alice sends Bob a dotted one-line token, it is one of these.
JWT
token · claims
JSON Web Token
A JWS whose payload is a set of claims about someone - who Alice is, what she may do, until when. The thing in your Authorization header.
JWS
token · sign
JSON Web Signature
Alice signs header and payload with her private key; Bob recomputes with her public key. Proves authorship and that nothing changed - hides nothing.
JWE
token · encrypt
JSON Web Encryption
Alice encrypts to Bob’s public key; five segments instead of three. Only Bob’s private key can open it.
JWK / JWKS
key · publish
JSON Web Key (Set)
A public key as JSON, and the set of them Bob fetches from a stable URL to check Alice’s signatures. Cryptobench hosts one per keyset.
kid
key · header
Key ID
The label in a token header naming which key signed it, so Bob picks the right one from a JWKS with several.
alg
header · attack
Algorithm header
Names how the token was signed or encrypted. The infamous alg:none claims no signature at all - a verifier must reject it.
exp / nbf / iat
claims · time
Temporal claims
Expiry, not-before and issued-at. Bob checks Alice’s token is neither expired nor from the future - allowing a little clock skew.
OpenPGP
file · encrypt · sign
Pretty Good Privacy (the standard)
Sign and encrypt files rather than tokens. The armored BEGIN/END block dropped on an SFTP server or attached to email.
GPG
file · tool
GNU Privacy Guard
The most common OpenPGP implementation - the gpg command. GPG the tool, OpenPGP the format.
.asc / armor
file · encoding
ASCII armor
A binary PGP message encoded as plain text between BEGIN and END lines, so it survives email and copy-paste unchanged.
HMAC
sign · secret · webhook
Hash-based Message Authentication Code
One shared secret on both sides instead of a key pair. Fast and common in webhooks - but anyone who can verify can also forge.
RS256 / ES256 / EdDSA
sign · algorithm
Signature algorithms
RSA, elliptic-curve and Edwards-curve signing. Different math, same contract: private key signs, public key verifies.
X.509
key · cert · tls
Certificate standard
A public key wrapped with a name and an issuer’s signature - a chain of vouching that ends at a root Bob already trusts. TLS runs on it.
mTLS
cert · transport
Mutual TLS
TLS where the client shows a certificate too, so Alice and Bob each prove who they are before a byte of payload moves.
CWE
report · reference
Common Weakness Enumeration
The public catalogue of known software weaknesses. Each Cryptobench failure case cites one, so a red build links to the class of bug it caught.