anchor.diff:  |HMAC               | sha256*, sha512   | `:hs256`, `:hs512` | No
   |====================================================================================
   
  -
  -=== Signing data
  -
  -Let start with signing data. For it we will use the `sign` function from
  -`buddy.sign.jws` namespace, and the `hs256` algorithm for signining:
  -
  -[source, clojure]
  -----
  -(require '[buddy.sign.jws :as jws])
  -
  -(jws/sign {:userid 1} "secret")
  -;; "eyJ0eXAiOiJKV1MiLCJhbGciOiJIU..."
  -----
  -
  -The `sign` function return a encoded and signed token as plain `String` instance
  -or an exception in case of something goes wrong. As you can observe, no algorithm
  -is passed as parameter. In this situations the default one will be used, and in
  -this case is `:hs256`.
  -
  -NOTE: Due to the nature of the storage format, the input is restricted mainly to
  -json objects in the current version.
  -
  -
  -=== Unsigning data
  -
  -It's time to unsing data. That process consists on verify the signature of incoming
  -data and return the plain data (without signature). For it we will use the `unsign`
  -function from `buddy.sign.jws` namespace:
  -
  -[source, clojure]
  -----
  -(jws/unsign data "secret")
  -;; => {:userid 1}
  -----
  -
  -
  -=== Claims validation
  -
  -_buddy-sign_ json web signature implements validation of a concrete subset of
  -claims: *iat* (issue time), *exp* (expiration time), *nbf* (not before), *iss*
  -(issuer) and *aud* (audience).
  -
  -The validation is performed on decoding the token. If `:exp` claim is found and
  -is posterior to the current date time (UTC) an validation exception will be raised.
  -Alternatively, the time to validate token against can be specified as `:now`
  -option to `unsign`.
  -
  -Let see an example using direct api:
  -
  -[source, clojure]
  -----
  -(require '[clj-time.core :as time])
  -
  -;; Define claims with `:exp` key
  -(def claims
  -  {:user 1 :exp (time/plus (time/now) (time/seconds 5))})
  -
  -;; Serialize and sign a token with previously defined claims
  -(def token (jws/sign claims "key"))
  -
  -;; wait 5 seconds and try unsign it
  -
  -(jws/unsign token "key")
  -;; => ExceptionInfo "Token is older than :exp (1427836475)"
  -
  -;; use timestamp in the past
  -(jws/unsign token "key" {:now (time/minus (time/now) (time/seconds 5))})
  -;; => {:user 1}
  -----
  -
  -
  -=== Digital signature algorithms
  -
  -In order to use any of digital signature algorithms you must have a private/public
  -key. If you don't have one, don't worry, it is very easy to generate it using
  -*openssl*, see this <<generate-keypairs,faq entry>>.
  -
  -Now, having generated a key pair, you can sign your messages using one
  -of supported digital signature algorithms.
  -
  -.Example of signing a string using _es256_ (eliptic curve dsa) algorithm.
  -[source, clojure]
  -----
  -(require '[buddy.core.keys :as keys])
  -
  -;; Create keys instances
  -(def ec-privkey (keys/private-key "ecprivkey.pem"))
  -(def ec-pubkey (keys/public-key "ecpubkey.pem"))
  -
  -;; Use them like plain secret password with hmac algorithms for sign
  -(def signed-data (jws/sign {:foo "bar"} ec-privkey {:alg :es256}))
  -
  -;; And unsign
  -(def unsigned-data (jws/unsign signed-data ec-pubkey {:alg :es256}))
  -----
  -
  -
  -[[jwe]]
  -== Json Web Encryption
  -
  -[small]#New in version: 0.5#
  -
  -JSON Web Encryption (JWE) is a encryption part of Json Web Token (JWT)
  -specification and represents a encrypted content using JavaScript Object Notation
  -(JSON) based data structures.
  -
  -
  -=== Supported algorithms
  +==== For claims encryption
   
   The Json Web Encryption in difference to JWS uses two types of algoritms: key
   encryption algorithms and content encryption algorithms.
  
positive.code: (public and private).
  ====
  
  
  === Signing and unsigning data
  
  With difference with jwt/jws, this implementation is not limited to hash-map
  like objects, and you can sign any clojure valid type. Let see an example:
  
  
negative.code: is a table that exposes the currently supported _Content Encryption Algorithms_
  (all specified in the JWA RFC):
  
  [options="header", cols="1,1,1,1"]
  |===================================================================================
  | Algorithm name | Description | Keyword | Shared Key Size
  