RFC 7517 / START HERE
JWK, before the details
JWK: JSON Web Key
A JWK describes a cryptographic key using JSON fields. A set of JWKs can publish several keys so recipients can find an appropriate one.
The idea in one picture
A service has key material
JWK describes it as JSON
Another service selects a key
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
Applications need an interoperable way to distribute key information and identify keys during operations such as signature verification.
A familiar example
An identity service publishes public verification keys in a JWK set for the services that accept its signed tokens.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- A key has typed membersA JWK is a JSON object representing a cryptographic key and optional metadata.→
- Choose from a JWK SetA JWK Set contains an array of keys; the consumer still needs a trusted source and selection policy.→
- Use and operations constrain keysA key intended for signing should not automatically be used for unrelated operations.→
- Public and private are differentA public key representation can be shared; private and symmetric key material must remain confidential.→
- Protect a stored key objectA JWK or JWK Set can itself be encrypted using JWE.→
This introduction explains RFC 7517 (2015). Read the original RFC ↗