Identify a key, not its metadata
01A JSON Web Key (JWK) represents a cryptographic key. Its thumbprint is a hash of a precisely selected representation, not a hash of the entire incoming file.
For the same RSA key and chosen hash, changing kid or omitting alg leaves the selected required members and hence the digest unchanged. That does not authenticate the metadata.
Source for this drawing: RFC 7638 · Read RFC section 3 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- Digest
- The fixed-length output of a cryptographic hash function.
- kid
- A key identifier, often used to select a key; its value does not establish trust.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Select only the members required to represent this key type, not every member present in the JWK. For RSA public keys these are e, kty and n.
- Select only the members required to represent this key type, not every member present in the JWK. For RSA public keys these are e, kty and n.
- Optional alg, kid, use and other attributes do not enter the thumbprint. Changing them alone does not change the result for the same key and hash function.
- Construct the ordered compact JSON, encode it as UTF-8, then hash those bytes. Base64url is an optional way to express the resulting digest as a key identifier.
- An application chooses the hash function. Parties reproducing a thumbprint must agree on that choice; a consumer using kid for lookup may treat it as opaque.
The scenes show local data dependencies, not a network protocol. A thumbprint can be used as kid; RFC 7638 does not require every kid to be a thumbprint. Key selection is separate from checking signatures, provenance and permitted uses.
Read the RFC section ↗