Choose members for each key family
04The required-member set depends on the key type. Asymmetric private keys use their corresponding public representation; symmetric keys have no public half.
An oct thumbprint hashes k as part of its JSON representation. Publishing a hash can help test guesses of a weak secret; the usual public-key intuition does not automatically apply.
Source for this drawing: RFC 7638 · Read RFC section 3.2 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- Asymmetric pair
- A linked public and private key pair; the thumbprint uses its public representation.
- Symmetric key
- One shared secret whose key material is part of the selected JWK members.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
For the EC public key curves covered here, select crv, kty, x, y; for RSA select e, kty, n; for oct select k, kty, each in that order.
- For the EC public key curves covered here, select crv, kty, x, y; for RSA select e, kty, n; for oct select k, kty, each in that order.
- For an asymmetric private key, compute the thumbprint of its corresponding public key. Private RSA d and other private members are not hashed.
- A private and public member of the same asymmetric key pair therefore have the same thumbprint with the same hash. Application context decides which half an identifier refers to.
- For a symmetric oct key, k is required and does enter the hash input. Its thumbprint should typically be concealed from parties lacking that key, unless the stated application/hash protection condition holds.
These are the key families specified by RFC 7638’s cited JWA edition, not a claim that every modern curve uses x and y. For other kty definitions, consult their defining specification. The symmetric-key warning is lowercase should in §7; it is conditional guidance, not a new uppercase MUST. No private or real secret key is used in this guide.
Read the RFC section ↗