RFC 7638 / START HERE
JWK thumbprints, before the details
JWK means JSON Web Key; a thumbprint is a digest identifying a key’s specified representation.
A JWK thumbprint gives a key a repeatable fingerprint by selecting required fields, putting them in an exact JSON form and hashing its UTF-8 bytes. A hash is a fixed-length summary, not encryption or a signature.
The idea in one picture
Select key fields
Order and hash bytes
Identify, then validate
A simplified picture of the idea; the chapters explain the actual mechanisms.
Why it exists
The same public key may arrive with different formatting or optional labels. Hashing a whole JSON file would produce inconsistent identifiers. RFC 7638 specifies what to include so compatible implementations can identify the same key using the same chosen hash.
A familiar example
Imagine a key directory that changes a key’s nickname. Its thumbprint stays the same because the nickname is excluded. You can use the fingerprint to find the key, but you must still check whether you trust it and whether a signature is valid.
Helpful background
You can start here without reading another RFC. If these ideas are unfamiliar, these short introductions may help.
What you’ll learn next
Begin with chapter one, or choose a topic.
- Identify a key, not its metadataA JSON Web Key (JWK) represents a cryptographic key. Its thumbprint is a hash of a precisely selected representation, not a hash of the entire incoming file.→
- Construct the exact bytesSemantically similar JSON can have different bytes. Thumbprints require the specified member order and representation before hashing.→
- Reproduce the official RSA exampleThe published RSA example gives a complete known result. Reproducing it catches wrong member selection, ordering, byte encoding and digest formatting.→
- Choose members for each key familyThe required-member set depends on the key type. Asymmetric private keys use their corresponding public representation; symmetric keys have no public half.→
- Validate representation and preserve trust boundariesA repeatable fingerprint identifies a representation. It does not replace key validation, authentication or a complete key-management policy.→
This introduction explains RFC 7638 (2015). Read the original RFC ↗