org.picketlink.json

Interface JsonConstants.JWK

Enclosing interface:

JsonConstants

public static interface JsonConstants.JWK

A JSON Web Key (JWK) is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. This specification also defines a JSON Web Key Set (JWK Set) JSON data structure that represents a set of JWKs. Cryptographic algorithms and identifiers for use with this specification are described in the separate JSON Web Algorithms (JWA) specification and IANA registries defined by that specification.

See Also:

http://self-issued.info/docs/draft-ietf-jose-json-web-key.html

Field Summary

Fields

Modifier and Type	Field and Description
static String	KEY_ALGORITHM The alg (algorithm) member identifies the algorithm intended for use with the key.
static String	KEY_OPERATIONS The key_ops (key operations) member identifies the operation(s) that the key is intended to be used for.
static String	KEY_TYPE The kty (key type) member identifies the cryptographic algorithm family used with the key.
static String	KEY_USE The use (public key use) member identifies the intended use of the public key.
static String	X509_CERTIFICATE_CHAIN The x5c (X.509 Certificate Chain) member contains a chain of one or more PKIX certificates [RFC5280].
static String	X509_CERTIFICATE_SHA1_THUMBPRINT The x5t (X.509 Certificate SHA-1 Thumbprint) member is a base64url encoded SHA-1 thumbprint (a.k.a.
static String	X509_CERTIFICATE_SHA256_THUMBPRINT The x5t#S256 (X.509 Certificate SHA-256 Thumbprint) member is a base64url encoded SHA-256 thumbprint (a.k.a.
static String	X509_URL The x5u (X.509 URL) member is a URI [RFC3986] that refers to a resource for an X.509 public key certificate or certificate chain [RFC5280].

Field Detail

KEY_TYPE

static final String KEY_TYPE

The kty (key type) member identifies the cryptographic algorithm family used with the key. kty values should either be registered in the IANA JSON Web Key Types registry defined in [JWA] or be a value that contains a Collision-Resistant Name. The kty value is a case-sensitive string. This member MUST be present in a JWK.

See Also:

Constant Field Values

KEY_USE

static final String KEY_USE

The use (public key use) member identifies the intended use of the public key. The use parameter is intended for use cases in which it is useful to distinguish between public signing keys and public encryption keys. Values defined by this specification are:

• sig (signature)
• enc (encryption)

Other values MAY be used. Public Key Use values can be registered in the IANA JSON Web Key Use registry defined in Section 8.2. The use value is a case-sensitive string. Use of the use member is OPTIONAL, unless the application requires its presence.

See Also:

Constant Field Values

KEY_OPERATIONS

static final String KEY_OPERATIONS

The key_ops (key operations) member identifies the operation(s) that the key is intended to be used for. The key_ops parameter is intended for use cases in which public, private, or symmetric keys may be present. Its value is an array of key operation values. Values defined by this specification are:

• sign (compute signature or MAC)
• verify (verify signature or MAC)
• encrypt (encrypt content)
• decrypt (decrypt content and validate decryption, if applicable)
• wrapKey (encrypt key)
• unwrapKey (decrypt key and validate decryption, if applicable)
• deriveKey (derive key)
• deriveBits (derive bits not to be used as a key).

Other values MAY be used. Key operation values can be registered in the IANA JSON Web Key Operations registry defined in Section 8.3. The key operation values are case-sensitive strings. Duplicate key operation values MUST NOT be present in the array.

Multiple unrelated key operations SHOULD NOT be specified for a key because of the potential vulnerabilities associated with using the same key with multiple algorithms. Thus, the combinations sign with verify, encrypt with decrypt, and wrapKey with unwrapKey are permitted, but other combinations SHOULD NOT be used.The use and key_ops JWK members SHOULD NOT be used together.

See Also:

Constant Field Values

KEY_ALGORITHM

static final String KEY_ALGORITHM

The alg (algorithm) member identifies the algorithm intended for use with the key. The values used should either be registered in the IANA JSON Web Signature and Encryption Algorithms registry defined in [JWA] or be a value that contains a Collision-Resistant Name. Use of this member is OPTIONAL.

See Also:

Constant Field Values

X509_URL

static final String X509_URL

The x5u (X.509 URL) member is a URI [RFC3986] that refers to a resource for an X.509 public key certificate or certificate chain [RFC5280]. The identified resource MUST provide a representation of the certificate or certificate chain that conforms to RFC 5280 [RFC5280] in PEM encoded form [RFC1421]. The key in the first certificate MUST match the public key represented by other members of the JWK. The protocol used to acquire the resource MUST provide integrity protection; an HTTP GET request to retrieve the certificate MUST use TLS [RFC2818, RFC5246]; the identity of the server MUST be validated, as per Section 6 of RFC 6125 [RFC6125]. Use of this member is OPTIONAL.

See Also:

Constant Field Values

X509_CERTIFICATE_CHAIN

static final String X509_CERTIFICATE_CHAIN

The x5c (X.509 Certificate Chain) member contains a chain of one or more PKIX certificates [RFC5280]. The certificate chain is represented as a JSON array of certificate value strings. Each string in the array is a base64 encoded ([RFC4648] Section 4 -- not base64url encoded) DER [ITU.X690.1994] PKIX certificate value. The PKIX certificate containing the key value MUST be the first certificate. This MAY be followed by additional certificates, with each subsequent certificate being the one used to certify the previous one. The key in the first certificate MUST match the public key represented by other members of the JWK. Use of this member is OPTIONAL.

See Also:

Constant Field Values

X509_CERTIFICATE_SHA1_THUMBPRINT

static final String X509_CERTIFICATE_SHA1_THUMBPRINT

The x5t (X.509 Certificate SHA-1 Thumbprint) member is a base64url encoded SHA-1 thumbprint (a.k.a. digest) of the DER encoding of an X.509 certificate [RFC5280]. The key in the certificate MUST match the public key represented by other members of the JWK. Use of this member is OPTIONAL.

See Also:

Constant Field Values

X509_CERTIFICATE_SHA256_THUMBPRINT

static final String X509_CERTIFICATE_SHA256_THUMBPRINT

The x5t#S256 (X.509 Certificate SHA-256 Thumbprint) member is a base64url encoded SHA-256 thumbprint (a.k.a. digest) of the DER encoding of an X.509 certificate [RFC5280]. The key in the certificate MUST match the public key represented by other members of the JWK. Use of this member is OPTIONAL.

See Also:

Constant Field Values