Skip to main content

Appendix D. Notes on Key Selection

Appendix D. Notes on Key Selection​

This appendix provides notes on algorithms that applications can use to select the key to be used for validating a JWS among a set of potential keys.

Key Selection Considerations​

When multiple keys are available to an application, the following Header Parameters can assist in key selection:

  1. "kid" (Key ID): Provides a hint about which key was used. Applications can match this with the "kid" parameter in JWK representations of candidate keys.

  2. "jku" (JWK Set URL): Points to a set of JSON-encoded public keys, one of which corresponds to the signing key.

  3. "jwk" (JSON Web Key): Contains the actual public key used for signing.

  4. "x5u" (X.509 URL): Points to an X.509 certificate or certificate chain.

  5. "x5c" (X.509 Certificate Chain): Contains the X.509 certificate or certificate chain directly.

  6. "x5t" (X.509 Certificate SHA-1 Thumbprint): Contains a thumbprint of the certificate.

  7. "x5t#S256" (X.509 Certificate SHA-256 Thumbprint): Contains a SHA-256 thumbprint of the certificate.

Selection Algorithm​

A typical key selection algorithm might:

  1. Check if "kid" is present and matches a known key ID
  2. If "jwk" is present, use that key directly
  3. If "jku" is present, fetch the JWK Set and find the matching key
  4. If X.509 parameters are present, validate and extract the key from the certificate
  5. Fall back to application-specific key determination methods

Applications MUST validate that the selected key is appropriate for use with the algorithm specified in the "alg" Header Parameter.

Last updated on