GM/T 0125.4-2022JavaScript Object Notation Web cryptographic application syntax specification—Part 4:Key (English PDF)

3.1 JWK set

A JSON object representing a set of JWKs.

3.2 Base64url encoding

Base64url encoding is a safe encoding for URLs and file names. base64url encoding is first performed without padding in accordance with the base64 encoding rules, and then, the '+' symbol in the base64 encoding result is replaced with a '-' symbol, and the '/' symbol is replaced with a '_' symbol.

sensitive character string. This parameter is optional. The values defined by this parameter are.

---"sig" (signature);

---"enc" (encryption).

5.4 "key_ops" (key operation) Parameter the "key_ops" parameter is used to identify the key operation type. Its value is a string array of key operation values. The values of this parameter may include.

---"sign" (calculate digital signature or message authentication code);

---"verify" (verify digital signature or message authentication code);

---"encrypt" (encrypt content);

---"decrypt" (decrypt content and verify decryption, if applicable);

---"wrapKey" (key wrapping);

---"unwrapKey" (decrypt key wrapping and verify decryption, if applicable);

---"deriveKey" (derive key);

---"deriveBits" (derive bits not used as keys).

All key operation values are case-sensitive character strings, and repeated key operation values cannot appear in the array. The "key_ops" parameter is optional.

Multiple unrelated key operations shall not be specified for a key. A combination of "sign" and "verify", "encrypt" and "decrypt", and "wrapKey" and "unwrapKey" can be used.

The "use" and "key_ops" parameters should not be used together. If both are used, the information they represent shall be consistent, and the application program shall explicitly specify which parameters to use.

5.5 "alg" (algorithm) Parameter the "alg" parameter is used to identify the algorithm related to the key. Its value is a case-sensitive character string. This parameter is optional, and its value shall comply with GM/T 0125.1.

5.6 "kid" (key ID) Parameter the "kid" parameter is used to match a specific key. Its value is a case-sensitive character string, and this parameter is optional.

When the "kid" value is used in a JWK set, different keys in the JWK set shall use different "kid" values. When used with JWS or JWE, the "kid" value can be used to match the JWS or JWE "kid" parameter value.

5.7 "x5u" (certificate URL) Parameter the "x5u" parameter is used to identify the resource of a digital certificate or certificate chain, and its value is a character string in the form of URI. This resource shall provide a certificate or certificate chain in PEM-encoded form, with each certificate separated by the following delimiters.

-----BEGIN CERTIFICATE-----

-----END CERTIFICATE-----the key in the first certificate shall match the public key represented by the other parameters of JWK. This parameter is optional.

5.8 "x5c" (certificate chain) Parameter the "x5c" parameter is used to identify the digital certificate or certificate chain related to the key. Its value is a JSON array of strings. Each element in the array is a base64-encoded string of the DER-encoded digital certificate. The first element in the array shall be the digital certificate that matches the key, and the subsequent elements are successively the certificates held by the CA that issues the certificate of the previous element. This parameter is optional.

As with the "x5u" parameter, when the "x5c" parameter is used, optional JWK parameters may be present to provide key usage, algorithm, or other information. If other parameters are present, then, their content shall be semantically consistent with the relevant fields in the first certificate.

5.9 "x5t#sm3" (certificate SM3 hash value) Parameter the "x5t#sm3" parameter is a character string used to identify the SM3 fingerprint of the digital certificate, which can be used to match the key. The value is generated by first calculating the digital certificate DER code, performing SM3 hashing, and then, performing base64url encoding. The calculation method and steps of the SM3 algorithm shall comply with GB/T 39205.This parameter is optional.

6.1 General Description

A JWK set is a JSON object that represents a set of JWKs. The JSON object shall have a "keys" parameter, whose value is a JWK array. This JSON object may contain spaces, "/" and newlines.

The parameter names in the JWK set shall be unique, and the JWK set parser shall reject JWK sets containing duplicate parameter names. For examples of the JWK set, see Appendix A.