RFC 7517

Q: What does the Introduction section cover in RFC 7517 — JWK?

The Introduction section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 7517 — JWK. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the JWK Parameters section cover in RFC 7517 — JWK?

The JWK Parameters section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 7517 — JWK. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the EC Key Example section cover in RFC 7517 — JWK?

The EC Key Example section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 7517 — JWK. This content is part of the BLACKLABS RFC Reference Library.

Q: What does the Security Considerations section cover in RFC 7517 — JWK?

The Security Considerations section provides detailed technical specifications, security considerations, and implementation guidance as documented in RFC 7517 — JWK. This content is part of the BLACKLABS RFC Reference Library.

BLACKLABS

JSON Web Key (JWK)

Standards Track

May 2015

Abstract: JWK is a JSON data structure representing a cryptographic key. JWK Sets aggregate multiple keys for key management. In 5G, JWK/JWKS is used by the NRF to publish signing keys for JWT access token verification.

Canonical source: https://www.rfc-editor.org/rfc/rfc7517 | IETF Datatracker

1. Introduction

▶

JWK provides a standard JSON format for representing cryptographic keys (both public and private). This enables key distribution and discovery via HTTP/REST APIs.

In 5G, the NRF exposes a JWKS (JWK Set) endpoint where NF producers can retrieve the NRF's public keys for JWT access token signature verification.

2. JWK Parameters

▶

Parameter	Required	Description
kty	MUST	Key type — 'EC' (Elliptic Curve), 'RSA', 'oct' (symmetric)
use	OPTIONAL	Key use — 'sig' (signature) or 'enc' (encryption)
key_ops	OPTIONAL	Key operations — 'sign', 'verify', 'encrypt', 'decrypt'
alg	OPTIONAL	Algorithm intended for use with the key
kid	OPTIONAL	Key ID — matches 'kid' in JWS/JWE header
x5c	OPTIONAL	X.509 certificate chain containing the public key
x5t#S256	OPTIONAL	SHA-256 thumbprint of the X.509 certificate

3. EC Key Example

▶

The JWKS endpoint allows key rotation — new keys are added before old keys are removed, ensuring uninterrupted token verification.

  {
"kty": "EC",
"crv": "P-256",
"kid": "nrf-signing-key-1",
"use": "sig",
"x": "f83OJ3D2xF1Bg8vub9tLe1gHMzV76e8Tus9uPHvRVEU",
"y": "x_FEzRu9m36HLN_tue659LNpXW6pCyStikYjKIWI5a0"
}
JWK Set (JWKS):
{
"keys": [
{ "kty": "EC", "kid": "nrf-key-1", ... },
{ "kty": "EC", "kid": "nrf-key-2", ... }
]
}

4. Security Considerations

▶

Private key parameters (d for EC, d/p/q for RSA) MUST NOT be included in public JWK Sets
JWKS endpoints MUST be served over TLS to prevent key substitution attacks
NFs SHOULD cache JWKS with appropriate TTL to reduce NRF load
Key rotation should use overlapping key periods — add new key, migrate, then remove old key