JWK Thumbprint URI
Extracted elements (7)
JWK Thumbprint URIs are introduced so that JWK Thumbprints can be used as key identifiers in contexts that require URIs (e.g., JWT claims, SIOPv2 subject identifiers). Wrapping the thumbprint in a URI also allows differentiation from other URI-based identifiers such as Decentralized Identifiers (DIDs).
The security considerations of RFC 7638 (JWK Thumbprint) apply when using JWK Thumbprint URIs. Implementations must be aware that the hash algorithm identifier in the URI must match a registered IANA Named Information hash name string for the URI to be considered valid.
Hash algorithm identifiers used in JWK Thumbprint URIs MUST be values from the 'Hash Name String' column in the IANA 'Named Information Hash Algorithm Registry'. URIs with identifiers not found in this registry are not considered valid.
To promote interoperability among implementations, the SHA-256 hash algorithm is mandatory to implement for JWK Thumbprint URIs.
The JWK Thumbprint URI is formed by the prefix 'urn:ietf:params:oauth:jwk-thumbprint' followed by a colon, a hash algorithm identifier, a colon, and the JWK Thumbprint value. Example: urn:ietf:params:oauth:jwk-thumbprint:sha-256:NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs.
This specification registers the URN 'urn:ietf:params:oauth:jwk-thumbprint' with Common Name 'JWK Thumbprint URI' in the IANA 'OAuth URI' registry established by RFC 6755. Change controller is IESG.
For certain cryptographic algorithms (e.g., X25519/X448 from RFC 7748), multiple public keys correspond to the same private key. Using a JWK Thumbprint URI as an identifier in such cases may lead to subtle vulnerabilities. A recommended mitigation is to sign a message containing the correct public key with the private key to bind the thumbprint to the actual key used.