CBOR Object Signing and Encryption (COSE) Key Thumbprint
Extracted elements (27)
COSE Key Thumbprints are analogous to digests of X.509 Subject Public Key Info (SPKI) values rather than full certificate digests, because they cover only the essential key parameters, not the full key structure with all optional fields.
Optional COSE Key parameters are excluded from the thumbprint computation so that the same underlying key always produces the same thumbprint regardless of which optional attributes (e.g., 'kid', usage constraints) accompany it in different application contexts.
SHA-256 is the mandated baseline hash, but the preferred function may evolve; in single-party use cases (e.g., generating a 'kid') the hash choice is opaque to consumers, but multi-party thumbprint comparison requires explicit agreement on the algorithm.
The URI prefix uses the 'oauth' namespace segment (urn:ietf:params:oauth:ckt) solely to align with JWK Thumbprint URIs (RFC 9278); the URIs are intended for general use and not restricted to OAuth contexts.
Keys not originally in COSE Key format can be thumbprinted by first converting them to a COSE_Key representation, provided that representation is defined and the converter possesses the necessary key material.
The COSE Key Thumbprint ('ckt') and the JWK Thumbprint ('jkt') produce different values even when computed over the same underlying cryptographic key material, because they operate over different serialization formats (CBOR vs. JSON).
A COSE Key Thumbprint MUST be computed by: (1) constructing a COSE_Key structure with only required parameters, (2) applying CBOR deterministic encoding per RFC 8949 Section 4.2.1, and (3) hashing the resulting bytes with a cryptographic hash function.
Developers MUST ensure that symmetric keys used for thumbprinting have sufficient entropy (at least 128-bit randomly selected key); thumbprints MUST NOT be used with passwords or other low-entropy secrets. If entropy sufficiency cannot be determined, thumbprints of symmetric keys MUST NOT be used.
For EC2 elliptic curve keys, implementations MUST use the uncompressed point representation for thumbprint calculation; if a compressed point representation is used internally, it MUST first be converted to uncompressed form.
Hash algorithm identifiers used in COSE Key Thumbprint URIs MUST be values from the 'Hash Name String' column in the IANA 'Named Information Hash Algorithm Registry'; applications MUST detect and handle URIs with unrecognized algorithm identifiers.
The 'kty' element (label: 1) MUST be present for all key types, and the integer value from the IANA 'COSE Key Types' registry MUST be used; the tstr data type is not used with 'kty'.
The output of the COSE Key Thumbprint computation used in a URI MUST be base64url encoded without padding, following the encoding defined in RFC 7515.
The SHA-256 hash algorithm MUST be supported for COSE Key Thumbprint computation; other algorithms MAY be supported.
COSE Key Thumbprint URIs use the prefix 'urn:ietf:params:oauth:ckt', followed by a colon, the hash algorithm name from the Named Information Hash Algorithm Registry, another colon, and the base64url-encoded-without-padding thumbprint value.
Required parameters for EC2 elliptic curve public keys (e.g., NIST P-256): 'kty' (label 1, int, value 2), 'crv' (label -1, int), 'x' (label -2, bstr), 'y' (label -3, bstr, uncompressed). Only these four fields enter the thumbprint computation.
Required parameters for HSS-LMS post-quantum keys: 'kty' (label 1, int, value 5), 'pub' public key (label -1, bstr).
Required parameters for Octet Key Pair (OKP) public keys (e.g., X25519): 'kty' (label 1, int, value 1), 'crv' (label -1, int), 'x' (label -2, bstr). Only these are included in thumbprint computation.
Required parameters for RSA public keys: 'kty' (label 1, int, value 3), 'n' modulus (label -1, bstr), 'e' exponent (label -2, bstr).
Required parameters for symmetric keys: 'kty' (label 1, int, value 4), 'k' key value (label -1, bstr).
The 'ckt' CWT confirmation method member carries the COSE Key Thumbprint as a binary string within the 'cnf' claim, allowing proof-of-possession without transmitting the full COSE Key. Registered with confirmation key 5.
IANA added 'ckt' to the 'CWT Confirmation Methods' registry: name 'ckt', description 'COSE Key SHA-256 Thumbprint', confirmation key 5, value type binary string, no JWT counterpart.
IANA added 'urn:ietf:params:oauth:ckt' to the 'OAuth URI' registry with common name 'COSE Key Thumbprint URI', defined by RFC 9679.
A COSE Key Thumbprint uniquely identifies a key only if a single unambiguous COSE Key representation is defined and consistently used. Optional parameters (including key IDs) are excluded from thumbprint computation, so applications needing optional-parameter inclusion cannot use this specification.
Comparing thumbprint values is not a reliable means of excluding particular keys: an attacker can supply a transformed key (e.g., RSA modulus 3*N) that produces a different thumbprint but still functions for a fraction of operations.
Thumbprints of symmetric keys risk precomputed table attacks if the key has insufficient entropy; MUST NOT be used with passwords or low-entropy secrets, and are inappropriate for most deployment scenarios.
For EC2 thumbprint, the y-coordinate is expressed as a bstr (uncompressed point); the resulting canonical CBOR map for P-256 contains exactly four entries with labels 1, -1, -2, -3 in CBOR map order.
The canonical input to the hash function is the CBOR deterministic encoding (RFC 8949 Section 4.2.1) of a COSE_Key map containing only the required key-type parameters in ascending label order.