JSON Web Key (JWK): Overview

Key Features and Purpose

• Data Structure: JWK defines how cryptographic keys (such as RSA or Elliptic Curve public keys) are formatted in JSON, making them easily exchangeable and readable by web applications and APIs.
• Public Key Distribution: Service providers (e.g., Google, identity providers) expose their public keys in JWK format via well-known endpoints. Clients or relying parties can fetch and use these keys to verify JWT (JSON Web Token) signatures.
• Key Identification: Each JWK has a kid (Key ID) used to match the correct key with a given signed token.
• Application: For example, during OAuth2 or federated login (like zkLogin on Sui), the ID provider exposes a JWK set, and users' authentication tokens (JWT) include a header referring to the appropriate kid. This ensures signature verification is performed with the correct key1.

Example Usage in Protocols

• In the Sui blockchain, authorities update their view of JWKs for supported providers, and use them to verify user authentication tokens.
• Correctness and up-to-date key management is vital, with many systems relying on a quorum or consensus to ensure only valid and trusted keys are used1.

Example JWK Format

{
  "kty": "RSA",
  "kid": "unique_key_id",
  "use": "sig",
  "alg": "RS256",
  "n": "modulus",
  "e": "exponent"
}

• kty: Key Type (e.g., RSA)
• kid: Key Identifier
• use: Intended use (e.g., "sig" for signature)
• alg: Algorithm used (e.g., RS256)
• n, e: Key material (for RSA: modulus and exponent)

Summary Table