kid
Registry Context
`kid` is an optional key identifier used to match a specific JWK, including selecting among keys in a JWK Set.
Technical Summary
RFC 7517 defines `kid` as a case-sensitive string whose structure is unspecified. It can select a key from a JWK Set, including during key rollover, and can match a JWK to a JWS or JWE `kid` Header Parameter. When used in a JWK Set, distinct values are recommended for different keys.
When Used
Use `kid` to identify or select a specific key, particularly in a JWK Set or when matching a JWS or JWE `kid` Header Parameter.
Normative Requirements
JWK producers
RFC 7517 - Section 4.5
Include the `kid` member..
Use of this member is OPTIONAL.
JWK Set producers
RFC 7517 - Section 4.5
Use distinct `kid` values for different keys within the same JWK Set..
Condition: When `kid` values are used within a JWK Set.
different keys within the JWK Set SHOULD use distinct "kid" values.
JWS implementations
RFC 7515 - Section 5.3
Use the specified JSON string comparison rules for JSON string comparisons, except where a member definition explicitly specifies different rules..
Condition: When processing JWS JSON strings; `typ` and `cty` values are exceptions.
These comparison rules MUST be used for all JSON string comparisons except in cases where the definition of the member explicitly calls out that a different comparison rule is to be used
Validation Guidance
Allow `kid` to be absent; its use is optional.
Require a present `kid` value to be a case-sensitive string.
When processing JWS values, compare `kid` using the applicable JSON string comparison rules.
Warn when different keys in the same JWK Set reuse a `kid` value.
Reference
Details
- Entry Id
kid- Parameter Name
kid- Parameter Description
Key ID- Used With Kty Value
*- Parameter Information Class
Public- Change Controller
IESG- Reference
RFC7517 - Section 4.5