EC
Registry Context
EC identifies JWKs representing elliptic-curve keys.
Technical Summary
RFC 7518 specifies `EC` as the `kty` value for elliptic-curve keys. EC public keys contain `crv` and `x`; keys using P-256, P-384, or P-521 also contain `y`. EC private keys additionally contain `d`.
When Used
When representing an elliptic-curve public or private key as a JWK.
Normative Requirements
producer of an EC JWK
RFC 7518 - Section 6.2.1.2
encode an `x` coordinate whose decoded octet-string length is the full coordinate size for the curve identified by `crv`.
Condition: when the JWK contains an `x` member
The length of this octet string MUST be the full size of a coordinate for the curve specified in "crv".
RFC 7518 - Section 6.2.1.3
encode a `y` coordinate whose decoded octet-string length is the full coordinate size for the curve identified by `crv`.
Condition: when the JWK contains a `y` member
The length of this octet string MUST be the full size of a coordinate for the curve specified in "crv".
producer of an EC private JWK
RFC 7518 - Section 6.2.2
include the `d` member in addition to the public-key members.
Condition: when representing an elliptic-curve private key
In addition to the public-key members, the following member MUST be present to represent Elliptic Curve private keys.
RFC 7518 - Section 6.2.2.1
encode a `d` value whose decoded octet-string length is ceiling(log-base-2(n)/8) octets, where n is the curve order.
Condition: when the JWK contains a `d` member
The length of this octet string MUST be ceiling(log-base-2(n)/8) octets.
producer of an EC public JWK
RFC 7518 - Section 6.2.1
include the `crv` and `x` members.
Condition: when representing an elliptic-curve public key
The following members MUST be present for all Elliptic Curve public keys: "crv" and "x".
RFC 7518 - Section 6.2.1
include the `y` member.
Condition: when the `crv` value is `P-256`, `P-384`, or `P-521`
The "y" member MUST also be present for public keys using the three curves defined in Section 6.2.1.1.
Validation Guidance
Reject or flag EC public keys that omit `crv` or `x`.
Reject or flag EC public keys using `P-256`, `P-384`, or `P-521` that omit `y`.
Reject or flag an `x` value whose decoded octet-string length is not the full coordinate size for the curve identified by `crv`.
Reject or flag a `y` value whose decoded octet-string length is not the full coordinate size for the curve identified by `crv`.
Reject or flag EC private keys that omit `d` or any required public-key member.
Reject or flag a `d` value whose decoded octet-string length is not ceiling(log-base-2(n)/8) octets, where n is the curve order.
Reference
Details
- Entry Id
EC- Kty Parameter Value
EC- Key Type Description
Elliptic Curve- Jose Implementation Requirements
Recommended+- Change Controller
IESG- Reference
RFC7518 - Section 6.2