Jwk (jose.Jose.Jwk)

JSON Web Key

Link to RFC

type public =

| Public

type priv =

| Private

type 'key jwk = {

alg : Jwa.alg option;
(*
The algorithm for the key
*)
kty : Jwa.kty;
(*
The key type for the key
*)
use : Jwa.use option;
kid : string option;
(*
Key ID
*)
key : 'key;
(*
The key implementation
*)

}

type pub_rsa = Mirage_crypto_pk.Rsa.pub jwk

rsa represents a public JWK with kty `RSA and a Rsa.pub key

type priv_rsa = Mirage_crypto_pk.Rsa.priv jwk

rsa represents a private JWK with kty `RSA and a Rsa.priv key

type oct = string jwk

oct represents a JWK with kty `OCT and a string key.

oct will in most cases be a private key but there are some cases where it will be considered public, eg. if you parse a public JSON

type priv_es256 = Mirage_crypto_ec.P256.Dsa.priv jwk

es256 represents a public JWK with kty `EC and a P256.pub key

type pub_es256 = Mirage_crypto_ec.P256.Dsa.pub jwk

es256 represents a private JWK with kty `EC and a P256.priv key

type priv_es384 = Mirage_crypto_ec.P384.Dsa.priv jwk

es384 represents a public JWK with kty `EC and a P384.pub key

type pub_es384 = Mirage_crypto_ec.P384.Dsa.pub jwk

es384 represents a private JWK with kty `EC and a P384.priv key

type priv_es512 = Mirage_crypto_ec.P521.Dsa.priv jwk

es512 represents a public JWK with kty `EC and a P512.pub key

type pub_es512 = Mirage_crypto_ec.P521.Dsa.pub jwk

es512 represents a private JWK with kty `EC and a P512.priv key

type priv_ed25519 = Mirage_crypto_ec.Ed25519.priv jwk

ed25519 represents a public JWK with kty `OKP and a Ed25519.pub key

type pub_ed25519 = Mirage_crypto_ec.Ed25519.pub jwk

ed25519 represents a private JWK with kty `OKP and a Ed25519.priv key

type 'a t =

| Oct : oct -> 'a t
| Rsa_priv : priv_rsa -> priv t
| Rsa_pub : pub_rsa -> public t
| Es256_priv : priv_es256 -> priv t
| Es256_pub : pub_es256 -> public t
| Es384_priv : priv_es384 -> priv t
| Es384_pub : pub_es384 -> public t
| Es512_priv : priv_es512 -> priv t
| Es512_pub : pub_es512 -> public t
| Ed25519_priv : priv_ed25519 -> priv t
| Ed25519_pub : pub_ed25519 -> public t

t describes a JSON Web Key which can be either public or private

Public keys

These keys are safe to show and should be used to verify signed content.

val make_pub_rsa : 
  ?use:Jwa.use ->
  ?alg:Jwa.alg ->
  Mirage_crypto_pk.Rsa.pub ->
  public t

make_pub_rsa ?use ?alg pub takes a public key generated by mirage-crypto and returns a public t.

val make_pub_es256 : 
  ?use:Jwa.use ->
  ?alg:Jwa.alg ->
  Mirage_crypto_ec.P256.Dsa.pub ->
  public t

make_pub_es256 ?use ?alg pub takes a P-256 public key and returns a public t.

val make_pub_es384 : 
  ?use:Jwa.use ->
  ?alg:Jwa.alg ->
  Mirage_crypto_ec.P384.Dsa.pub ->
  public t

make_pub_es384 ?use ?alg pub takes a P-384 public key and returns a public t.

val make_pub_es512 : 
  ?use:Jwa.use ->
  ?alg:Jwa.alg ->
  Mirage_crypto_ec.P521.Dsa.pub ->
  public t

make_pub_es512 ?use ?alg pub takes a P-521 public key and returns a public t.

val make_pub_ed25519 : 
  ?use:Jwa.use ->
  ?alg:Jwa.alg ->
  Mirage_crypto_ec.Ed25519.pub ->
  public t

make_pub_ed25519 ?use ?alg pub takes an Ed25519 public key and returns a public t.

val of_pub_pem : 
  ?use:Jwa.use ->
  ?alg:Jwa.alg ->
  string ->
  (public t, [> `Msg of string | `Unsupported_kty ]) Stdlib.result

of_pub_pem ?use ?alg pem takes a PEM as a string and returns a public t or a message of what went wrong.

val to_pub_pem : 
  'a t ->
  (string, [> `Msg of string | `Unsupported_kty ]) Stdlib.result

to_pub_pem t takes a JWK and returns a result PEM string or a message of what went wrong.

val of_pub_json : 
  Yojson.Safe.t ->
  (public t,
    [> `Json_parse_failed of string | `Msg of string | `Unsupported_kty ])
    Stdlib.result

of_pub_json t takes a Yojson.Safe.t and tries to return a public t

val of_pub_json_string : 
  string ->
  (public t,
    [> `Json_parse_failed of string | `Msg of string | `Unsupported_kty ])
    Stdlib.result

of_pub_json_string json_string takes a JSON string representation and tries to return a public t

val to_pub_json : 'a t -> Yojson.Safe.t

to_pub_json t takes a priv t and returns a JSON representation

val to_pub_json_string : 'a t -> string

to_pub_json_string t takes a priv t and returns a JSON string representation

Private keys

These keys are not safe to show and should be used to sign content.

val make_priv_rsa : 
  ?use:Jwa.use ->
  ?alg:Jwa.alg ->
  Mirage_crypto_pk.Rsa.priv ->
  priv t

make_priv_rsa ?use ?alg priv takes a private key generated by mirage-crypto and returns a priv t.

val make_priv_es256 : 
  ?use:Jwa.use ->
  ?alg:Jwa.alg ->
  Mirage_crypto_ec.P256.Dsa.priv ->
  priv t

make_priv_es256 ?use ?alg priv takes a P-256 private key and returns a priv t.

val make_priv_es384 : 
  ?use:Jwa.use ->
  ?alg:Jwa.alg ->
  Mirage_crypto_ec.P384.Dsa.priv ->
  priv t

make_priv_es384 ?use ?alg priv takes a P-384 private key and returns a priv t.

val make_priv_es512 : 
  ?use:Jwa.use ->
  ?alg:Jwa.alg ->
  Mirage_crypto_ec.P521.Dsa.priv ->
  priv t

make_priv_es512 ?use ?alg priv takes a P-521 private key and returns a priv t.

val make_priv_ed25519 : 
  ?use:Jwa.use ->
  ?alg:Jwa.alg ->
  Mirage_crypto_ec.Ed25519.priv ->
  priv t

make_priv_ed25519 ?use ?alg priv takes an Ed25519 private key and returns a priv t.

val of_priv_pem : 
  ?use:Jwa.use ->
  ?alg:Jwa.alg ->
  string ->
  (priv t, [> `Msg of string | `Unsupported_kty ]) Stdlib.result

of_priv_pem ?use ?alg pem takes a PEM as a string and returns a priv t or a message of what went wrong.

val make_oct : ?use:Jwa.use -> ?alg:Jwa.alg -> string -> priv t

make_oct ?use ?alg secret creates a priv t from a shared secret

val to_priv_pem : 
  priv t ->
  (string, [> `Msg of string | `Unsupported_kty ]) Stdlib.result

to_priv_pem t takes a JWK and returns a result PEM string or a message of what went wrong.

val of_priv_x509 : 
  ?use:Jwa.use ->
  ?alg:Jwa.alg ->
  X509.Private_key.t ->
  (priv t, [> `Msg of string | `Unsupported_kty ]) Stdlib.result

val of_pub_x509 : 
  ?use:Jwa.use ->
  ?alg:Jwa.alg ->
  X509.Public_key.t ->
  (public t, [> `Msg of string | `Unsupported_kty ]) Stdlib.result

val of_priv_json : 
  Yojson.Safe.t ->
  (priv t,
    [> `Json_parse_failed of string | `Msg of string | `Unsupported_kty ])
    Stdlib.result

of_json json takes a Yojson.Safe.t and returns a priv t

val of_priv_json_string : 
  string ->
  (priv t,
    [> `Json_parse_failed of string | `Msg of string | `Unsupported_kty ])
    Stdlib.result

of_priv_json_string json_string takes a JSON string representation and tries to return a private t

val to_priv_json : priv t -> Yojson.Safe.t

to_json t takes a t and returns a Yojson.Safe.t

val to_priv_json_string : priv t -> string

to_priv_json_string t takes a priv t and returns a JSON string representation

val pub_of_priv : priv t -> public t

pub_of_priv t takes a priv t and returns the coresponding public key.

When using it on Oct keys it will just return the same as it's a symetric key.

Utils

Utils to get different data from a JWK

val get_kid : 'a t -> string option

get_kid jwk is a convencience function to get the kid string

val get_kty : 'a t -> Jwa.kty

get_kty jwk is a convencience function to get the key type

val get_alg : 'a t -> Jwa.alg option

get_alg jwk is a convencience function to get the algorithm

val get_thumbprint : 
  Digestif.hash' ->
  'a t ->
  (string, [> `Unsafe ]) Stdlib.result

get_thumbprint hash jwk calculates the thumbprint of jwk with hash, following RFC 7638.

Returns an error for symmetric keys: sharing the hash may leak information about the key itself and it's deemed unsafe.