JwkOperation: "encrypt" | "decrypt" | "sign" | "verify" | "deriveKey" | "deriveBits" | "wrapKey" | "unwrapKey"

JSON Web Key Operations

The "key_ops" (key operations) parameter identifies the operation(s) for which the key is intended to be used. The "key_ops" parameter is intended for use cases in which public, private, or symmetric keys may be present.

Its value is an array of key operation values. Values defined by RFC 7517 Section 4.3 are:

  • "decrypt" : Decrypt content and validate decryption, if applicable
  • "deriveBits" : Derive bits not to be used as a key
  • "deriveKey" : Derive key
  • "encrypt" : Encrypt content
  • "sign" : Compute digital signature or MAC
  • "unwrapKey" : Decrypt key and validate decryption, if applicable
  • "verify" : Verify digital signature or MAC
  • "wrapKey" : Encrypt key

Other values MAY be used. The key operation values are case- sensitive strings. Duplicate key operation values MUST NOT be present in the array. Use of the "key_ops" member is OPTIONAL, unless the application requires its presence.

The "use" and "key_ops" JWK members SHOULD NOT be used together; however, if both are used, the information they convey MUST be consistent. Applications should specify which of these members they use, if either is to be used by the application.