JSON Web Keys (RFC 7517) for the ATProto OAuth profile.
ATProto OAuth uses elliptic-curve JWKs — P-256 for the spec-required
ES256 (and optionally secp256k1 for ES256K) — as the client's long-term
authentication key and as the per-session DPoP key.
Keys are represented as plain maps (%{"kty" => "EC", "crv" => ..., "x" => ..., "y" => ..., "d" => ...} with x/y/d base64url-encoded
coordinates); private keys additionally carry "d" and must never be
embedded in a client metadata document or DPoP proof header.
Examples
{:ok, jwk} = Exosphere.ATProto.OAuth.JWK.generate(:p256)
public = Exosphere.ATProto.OAuth.JWK.to_public(jwk)Summary
Functions
Convert an ATProto.Crypto keypair into a private JWK map.
Generate a new keypair as a private JWK map.
RFC 7638 JWK thumbprint: BASE64URL(SHA256(canonical JSON)) over the
required members for the key type, in lexicographic order.
Strip the private "d" member, returning the public JWK map.
Parse a public JWK map back into an ATProto.Crypto compressed public key.
Types
Functions
@spec from_keypair(Exosphere.ATProto.Crypto.keypair(), curve()) :: {:ok, t()} | {:error, term()}
Convert an ATProto.Crypto keypair into a private JWK map.
The public key may be compressed (33 bytes) or uncompressed (65 bytes).
Generate a new keypair as a private JWK map.
RFC 7638 JWK thumbprint: BASE64URL(SHA256(canonical JSON)) over the
required members for the key type, in lexicographic order.
Strip the private "d" member, returning the public JWK map.
@spec to_public_key(t()) :: {:ok, binary(), Exosphere.ATProto.Crypto.curve()} | {:error, term()}
Parse a public JWK map back into an ATProto.Crypto compressed public key.
Only elliptic-curve keys on the supported curves parse.