<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
FYI, I made a JWK generator utility this afternoon, part of the
MITREid Connect app suite. Details in the post to the JOSE list,
below.<br>
<div class="moz-forward-container"><br>
-- Justin<br>
<br>
-------- Original Message --------
<table class="moz-email-headers-table" border="0" cellpadding="0"
cellspacing="0">
<tbody>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">Subject:
</th>
<td>[jose] JWK Generator</td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">Date: </th>
<td>Mon, 25 Mar 2013 16:36:03 -0400</td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">From: </th>
<td>Justin Richer <a class="moz-txt-link-rfc2396E" href="mailto:jricher@mitre.org"><jricher@mitre.org></a></td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">To: </th>
<td><a class="moz-txt-link-abbreviated" href="mailto:jose@ietf.org">jose@ietf.org</a> <a class="moz-txt-link-rfc2396E" href="mailto:jose@ietf.org"><jose@ietf.org></a></td>
</tr>
</tbody>
</table>
<br>
<br>
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
A while ago, several folks complained that there was no toolchain
for creating bare keys in the JWK/JPSK format. Indeed, my team's
been using Java's keytool program and making self-signed dummy
certs and pulling them out of there. That was a bit of a pain, to
be honest.<br>
<br>
So now I've just written a utility program to generate JWK
formatted keys from whole cloth given a set of parameters. It's a
Java app built using the NimbusDS JWT-JOSE library, and at the
moment it supports both RSA and oct keytypes, with an option to
extract the public-only portion of the RSA as well. This is all
based on the current JPSK format, which we plan to track with the
aforementioned Nimbus library.<br>
<br>
You can get the code here:<br>
<br>
<a moz-do-not-send="true" class="moz-txt-link-freetext"
href="https://github.com/mitreid-connect/json-web-key-generator">https://github.com/mitreid-connect/json-web-key-generator</a><br>
<br>
It's open sourced under an Apache 2.0 license, so feel free to
pull it down and use it to your heart's content. It's a Java Maven
project, so you build it with:<br>
<br>
mvn package<br>
<br>
This will create a couple of .jar files in the target/ directory,
one of which is an executable fat jar, usble from the commandline:<br>
<br>
<blockquote>
<pre>usage: java -jar json-web-key-generator.jar -t <keyType> -s <keySize> [-u</pre>
<pre> <keyUsage> -a <algorithm> -i <keyId> -p]</pre>
<pre> -a <arg> Algorithm.</pre>
<pre> -i <arg> Key ID (optional)</pre>
<pre> -p Display public key separately</pre>
<pre> -s <arg> Key Size in bits, must be an integer, generally divisible by 8</pre>
<pre> -t <arg> Key Type, one of: RSA, oct</pre>
<pre> -u <arg> Usage, one of: enc, sig. Defaults to sig</pre>
</blockquote>
<br>
For instance, to generate a 1024-bit RSA key with the algorithm of
RS256, no key id, and display the public key separately, you would
run (after doing a mvn package):<br>
<br>
java -jar
target/json-web-key-generator-0.1-SNAPSHOT-jar-with-dependencies.jar
-a RS256 -t RSA -s 1024 -p<br>
<br>
This prints out (for example, your keys should vary):<br>
<br>
<blockquote>
<pre>Full key:</pre>
<pre>{</pre>
<pre> "alg": "RS256",</pre>
<pre> "d": "IXhRb4mXMOLlX1nEcv--CRX5WjGZdUTHzI2qIg-iX5QXY-noSZqit-BeWO0CTwBtryCU4DgNIjV4cvYHpWqkr8ES-FoH7DHDgt41lH5_YDv-MeeCU3hRSPbACLuWEbWQfjgLPgIL1cmh1q-eFOEpXWUtKy7DCFymMves7ojPxY0",</pre>
<pre> "e": "AQAB",</pre>
<pre> "n": "kWkuetDiodUI-0jZ2KpmwOMJ7jsnO8qG8ChMs7ax3xXKIr5g5K0axWtXm1HwA5OJRE-OyVHfJkda6xVgTFaV1AhWP8Zp7KL_Oq-moKRe5-BtahHpFJe7HZ1P6hxXAdhaygXen1lR0NAMNi4K4H5pn1KDCeRpuxAhJZsQnq5dxp0",</pre>
<pre> "kty": "RSA",</pre>
<pre> "use": "sig"</pre>
<pre>}</pre>
<pre>Public key:</pre>
<pre>{</pre>
<pre> "alg": "RS256",</pre>
<pre> "e": "AQAB",</pre>
<pre> "n": "kWkuetDiodUI-0jZ2KpmwOMJ7jsnO8qG8ChMs7ax3xXKIr5g5K0axWtXm1HwA5OJRE-OyVHfJkda6xVgTFaV1AhWP8Zp7KL_Oq-moKRe5-BtahHpFJe7HZ1P6hxXAdhaygXen1lR0NAMNi4K4H5pn1KDCeRpuxAhJZsQnq5dxp0",</pre>
<pre> "kty": "RSA",</pre>
<pre> "use": "sig"</pre>
<pre>}</pre>
</blockquote>
<br>
To create a 256-bit symmetric key with algorithm HS256 and key id
of "myKey", you'd do:<br>
<br>
java -jar
target/json-web-key-generator-0.1-SNAPSHOT-jar-with-dependencies.jar
-t oct -s 256<br>
<br>
Which outputs something like:<br>
<br>
<blockquote>
<pre>Full key:</pre>
<pre>{</pre>
<pre> "kty": "oct",</pre>
<pre> "use": "sig",</pre>
<pre> "k": "CsoV5LeX6S3RRlLr-hk0_VyIuTOWyovMPbU2UmbphME"</pre>
<pre>}</pre>
</blockquote>
<br>
It doesn't do EC keys yet because I don't know the Java Magic
needed to make such a thing happen, but I'd be happy to have
someone help out with that with a pull request. <br>
<br>
Hopefully people find this utility useful. I've got a few features
I'm planning to add (write output to files, Java GUI with
dropdowns for options), but this is a minimally-useful set of
functionality.<br>
<br>
-- Justin<br>
<br>
</div>
<br>
</body>
</html>