Package com.nimbusds.jose.jwk
Class ECKey.Builder
- java.lang.Object
-
- com.nimbusds.jose.jwk.ECKey.Builder
-
- Enclosing class:
- ECKey
public static class ECKey.Builder extends Object
Builder for constructing Elliptic Curve JWKs.Example usage:
ECKey key = new ECKey.Builder(Curve.P521, x, y) .d(d) .algorithm(JWSAlgorithm.ES512) .keyID("1") .build();
-
-
Method Summary
All Methods Instance Methods Concrete Methods Deprecated Methods Modifier and Type Method Description ECKey.Builder
algorithm(Algorithm alg)
Sets the intended JOSE algorithm (alg
) for the JWK.ECKey
build()
Builds a new Elliptic Curve JWK.ECKey.Builder
d(Base64URL d)
Sets the private 'd' coordinate for the elliptic curve point.ECKey.Builder
keyID(String kid)
Sets the ID (kid
) of the JWK.ECKey.Builder
keyIDFromThumbprint()
Sets the ID (kid
) of the JWK to its SHA-256 JWK thumbprint (RFC 7638).ECKey.Builder
keyIDFromThumbprint(String hashAlg)
Sets the ID (kid
) of the JWK to its JWK thumbprint (RFC 7638).ECKey.Builder
keyOperations(Set<KeyOperation> ops)
Sets the operations (key_ops
) of the JWK.ECKey.Builder
keyStore(KeyStore keyStore)
Sets the underlying key store.ECKey.Builder
keyUse(KeyUse use)
Sets the use (use
) of the JWK.ECKey.Builder
privateKey(ECPrivateKey priv)
Sets the private Elliptic Curve key.ECKey.Builder
privateKey(PrivateKey priv)
Sets the private EC key, typically for a key located in a PKCS#11 store that doesn't expose the private key parameters (such as a smart card or HSM).ECKey.Builder
x509CertChain(List<Base64> x5c)
Sets the X.509 certificate chain (x5c
) of the JWK.ECKey.Builder
x509CertSHA256Thumbprint(Base64URL x5t256)
Sets the X.509 certificate SHA-256 thumbprint (x5t#S256
) of the JWK.ECKey.Builder
x509CertThumbprint(Base64URL x5t)
Deprecated.ECKey.Builder
x509CertURL(URI x5u)
Sets the X.509 certificate URL (x5u
) of the JWK.
-
-
-
Constructor Detail
-
Builder
public Builder(Curve crv, Base64URL x, Base64URL y)
Creates a new Elliptic Curve JWK builder.- Parameters:
crv
- The cryptographic curve. Must not benull
.x
- The public 'x' coordinate for the elliptic curve point. It is represented as the Base64URL encoding of the coordinate's big endian representation. Must not benull
.y
- The public 'y' coordinate for the elliptic curve point. It is represented as the Base64URL encoding of the coordinate's big endian representation. Must not benull
.
-
Builder
public Builder(Curve crv, ECPublicKey pub)
Creates a new Elliptic Curve JWK builder.- Parameters:
crv
- The cryptographic curve. Must not benull
.pub
- The public EC key to represent. Must not benull
.
-
-
Method Detail
-
d
public ECKey.Builder d(Base64URL d)
Sets the private 'd' coordinate for the elliptic curve point. The alternative method isprivateKey(java.security.interfaces.ECPrivateKey)
.- Parameters:
d
- The private 'd' coordinate. It is represented as the Base64URL encoding of the coordinate's big endian representation.null
if not specified (for a public key).- Returns:
- This builder.
-
privateKey
public ECKey.Builder privateKey(ECPrivateKey priv)
Sets the private Elliptic Curve key. The alternative method isd
.- Parameters:
priv
- The private EC key, used to obtain the private 'd' coordinate for the elliptic curve point.null
if not specified (for a public key).- Returns:
- This builder.
-
privateKey
public ECKey.Builder privateKey(PrivateKey priv)
Sets the private EC key, typically for a key located in a PKCS#11 store that doesn't expose the private key parameters (such as a smart card or HSM).- Parameters:
priv
- The private EC key reference. Its algorithm must be "EC". Must not benull
.- Returns:
- This builder.
-
keyUse
public ECKey.Builder keyUse(KeyUse use)
Sets the use (use
) of the JWK.- Parameters:
use
- The key use,null
if not specified or if the key is intended for signing as well as encryption.- Returns:
- This builder.
-
keyOperations
public ECKey.Builder keyOperations(Set<KeyOperation> ops)
Sets the operations (key_ops
) of the JWK.- Parameters:
ops
- The key operations,null
if not specified.- Returns:
- This builder.
-
algorithm
public ECKey.Builder algorithm(Algorithm alg)
Sets the intended JOSE algorithm (alg
) for the JWK.- Parameters:
alg
- The intended JOSE algorithm,null
if not specified.- Returns:
- This builder.
-
keyID
public ECKey.Builder keyID(String kid)
Sets the ID (kid
) of the JWK. The key ID can be used to match a specific key. This can be used, for instance, to choose a key within aJWKSet
during key rollover. The key ID may also correspond to a JWS/JWEkid
header parameter value.- Parameters:
kid
- The key ID,null
if not specified.- Returns:
- This builder.
-
keyIDFromThumbprint
public ECKey.Builder keyIDFromThumbprint() throws JOSEException
Sets the ID (kid
) of the JWK to its SHA-256 JWK thumbprint (RFC 7638). The key ID can be used to match a specific key. This can be used, for instance, to choose a key within aJWKSet
during key rollover. The key ID may also correspond to a JWS/JWEkid
header parameter value.- Returns:
- This builder.
- Throws:
JOSEException
- If the SHA-256 hash algorithm is not supported.
-
keyIDFromThumbprint
public ECKey.Builder keyIDFromThumbprint(String hashAlg) throws JOSEException
Sets the ID (kid
) of the JWK to its JWK thumbprint (RFC 7638). The key ID can be used to match a specific key. This can be used, for instance, to choose a key within aJWKSet
during key rollover. The key ID may also correspond to a JWS/JWEkid
header parameter value.- Parameters:
hashAlg
- The hash algorithm for the JWK thumbprint computation. Must not benull
.- Returns:
- This builder.
- Throws:
JOSEException
- If the hash algorithm is not supported.
-
x509CertURL
public ECKey.Builder x509CertURL(URI x5u)
Sets the X.509 certificate URL (x5u
) of the JWK.- Parameters:
x5u
- The X.509 certificate URL,null
if not specified.- Returns:
- This builder.
-
x509CertThumbprint
@Deprecated public ECKey.Builder x509CertThumbprint(Base64URL x5t)
Deprecated.Sets the X.509 certificate SHA-1 thumbprint (x5t
) of the JWK.- Parameters:
x5t
- The X.509 certificate SHA-1 thumbprint,null
if not specified.- Returns:
- This builder.
-
x509CertSHA256Thumbprint
public ECKey.Builder x509CertSHA256Thumbprint(Base64URL x5t256)
Sets the X.509 certificate SHA-256 thumbprint (x5t#S256
) of the JWK.- Parameters:
x5t256
- The X.509 certificate SHA-256 thumbprint,null
if not specified.- Returns:
- This builder.
-
x509CertChain
public ECKey.Builder x509CertChain(List<Base64> x5c)
Sets the X.509 certificate chain (x5c
) of the JWK.- Parameters:
x5c
- The X.509 certificate chain as a unmodifiable list,null
if not specified.- Returns:
- This builder.
-
keyStore
public ECKey.Builder keyStore(KeyStore keyStore)
Sets the underlying key store.- Parameters:
keyStore
- Reference to the underlying key store,null
if none.- Returns:
- This builder.
-
build
public ECKey build()
Builds a new Elliptic Curve JWK.- Returns:
- The Elliptic Curve JWK.
- Throws:
IllegalStateException
- If the JWK parameters were inconsistently specified.
-
-