RFC 7517 Quiz (EN)

Q1: What does a JSON Web Key represent?

Multiple Choice

A. An OAuth authorization decision that applies to every resource server. B. A cryptographic key represented as a JSON object. C. An X.509 certification path that replaces certificate validation. D. A globally trusted identity established by possession of a kid value.

RFC 7517 Sections 2 and 4 define a JWK as a JSON object representing a cryptographic key and its properties. The format neither defines OAuth authorization nor makes `kid` a global identity or trust proof. A JWK can carry certificate-related members such as `x5c`, but the JWK definition is not itself an X.509 certification path or a substitute for validating one. Interpret the key representation first, then evaluate provenance, trust, and authorization separately.

Q2: Which statements follow from the JWK and JWK Set parsing rules? Select all that apply.

Multi-Select

A. Every JWK must contain a case-sensitive kty member. B. Every JWK must contain a kid member that is globally unique. C. An implementation must ignore additional JWK members it does not understand. D. The first key in a JWK Set is always the preferred verification key.

RFC 7517 Section 4.1 makes `kty` mandatory and case-sensitive, while Section 4 requires unrecognized additional members to be ignored. Section 4.5 leaves `kid` optional without global uniqueness, and Section 5.1 gives JWK Set array order no default preference. A parser therefore follows the stated member rules without inventing identity or ordering semantics.

Q3: How should a profile handle use and key_ops when both appear in one JWK?

Multiple Choice

A. Ignore key_ops because use always has normative priority. B. Combine the values even when they authorize unrelated operations. C. Treat any inconsistency as permission to follow the token header instead. D. Avoid using both where possible; if both occur, require them to be consistent.

RFC 7517 Section 4.3 discourages using `use` and `key_ops` together and requires their information to be consistent when both occur. It gives neither member automatic priority, and a message header cannot repair contradictory key metadata. A profile may select one representation, but it must not convert conflicting restrictions into permission.

Q4: A JWT header kid matches a JWK in a configured set. What has that match established?

Multiple Choice

A. The JWT issuer has been authenticated for every application. B. The selected key is globally unique across all JWK Sets. C. A candidate key has been selected; cryptographic and policy checks still remain. D. The algorithm in the JWT header overrides the verifier's allow-list.

RFC 7517 Section 4.5 defines `kid` as a matching aid, including during rollover, while leaving its structure unspecified and recommending distinct values only within a set. A match selects candidate key material; it does not authenticate the issuer, approve an algorithm, or complete verification. The identifier must remain scoped to the relevant trust context.

Q5: A public JWKS accidentally contains an oct JWK with its k member. What is the appropriate response?

Multiple Choice

A. Remove it from the public set, treat it as exposed, and protect replacement secret material. B. Keep it published because a symmetric JWK is useful only for verification. C. Retain it if the JWKS endpoint uses HTTPS, because transport protection makes it public-safe. D. Replace only the kid value, because that prevents use of the disclosed key bytes.

An `oct` JWK carries symmetric key material, so publishing its `k` value gives every recipient the secret rather than merely describing a public key. RFC 7517 Sections 9 and 9.2 require symmetric and private material to be protected from disclosure. TLS secures transport to each requester and changing `kid` changes only a label; neither reverses public disclosure of the key bytes.

Q6: Which statements about an x5c member are correct? Select all that apply.

Multi-Select

A. Each certificate is base64url-encoded and may appear in any chain order. B. The first certificate contains the represented key, which must match the JWK public key. C. Merely including x5c proves that the key is trusted by the receiving application. D. If use or alg is present, it must be semantically consistent with the first certificate.

RFC 7517 Section 4.7 encodes `x5c` certificates with base64, places the certificate containing the represented key first, and requires that key to match the other JWK members. The same section requires optional `use` and `alg` information to agree with the certificate. The chain still needs the provenance and application-trust evaluation described in Section 9.1; carrying certificates does not waive those checks.

Q7: Which rollover plan preserves verifiability without making kid an authorization mechanism?

Multiple Choice

An A2A issuer changes signing keys at noon. Tokens signed with the old key remain valid for one hour, but the published JWK Set removes the old key immediately.

A. Accept any key with the old kid from any issuer until the hour ends. B. Publish old and new verification keys for the required overlap, then retire the old key under the token policy. C. Reuse the old kid on the new unrelated key so cached verifiers continue without configuration changes. D. Let verifiers skip signatures for the remaining hour because the tokens were issued before rollover.

RFC 7517 Sections 4.5 and 5.1 provide a way to select among set members during rollover, but `kid` remains only a selector within the relevant trust context. If the application promises that old tokens remain acceptable for an hour, keeping the old verification key available for the necessary token and cache overlap is an operational consequence of that policy, not a universal RFC 7517 lifetime rule. Accepting another issuer's key, reusing an identifier ambiguously, or skipping signature verification would not preserve the stated trust boundary.

Q8: What should the verifier do with this x5c-bearing JWK?

Multiple Choice

A JWK contains RSA n and e values plus an x5c chain. The first certificate is valid under a configured trust anchor, but its subject public key is different from the RSA key formed by n and e.

A. Use the certificate key because a valid certification path overrides the JWK members. B. Use the n and e key because explicit JWK parameters override certificate content. C. Select whichever key makes the incoming signature verify successfully. D. Reject the JWK because the certificate key and the represented JWK key must match.

RFC 7517 Section 4.7 requires the public key in the first `x5c` certificate to match the key represented by the other JWK members. A valid certificate path does not cure contradictory key representations, nor may explicit parameters override the consistency rule. Trying both interpretations until one verifies would let attacker-controlled input choose the effective key, so the JWK must be rejected.

Q9: Which two review findings are justified for this shared-kid design? Select all that apply.

Multi-Select

A verifier aggregates JWK Sets from two unrelated issuers into one cache. Both contain kid=rotate-7. It selects the first match and then checks only the signature.

A. Key lookup must remain scoped to the issuer or other configured provenance context. B. A matching kid makes the first cached key authoritative across both issuers. C. The verifier must still decide whether the selected key is trusted for the asserted issuer and use. D. Successful signature verification alone establishes every claim and resource permission.

RFC 7517 Section 4.5 does not make `kid` globally unique, so aggregating two issuers and selecting only by that value creates an ambiguous lookup. Cache order cannot repair the problem because Section 5.1 assigns no default preference to JWK Set order. Following the trust guidance in Section 9.1, the verifier should scope key selection by issuer and provenance, then apply the relevant algorithm, claim, and resource-authorization policies separately.

Q10: Which end-to-end assessment correctly composes the guarantees in this A2A path?

Multiple Choice

An Agent Card names a JWKS URL. A gateway fetches that set over authenticated TLS, verifies an agent JWT, and forwards X-Agent-Id to a backend. The backend owns the resource policy but receives neither the JWT nor a protected attestation of the gateway's verification result.

A. The backend can authorize solely from X-Agent-Id because HTTPS retrieval made the JWK globally trusted. B. The Agent Card and kid together extend the original signature verification through every intermediary. C. The design must establish trust in the Agent Card-to-key association and protect the gateway assertion used by backend policy. D. The backend must reject every gateway architecture because RFC 7517 requires direct JWT verification by the resource owner.

RFC 7517 Section 9.1 ties confidence to how a key was obtained and to the trusted entity asserting its association; it does not grant that key every identity or resource role. TLS can authenticate JWKS retrieval, but neither an Agent Card reference nor `kid` protects a newly created header on a later hop. RFC 7517 does not prescribe the gateway-to-backend mechanism. Under the stated design, however, the backend can rely on the gateway claim only if that trust boundary protects the assertion and the backend applies an explicit local authorization rule.

JSON Web Key (JWK)

Primary reference

Q1: What does a JSON Web Key represent?

Q2: Which statements follow from the JWK and JWK Set parsing rules? Select all that apply.

Q3: How should a profile handle use and key_ops when both appear in one JWK?

Q4: A JWT header kid matches a JWK in a configured set. What has that match established?

Q5: A public JWKS accidentally contains an oct JWK with its k member. What is the appropriate response?

Q6: Which statements about an x5c member are correct? Select all that apply.

Q7: Which rollover plan preserves verifiability without making kid an authorization mechanism?

Q8: What should the verifier do with this x5c-bearing JWK?

Q9: Which two review findings are justified for this shared-kid design? Select all that apply.

Q10: Which end-to-end assessment correctly composes the guarantees in this A2A path?