How to compute a JWK thumbprint (RFC 7638) in Python

1import base64
2import hashlib
3import json
4 
5# RFC 7638: the required members of each key type
6REQUIRED = {"EC": ("crv", "kty", "x", "y"), "RSA": ("e", "kty", "n"), "OKP": ("crv", "kty", "x"), "oct": ("k", "kty")}
7 
8 
9def jwk_thumbprint(jwk: dict) -> str:
10    members = {name: jwk[name] for name in REQUIRED[jwk["kty"]]}
11    # sorted names, no whitespace, UTF-8
12    canonical = json.dumps(members, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode()
13    digest = hashlib.sha256(canonical).digest()
14    return base64.urlsafe_b64encode(digest).rstrip(b"=").decode()
15 
16 
17for name in ("ec.jwk.json", "rsa.jwk.json", "okp.jwk.json"):
18    with open(name) as f:
19        print(f"{name}: {jwk_thumbprint(json.load(f))}")

1from cryptography.hazmat.primitives.asymmetric import ec, ed25519, rsa
2from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat, load_pem_public_key
3 
4 
5def b64url_uint(value: int, length: int = 0) -> str:
6    """Big-endian, minimal length unless a fixed length is given (EC coordinates)."""
7    raw = value.to_bytes(length or (value.bit_length() + 7) // 8, "big")
8    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
9 
10 
11def public_jwk(pem: bytes) -> dict:
12    key = load_pem_public_key(pem)
13    if isinstance(key, ec.EllipticCurvePublicKey):
14        size = (key.curve.key_size + 7) // 8  # 32 bytes for P-256, 66 for P-521
15        crv = {"secp256r1": "P-256", "secp384r1": "P-384", "secp521r1": "P-521"}[key.curve.name]
16        n = key.public_numbers()
17        return {"kty": "EC", "crv": crv, "x": b64url_uint(n.x, size), "y": b64url_uint(n.y, size)}
18    if isinstance(key, rsa.RSAPublicKey):
19        n = key.public_numbers()
20        return {"kty": "RSA", "n": b64url_uint(n.n), "e": b64url_uint(n.e)}
21    if isinstance(key, ed25519.Ed25519PublicKey):
22        raw = key.public_bytes(Encoding.Raw, PublicFormat.Raw)
23        return {"kty": "OKP", "crv": "Ed25519", "x": base64.urlsafe_b64encode(raw).rstrip(b"=").decode()}
24    raise TypeError(f"unsupported key type {type(key).__name__}")
25 
26 
27for name in ("ec.pub.pem", "rsa.pub.pem", "okp.pub.pem"):
28    with open(name, "rb") as f:
29        print(f"{name}: {jwk_thumbprint(public_jwk(f.read()))}")