{
  "schema_version": "1.0.0",
  "record_type": "citation-evidence-pack",
  "pack_id": "jwk-thumbprint-calculator",
  "title": "RFC 7638 JWK thumbprint evidence",
  "description": "Canonical JWK and SHA-256 outcomes showing a known thumbprint, metadata invariance, and a missing required member.",
  "scope": "These cases prove RFC 7638 canonicalization for the supported public key families. A thumbprint identifies key material; it does not establish publisher trust.",
  "canonical_url": "https://encrypt-online.com/evidence/jwk-thumbprint-calculator.json",
  "tool": {
    "id": "jwk-thumbprint-calculator",
    "name": "JWK Thumbprint Calculator",
    "path": "/tools/jwk-thumbprint-calculator",
    "canonical_url": "https://encrypt-online.com/tools/jwk-thumbprint-calculator"
  },
  "implementation": {
    "version": "source-sha256:31fc99b47da53d11",
    "aggregate_sha256": "31fc99b47da53d11ba0efdd878860929142c869f3477091bab155629211f048b",
    "sources": [
      {
        "path": "lib/jose-tools-core.mjs",
        "sha256": "88898378d28dfeacd66ad9d8dc90e687b3265efc0bd505585946d750c6545a4f"
      },
      {
        "path": "lib/browser-security-fixtures.mjs",
        "sha256": "77c7622557ad876d4c62b09a18ffb3d4f71374081ae44a8487282620f916557f"
      }
    ]
  },
  "verification": {
    "last_verified": "2026-08-05",
    "command": "npm run check:citation-evidence",
    "environments": [
      "Node.js release check with Web Crypto",
      "Chromium desktop 1440x900 evidence presentation"
    ]
  },
  "standards": [
    {
      "name": "JSON Web Key (JWK) Thumbprint",
      "section": "Sections 3 and 3.2",
      "url": "https://www.rfc-editor.org/rfc/rfc7638#section-3"
    }
  ],
  "cases": [
    {
      "case_id": "JWK-RSA-THUMBPRINT-VALID-001",
      "classification": "valid",
      "symptom": "A synthetic RSA JWK produces the fixed canonical JSON and SHA-256 thumbprint.",
      "safe_input": {
        "jwk": {
          "kid": "solo-rsa-key",
          "kty": "RSA",
          "alg": "RS256",
          "use": "sig",
          "n": "w7Z4SingleJwkExampleModulusValueForInspector",
          "e": "AQAB",
          "x5t": "demo-thumbprint-sha1"
        }
      },
      "expected_output": {
        "status": "calculated",
        "canonical_json": "{\"e\":\"AQAB\",\"kty\":\"RSA\",\"n\":\"w7Z4SingleJwkExampleModulusValueForInspector\"}",
        "base64url": "BvUC2eD-NX4QCsYEe1TRWIx6ErcNtlNvqvINjY6-oPE",
        "hex": "06f502d9e0fe357e100ac6047b54d1588c7a12b70db6536faaf20d8d8ebea0f1",
        "ignored_fields": [
          "kid",
          "alg",
          "use",
          "x5t"
        ]
      },
      "failure_code": null,
      "expected_outcome": "Use the thumbprint as a key-material identifier, not a trust decision.",
      "fixture_sha256": "627a78f30a4f60062eee32876a82af0a4f326bd444618fcdb111d4fb7b092fd3"
    },
    {
      "case_id": "JWK-METADATA-INVARIANT-002",
      "classification": "mismatch",
      "symptom": "Publisher metadata changes while the RSA public key members stay the same.",
      "safe_input": {
        "jwk": {
          "kid": "rotated-label",
          "kty": "RSA",
          "alg": "PS256",
          "use": "enc",
          "n": "w7Z4SingleJwkExampleModulusValueForInspector",
          "e": "AQAB",
          "x5t": "demo-thumbprint-sha1"
        }
      },
      "expected_output": {
        "status": "calculated",
        "canonical_json": "{\"e\":\"AQAB\",\"kty\":\"RSA\",\"n\":\"w7Z4SingleJwkExampleModulusValueForInspector\"}",
        "base64url": "BvUC2eD-NX4QCsYEe1TRWIx6ErcNtlNvqvINjY6-oPE",
        "hex": "06f502d9e0fe357e100ac6047b54d1588c7a12b70db6536faaf20d8d8ebea0f1",
        "ignored_fields": [
          "kid",
          "alg",
          "use",
          "x5t"
        ]
      },
      "failure_code": "METADATA_IGNORED_BY_RFC7638",
      "expected_outcome": "Do not expect kid, alg, use, or x5t changes to alter the RFC 7638 thumbprint.",
      "fixture_sha256": "938f913aebd90dcabeb225c9445fed99cd6ba9cdc5dce82c4d89c26c4f09a99a"
    },
    {
      "case_id": "JWK-RSA-MISSING-MODULUS-003",
      "classification": "malformed",
      "symptom": "An RSA JWK omits the required modulus member n.",
      "safe_input": {
        "jwk": {
          "kty": "RSA",
          "e": "AQAB"
        }
      },
      "expected_output": {
        "status": "rejected",
        "message": "RSA JWK is missing n."
      },
      "failure_code": "INVALID_JWK",
      "expected_outcome": "Reject before hashing.",
      "fixture_sha256": "e0fddcffac2032a028f8c95e21e4b45f2d4243147c4a8b88ee38fe3216d5d19f"
    }
  ]
}