Update Public Key JWT

To ensure the registered public key of an IoT device can only be updated by the device itself, the IoT device has to authenticate to the IoT IdP by providing a private key JWT. However, the structure of the JWT differs slightly from the JWT used to authenticate against the token API of the IoT identity provider.

Structure

The only difference to the JWT used to authenticate to the token API is an additional claim in the body of the JWT that contains the new public key that the IoT device wants to update. An example of what an assembled JWT to update a registered public key may look like is displayed below.

eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6InRlc3QuZGV2aWNlLjAxIn0.eyJzdWIiOiJ0ZXN0LmRldmljZS4wMSIsInB1YmxpY19rZXkiOiItLS0tLUJFR0lOIFBVQkxJQyBLRVktLS0tLU1Ga3dFd1lIS29aSXpqMENBUVlJS29aSXpqMERBUWNEUWdBRTBEUGwveEV2bWFCL2RpNjk1UkorcWZJZEw1NlNuZXYwUGRxVUdobWJKWXFQZ2tUZDJSc1RGanQ2VFNaLzFIbGx1U1hCVCtPN05za2ErQzhyRms0d09nPT0tLS0tLUVORCBQVUJMSUMgS0VZLS0tLS0iLCJqdGkiOiI2OTNDQTdERTY0NDdENDZDNTE1MTQ4NDhGRjA5RUY2QiJ9.N0Z-GmR-NCrLgD3Cf6xWtQ-Wp1VYhw-UpOIKA2e7aUta5EPwCInPW8ycwfOdRpPCVRHSrKc2q0j5pBz-qJiZ4A

Header

The header object contains three claims:

• alg: The cryptographic algorithm used to generate the signature of the JWT.

• typ: The type of JWT the object represents. Has to be set to JWT.

• kid: The id of the key used to generate the signature of the JWT. This claim has to correspond to the device ID registered with IoT IdP.

An example of how a JWT header may look is displayed below.

{
  "alg": "ES256",
  "typ": "JWT",
  "kid": "test-device-01"
}

Body

The body has two contain two claims

• sub: The subject of the JWT. This claim has to correspond to the device ID registered with the IoT IdP.

• public_key: This claim contains a PEM representation of the new public key that should be updated.

• jti: The JWT ID is a 32-byte long hexadecimal random number, which has to be unique. As a result, preventing replay attacks and ensures that an issued JWT can only be used once for each device.

An example of how a JWT body may look is displayed below.

{
  "sub": "test-device-01",
  "public_key": "-----BEGIN PUBLIC KEY-----MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE0DPl/xEvmaB/di695RJ+qfIdL56Snev0PdqUGhmbJYqPgkTd2RsTFjt6TSZ/1HlluSXBT+O7Nska+C8rFk4wOg==-----END PUBLIC KEY-----"
  "jti": "693CA7DE6447D46C51514848FF09EF6B"
}

Signature

The signature is generated using the private key that corresponds to the registered public key and the defined algorithm in the alg claim of the header, e.g. for the above-displayed header the signature is calculated as follows.

ECDSASHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload)
)