Add Kid header to JWK Keys generated from Tink JWT Keys.

- Tink keys with output prefix "TINK" will be exported into a JWK with a kid.
- The kid is the base64-encoded keyId.
- Any JWK with a kid that can be decoded into a keyId is imported as "TINK" key.
- Any JWK without kid or with a kid that cannot be decoded is imported as "RAW" key.

PiperOrigin-RevId: 374828288

1 files changed, 8 insertions, 0 deletions

diff --git a/java_src/src/main/java/com/google/crypto/tink/jwt/JwtFormat.java b/java_src/src/main/java/com/google/crypto/tink/jwt/JwtFormat.java
index eb05116fa..62d8fa4c7 100644
--- a/java_src/src/main/java/com/google/crypto/tink/jwt/JwtFormat.java
+++ b/java_src/src/main/java/com/google/crypto/tink/jwt/JwtFormat.java
@@ -186,6 +186,14 @@ final class JwtFormat {
     throw new JwtInvalidException("unsupported output prefix type");
   }
 
+  static Optional<Integer> getKeyId(String kid) {
+    byte[] encodedKeyId = Base64.urlSafeDecode(kid);
+    if (encodedKeyId.length != 4) {
+      return Optional.empty();
+    }
+    return Optional.of(ByteBuffer.wrap(encodedKeyId).getInt());
+  }
+
   static Parts splitSignedCompact(String signedCompact) throws JwtInvalidException {
       validateASCII(signedCompact);
       int sigPos = signedCompact.lastIndexOf('.');