diff --git a/src/joserfc/_keys.py b/src/joserfc/_keys.py index cbb5d26..e33ab7e 100644 --- a/src/joserfc/_keys.py +++ b/src/joserfc/_keys.py @@ -167,7 +167,13 @@ def import_key_set(cls, value: KeySetSerialization, parameters: KeyParameters | keys: list[Key] = [] for data in value["keys"]: - keys.append(cls.registry_cls.import_key(data, parameters=parameters)) + # RFC 7517, Section 5: ignore a key whose "kty" is not understood + # rather than failing the whole set (for example a post-quantum key + # published alongside classical ones). + try: + keys.append(cls.registry_cls.import_key(data, parameters=parameters)) + except InvalidKeyTypeError: + continue if not keys: raise MissingKeyError("No keys to import") diff --git a/tests/jwk/test_jwk_set.py b/tests/jwk/test_jwk_set.py index 45f9e38..06c4bbc 100644 --- a/tests/jwk/test_jwk_set.py +++ b/tests/jwk/test_jwk_set.py @@ -11,6 +11,16 @@ class TestKeySet(TestCase): def test_import_empty_key_set(self): self.assertRaises(MissingKeyError, KeySet.import_key_set, {"keys": []}) + def test_import_key_set_ignores_unknown_kty(self): + # RFC 7517 Section 5: a key with an unrecognised "kty" is ignored, not fatal. + jwks = {"keys": [ + {"kty": "unknown", "alg": "X", "kid": "unknown"}, + {"kty": "oct", "k": "MDEyMzQ1Njc4OWFiY2RlZg", "kid": "classical"}, + ]} + key_set = KeySet.import_key_set(jwks) + self.assertEqual(len(key_set.keys), 1) + self.assertEqual(key_set.keys[0].kid, "classical") + def test_generate_and_import_key_set(self): jwks1 = KeySet.generate_key_set("RSA", 2048) self.assertEqual(len(jwks1.keys), 4)