From 2e21fc716eed94c089c0b922d122f421a12d0dc7 Mon Sep 17 00:00:00 2001 From: Ralph Bragg Date: Fri, 24 Jul 2026 13:01:57 +1000 Subject: [PATCH 1/2] Ignore unknown kty in KeySet.import_key_set (RFC 7517 Section 5) import_key_set raised InvalidKeyTypeError on the first key whose kty was not in the registry, failing the whole set. Skip a key whose kty is present but unrecognised, per RFC 7517 Section 5, so classical keys published alongside a post-quantum key (ML-DSA, kty AKP) remain usable. --- src/joserfc/_keys.py | 7 +++++++ tests/jwk/test_jwk_set.py | 10 ++++++++++ 2 files changed, 17 insertions(+) diff --git a/src/joserfc/_keys.py b/src/joserfc/_keys.py index cbb5d26..35db7c7 100644 --- a/src/joserfc/_keys.py +++ b/src/joserfc/_keys.py @@ -167,6 +167,13 @@ def import_key_set(cls, value: KeySetSerialization, parameters: KeyParameters | keys: list[Key] = [] for data in value["keys"]: + # RFC 7517, Section 5: ignore a key whose "kty" is not understood + # rather than failing the whole set (for example a post-quantum key + # published alongside classical ones). + if isinstance(data, dict): + kty = data.get("kty") + if kty is not None and kty not in cls.registry_cls.key_types: + continue keys.append(cls.registry_cls.import_key(data, parameters=parameters)) if not keys: diff --git a/tests/jwk/test_jwk_set.py b/tests/jwk/test_jwk_set.py index 45f9e38..06c4bbc 100644 --- a/tests/jwk/test_jwk_set.py +++ b/tests/jwk/test_jwk_set.py @@ -11,6 +11,16 @@ class TestKeySet(TestCase): def test_import_empty_key_set(self): self.assertRaises(MissingKeyError, KeySet.import_key_set, {"keys": []}) + def test_import_key_set_ignores_unknown_kty(self): + # RFC 7517 Section 5: a key with an unrecognised "kty" is ignored, not fatal. + jwks = {"keys": [ + {"kty": "unknown", "alg": "X", "kid": "unknown"}, + {"kty": "oct", "k": "MDEyMzQ1Njc4OWFiY2RlZg", "kid": "classical"}, + ]} + key_set = KeySet.import_key_set(jwks) + self.assertEqual(len(key_set.keys), 1) + self.assertEqual(key_set.keys[0].kid, "classical") + def test_generate_and_import_key_set(self): jwks1 = KeySet.generate_key_set("RSA", 2048) self.assertEqual(len(jwks1.keys), 4) From ea19ea611a9d56716d2ea86107b91821729e4df7 Mon Sep 17 00:00:00 2001 From: Ralph Bragg Date: Sat, 25 Jul 2026 12:16:04 +1000 Subject: [PATCH 2/2] Use try/except InvalidKeyTypeError per maintainer feedback Switch from a pre-check of the kty registry to catching InvalidKeyTypeError per key, as suggested by @lepture. Same behaviour: an unrecognised key type is skipped (RFC 7517 Section 5) while the rest of the set loads. --- src/joserfc/_keys.py | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/src/joserfc/_keys.py b/src/joserfc/_keys.py index 35db7c7..e33ab7e 100644 --- a/src/joserfc/_keys.py +++ b/src/joserfc/_keys.py @@ -170,11 +170,10 @@ def import_key_set(cls, value: KeySetSerialization, parameters: KeyParameters | # RFC 7517, Section 5: ignore a key whose "kty" is not understood # rather than failing the whole set (for example a post-quantum key # published alongside classical ones). - if isinstance(data, dict): - kty = data.get("kty") - if kty is not None and kty not in cls.registry_cls.key_types: - continue - keys.append(cls.registry_cls.import_key(data, parameters=parameters)) + try: + keys.append(cls.registry_cls.import_key(data, parameters=parameters)) + except InvalidKeyTypeError: + continue if not keys: raise MissingKeyError("No keys to import")