importJWK without alg attribute or parameter

[loozhengyuan]

Hello, I would like to seek some clarifications regarding the importJWK function. I noted that in absence of the alg property in the JWK, it is required to provide the alg argument to the importJWK function. Is there a way we can dynamically import a JWK if we do not know the algorithm (and the alg property is not set on the JWK either)?

[panva]

No, that's why it's a required argument / property. This is necessary because of the way Web Cryptography API importKey is designed, without knowing the key's intended use algorithm there's no way to import.

[panva]

I think in the node.js runtime you may get away with putting anything in the alg argument, but that's only because there are validations missing on the import step which are then present on sign/verify/encrypt/decrypt operations. Doing so is not gonna harm now but if validations get added later, you'd have to fix your implementation.

[panva]

However, if your runtime is Node.js (is it?) just use the crypto.createPublicKey / crypto.createPrivateKey API with format: 'jwk' to end up with a KeyObject.

[loozhengyuan]

Ok understood, thank you for the prompt response and for this library. 👍