Re: RSA JWK import

On Fri, Aug 19, 2016 at 12:38 PM, Eric Roman <ericroman@google.com> wrote:

> Perhaps JWA would be willing to change that SHOULD to a MUST, and then
> consumers needn't concern themselves with their absence.
>

I doubt that spec will change.

The archives contain the motivation - it's a security nightmare in
virtually every implementation if you omit the parameters. Certainly, when
doing private key operations, if you don't have the parameters, then most
of your JWA implementations will disable RSA blinding, which can end up
leaking your key.

See https://tools.ietf.org/html/rfc7518#section-8.14