#### [Abblix\.Jwt](https://www.abblix.com/docs/api/abblix-jwt 'index')
### [Abblix\.Jwt](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt 'Abblix\.Jwt')

## JsonWebKeyExtensions Class

Provides extension methods for the JsonWebKey model to simplify the process of populating its properties from different sources\.
These methods enable easy conversion between JsonWebKey and various cryptographic representations\.

```csharp
public static class JsonWebKeyExtensions
```

Inheritance [System\.Object](https://learn.microsoft.com/en-us/dotnet/api/system.object 'System\.Object') → JsonWebKeyExtensions
### Fields

## JsonWebKeyExtensions\.MinimumRsaKeyBits Field {#Abblix.Jwt.JsonWebKeyExtensions.MinimumRsaKeyBits}

The smallest RSA modulus RFC 7518 permits\. Four sections state it, one per family: Section 3\.3
and Section 3\.5 for signing, Section 4\.2 and Section 4\.3 for key encryption\. Almost the same
words \- 3\.3 and 4\.3 govern several algorithms and say "these", 3\.5 and 4\.2 govern one and say
"this"\. One number here, so the sites that enforce it cannot drift apart\.

```csharp
public const int MinimumRsaKeyBits = 2048;
```

#### Field Value
[System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32')
### Methods

## JsonWebKeyExtensions\.Apply\(this EllipticCurveJsonWebKey, ECParameters\) Method {#Abblix.Jwt.JsonWebKeyExtensions.Apply(thisAbblix.Jwt.EllipticCurveJsonWebKey,System.Security.Cryptography.ECParameters)}

Applies Elliptic Curve parameters to an EllipticCurveJsonWebKey\.

```csharp
public static Abblix.Jwt.EllipticCurveJsonWebKey Apply(this Abblix.Jwt.EllipticCurveJsonWebKey jwk, System.Security.Cryptography.ECParameters parameters);
```
#### Parameters

###### `jwk` [EllipticCurveJsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.Apply(thisAbblix.Jwt.EllipticCurveJsonWebKey,System.Security.Cryptography.ECParameters).jwk}

The EllipticCurveJsonWebKey to which the EC parameters are to be applied\.

###### `parameters` [System\.Security\.Cryptography\.ECParameters](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.ecparameters 'System\.Security\.Cryptography\.ECParameters') {#Abblix.Jwt.JsonWebKeyExtensions.Apply(thisAbblix.Jwt.EllipticCurveJsonWebKey,System.Security.Cryptography.ECParameters).parameters}

The ECParameters providing the Elliptic Curve key information\.

#### Returns
[EllipticCurveJsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey')  
The updated EllipticCurveJsonWebKey with applied Elliptic Curve parameters\.

## JsonWebKeyExtensions\.Apply\(this RsaJsonWebKey, RSAParameters\) Method {#Abblix.Jwt.JsonWebKeyExtensions.Apply(thisAbblix.Jwt.RsaJsonWebKey,System.Security.Cryptography.RSAParameters)}

Applies RSA parameters to an RsaJsonWebKey\.

```csharp
public static Abblix.Jwt.RsaJsonWebKey Apply(this Abblix.Jwt.RsaJsonWebKey jwk, System.Security.Cryptography.RSAParameters parameters);
```
#### Parameters

###### `jwk` [RsaJsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.Apply(thisAbblix.Jwt.RsaJsonWebKey,System.Security.Cryptography.RSAParameters).jwk}

The RsaJsonWebKey to which the RSA parameters are to be applied\.

###### `parameters` [System\.Security\.Cryptography\.RSAParameters](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsaparameters 'System\.Security\.Cryptography\.RSAParameters') {#Abblix.Jwt.JsonWebKeyExtensions.Apply(thisAbblix.Jwt.RsaJsonWebKey,System.Security.Cryptography.RSAParameters).parameters}

The RSAParameters providing the RSA key information\.

#### Returns
[RsaJsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey')  
The updated RsaJsonWebKey with applied RSA parameters\.

## JsonWebKeyExtensions\.Apply\<T\>\(this T, X509Certificate2\) Method {#Abblix.Jwt.JsonWebKeyExtensions.Apply_T_(thisT,System.Security.Cryptography.X509Certificates.X509Certificate2)}

Applies X509Certificate2 properties to a JsonWebKey\.

```csharp
public static T Apply<T>(this T jwk, System.Security.Cryptography.X509Certificates.X509Certificate2 certificate)
    where T : Abblix.Jwt.JsonWebKey;
```
#### Type parameters

###### `T` {#Abblix.Jwt.JsonWebKeyExtensions.Apply_T_(thisT,System.Security.Cryptography.X509Certificates.X509Certificate2).T}

The type of JsonWebKey \(must be a subclass\)\.
#### Parameters

###### `jwk` [T](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyExtensions#Abblix.Jwt.JsonWebKeyExtensions.Apply_T_(thisT,System.Security.Cryptography.X509Certificates.X509Certificate2).T 'Abblix\.Jwt\.JsonWebKeyExtensions\.Apply\<T\>\(this T, System\.Security\.Cryptography\.X509Certificates\.X509Certificate2\)\.T') {#Abblix.Jwt.JsonWebKeyExtensions.Apply_T_(thisT,System.Security.Cryptography.X509Certificates.X509Certificate2).jwk}

The JsonWebKey to which the certificate properties are to be applied\.

###### `certificate` [System\.Security\.Cryptography\.X509Certificates\.X509Certificate2](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509certificate2 'System\.Security\.Cryptography\.X509Certificates\.X509Certificate2') {#Abblix.Jwt.JsonWebKeyExtensions.Apply_T_(thisT,System.Security.Cryptography.X509Certificates.X509Certificate2).certificate}

The X509Certificate2 providing the properties\.

#### Returns
[T](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyExtensions#Abblix.Jwt.JsonWebKeyExtensions.Apply_T_(thisT,System.Security.Cryptography.X509Certificates.X509Certificate2).T 'Abblix\.Jwt\.JsonWebKeyExtensions\.Apply\<T\>\(this T, System\.Security\.Cryptography\.X509Certificates\.X509Certificate2\)\.T')  
The updated JsonWebKey with applied certificate properties\.

## JsonWebKeyExtensions\.ModulusBitLength\(this RsaJsonWebKey\) Method {#Abblix.Jwt.JsonWebKeyExtensions.ModulusBitLength(thisAbblix.Jwt.RsaJsonWebKey)}

The real bit length of the key's modulus, ignoring any leading zero octets\.

```csharp
public static int ModulusBitLength(this Abblix.Jwt.RsaJsonWebKey key);
```
#### Parameters

###### `key` [RsaJsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.ModulusBitLength(thisAbblix.Jwt.RsaJsonWebKey).key}

#### Returns
[System\.Int32](https://learn.microsoft.com/en-us/dotnet/api/system.int32 'System\.Int32')

### Remarks
`RSA.KeySize` is not this number, and how far it differs depends on the platform\. It reports
            the key as the importer built it: Windows CNG keeps a left\-padded modulus at its padded length and
            reports twice the real strength, while Linux \(OpenSSL\) strips the leading zeros and reports the
            true one\. So a size check written against that property refuses a downgraded key on one operating
            system and admits it on another \- which is a worse failure than either, because the deployment
            that admits it looks identical to the one that does not, and the forgery arrives later from
            whoever factored the real modulus\.
            

Measuring the modulus itself removes the platform from the question. It is also never larger than
`RSA.KeySize`, so switching to it can only add refusals, never remove one.

RFC 7518 Section 2 requires the minimal encoding - "The octet sequence MUST utilize the minimum
number of octets needed to represent the value" - which is what this measurement follows. Padding
far enough to matter is NOT something a library does by accident: the one benign quirk the
specification records is a single extra zero octet (Section 6.3.1.1, "returning 257 octets for a
2048-bit key"), and one octet moves neither check in either direction. Sixty-four of them is a
malformed or hostile JWKS entry.

The leading octet contributes only the bits from its own highest set bit down, which is what makes
this the modulus's true length rather than a rounded-up octet count.

## JsonWebKeyExtensions\.RsaSectionFor\(string\) Method {#Abblix.Jwt.JsonWebKeyExtensions.RsaSectionFor(string)}

The RFC 7518 section that carries the key\-size requirement for [algorithm](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyExtensions#Abblix.Jwt.JsonWebKeyExtensions.RsaSectionFor(string).algorithm 'Abblix\.Jwt\.JsonWebKeyExtensions\.RsaSectionFor\(string\)\.algorithm')\.

```csharp
public static string RsaSectionFor(string algorithm);
```
#### Parameters

###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebKeyExtensions.RsaSectionFor(string).algorithm}

#### Returns
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

#### Exceptions

[System\.ArgumentException](https://learn.microsoft.com/en-us/dotnet/api/system.argumentexception 'System\.ArgumentException')  
The algorithm is not one this library enforces a floor for\.

### Remarks
A refusal has to send the operator to the paragraph that refused them\. Sections 3 and 4 are
container headings and state no size requirement at all, so citing either leaves the reader
looking at a table of algorithm names and no MUST \- which reads as the library inventing the rule\.

## JsonWebKeyExtensions\.RsaSectionForOrNothing\(string\) Method {#Abblix.Jwt.JsonWebKeyExtensions.RsaSectionForOrNothing(string)}

The WHOLE citation phrase, ready to drop into a refusal message \- "per RFC 7518 Section 3\.3", or
"for RSA signatures" when the algorithm has no section of its own\.

```csharp
public static string RsaSectionForOrNothing(string algorithm);
```
#### Parameters

###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebKeyExtensions.RsaSectionForOrNothing(string).algorithm}

#### Returns
[System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String')

### Remarks
Two differences from [RsaSectionFor\(string\)](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyExtensions#Abblix.Jwt.JsonWebKeyExtensions.RsaSectionFor(string) 'Abblix\.Jwt\.JsonWebKeyExtensions\.RsaSectionFor\(string\)'), and both matter at a call site\. This one never
throws, because an unknown algorithm must not replace the refusal the operator was about to read
with a complaint about the citation \- and it is reachable, since an RSA key carrying no
`alg` resolves to `SigningAlgorithms.None`\. And this one carries the words "per RFC
7518" itself, where [RsaSectionFor\(string\)](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKeyExtensions#Abblix.Jwt.JsonWebKeyExtensions.RsaSectionFor(string) 'Abblix\.Jwt\.JsonWebKeyExtensions\.RsaSectionFor\(string\)') returns the bare section and leaves them to the
caller\. Interpolate this one into a sentence that writes them too and the message says them twice\.

## JsonWebKeyExtensions\.SupportsAlgorithm\(this JsonWebKey, string\) Method {#Abblix.Jwt.JsonWebKeyExtensions.SupportsAlgorithm(thisAbblix.Jwt.JsonWebKey,string)}

Whether this key can carry out the given algorithm \- JWS signing or JWE key management \- judged by the
key's own material rather than by what it declares\.

```csharp
public static bool SupportsAlgorithm(this Abblix.Jwt.JsonWebKey key, string algorithm);
```
#### Parameters

###### `key` [JsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.SupportsAlgorithm(thisAbblix.Jwt.JsonWebKey,string).key}

The key to test\.

###### `algorithm` [System\.String](https://learn.microsoft.com/en-us/dotnet/api/system.string 'System\.String') {#Abblix.Jwt.JsonWebKeyExtensions.SupportsAlgorithm(thisAbblix.Jwt.JsonWebKey,string).algorithm}

The JWS algorithm the caller needs\.

#### Returns
[System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean')  
True when the key's type, and for ECDSA its curve, match what the algorithm requires\.

### Remarks
RFC 7517 section 4\.4 makes `alg` OPTIONAL, so a key may simply not say what it is for \- and a key
imported from a certificate never does\. Such a key is not "unknown", it is answerable: RFC 7518 section 3\.1
binds each algorithm to a key type, and section 3\.4 binds each ECDSA algorithm to one curve\. Asking the
material is therefore exact, and it is the only question that matters at the point of use, since a
declaration is a claim while the material is the fact\.

## JsonWebKeyExtensions\.ToEcdh\(this EllipticCurveJsonWebKey\) Method {#Abblix.Jwt.JsonWebKeyExtensions.ToEcdh(thisAbblix.Jwt.EllipticCurveJsonWebKey)}

Converts an EllipticCurveJsonWebKey to an ECDiffieHellman object for ECDH key agreement
operations \(e\.g\. the ECDH\-ES family of JWE key management algorithms\)\.

```csharp
public static System.Security.Cryptography.ECDiffieHellman ToEcdh(this Abblix.Jwt.EllipticCurveJsonWebKey key);
```
#### Parameters

###### `key` [EllipticCurveJsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.ToEcdh(thisAbblix.Jwt.EllipticCurveJsonWebKey).key}

The EllipticCurveJsonWebKey to be converted\.

#### Returns
[System\.Security\.Cryptography\.ECDiffieHellman](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.ecdiffiehellman 'System\.Security\.Cryptography\.ECDiffieHellman')  
An ECDiffieHellman object based on the provided EllipticCurveJsonWebKey\.

## JsonWebKeyExtensions\.ToEcdsa\(this EllipticCurveJsonWebKey\) Method {#Abblix.Jwt.JsonWebKeyExtensions.ToEcdsa(thisAbblix.Jwt.EllipticCurveJsonWebKey)}

Converts an EllipticCurveJsonWebKey to an ECDsa object,
which represents an ECDSA public and private key pair or just a public key\.

```csharp
public static System.Security.Cryptography.ECDsa ToEcdsa(this Abblix.Jwt.EllipticCurveJsonWebKey key);
```
#### Parameters

###### `key` [EllipticCurveJsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.ToEcdsa(thisAbblix.Jwt.EllipticCurveJsonWebKey).key}

The EllipticCurveJsonWebKey to be converted\.

#### Returns
[System\.Security\.Cryptography\.ECDsa](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.ecdsa 'System\.Security\.Cryptography\.ECDsa')  
An ECDsa object based on the provided EllipticCurveJsonWebKey\.

## JsonWebKeyExtensions\.ToEcParameters\(this EllipticCurveJsonWebKey\) Method {#Abblix.Jwt.JsonWebKeyExtensions.ToEcParameters(thisAbblix.Jwt.EllipticCurveJsonWebKey)}

Converts an EllipticCurveJsonWebKey to ECParameters,
which represent the key parameters used in ECDSA cryptographic operations\.
Supports P\-256, P\-384, and P\-521 curves as defined in NIST standards\.

```csharp
public static System.Security.Cryptography.ECParameters ToEcParameters(this Abblix.Jwt.EllipticCurveJsonWebKey key);
```
#### Parameters

###### `key` [EllipticCurveJsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.EllipticCurveJsonWebKey 'Abblix\.Jwt\.EllipticCurveJsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.ToEcParameters(thisAbblix.Jwt.EllipticCurveJsonWebKey).key}

The EllipticCurveJsonWebKey to be converted\.

#### Returns
[System\.Security\.Cryptography\.ECParameters](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.ecparameters 'System\.Security\.Cryptography\.ECParameters')  
An ECParameters object based on the provided EllipticCurveJsonWebKey\.

#### Exceptions

[System\.InvalidOperationException](https://learn.microsoft.com/en-us/dotnet/api/system.invalidoperationexception 'System\.InvalidOperationException')  
Thrown when the curve type is not supported\.

## JsonWebKeyExtensions\.ToJsonWebKey\(this X509Certificate2, bool\) Method {#Abblix.Jwt.JsonWebKeyExtensions.ToJsonWebKey(thisSystem.Security.Cryptography.X509Certificates.X509Certificate2,bool)}

Converts an X509Certificate2 to a JsonWebKey\. The private keys can be optionally included in the conversion\.

```csharp
public static Abblix.Jwt.JsonWebKey ToJsonWebKey(this System.Security.Cryptography.X509Certificates.X509Certificate2 certificate, bool includePrivateKeys=false);
```
#### Parameters

###### `certificate` [System\.Security\.Cryptography\.X509Certificates\.X509Certificate2](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509certificate2 'System\.Security\.Cryptography\.X509Certificates\.X509Certificate2') {#Abblix.Jwt.JsonWebKeyExtensions.ToJsonWebKey(thisSystem.Security.Cryptography.X509Certificates.X509Certificate2,bool).certificate}

The X509Certificate2 to convert\.

###### `includePrivateKeys` [System\.Boolean](https://learn.microsoft.com/en-us/dotnet/api/system.boolean 'System\.Boolean') {#Abblix.Jwt.JsonWebKeyExtensions.ToJsonWebKey(thisSystem.Security.Cryptography.X509Certificates.X509Certificate2,bool).includePrivateKeys}

Indicates whether to include private keys in the conversion\.

#### Returns
[JsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.JsonWebKey 'Abblix\.Jwt\.JsonWebKey')  
A JsonWebKey representing the certificate\.

## JsonWebKeyExtensions\.ToRsa\(this RsaJsonWebKey\) Method {#Abblix.Jwt.JsonWebKeyExtensions.ToRsa(thisAbblix.Jwt.RsaJsonWebKey)}

Converts an RsaJsonWebKey to an RSA object, which represents an RSA public and private key pair or just a public key\.

```csharp
public static System.Security.Cryptography.RSA ToRsa(this Abblix.Jwt.RsaJsonWebKey key);
```
#### Parameters

###### `key` [RsaJsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.ToRsa(thisAbblix.Jwt.RsaJsonWebKey).key}

The RsaJsonWebKey to be converted\.

#### Returns
[System\.Security\.Cryptography\.RSA](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsa 'System\.Security\.Cryptography\.RSA')  
An RSA object based on the provided RsaJsonWebKey\.

## JsonWebKeyExtensions\.ToRsaParameters\(this RsaJsonWebKey\) Method {#Abblix.Jwt.JsonWebKeyExtensions.ToRsaParameters(thisAbblix.Jwt.RsaJsonWebKey)}

Converts an RsaJsonWebKey to RSAParameters, which represent the key parameters used in RSA cryptographic operations\.

```csharp
public static System.Security.Cryptography.RSAParameters ToRsaParameters(this Abblix.Jwt.RsaJsonWebKey key);
```
#### Parameters

###### `key` [RsaJsonWebKey](https://www.abblix.com/docs/api/abblix-jwt/Abblix.Jwt.RsaJsonWebKey 'Abblix\.Jwt\.RsaJsonWebKey') {#Abblix.Jwt.JsonWebKeyExtensions.ToRsaParameters(thisAbblix.Jwt.RsaJsonWebKey).key}

The RsaJsonWebKey to be converted\.

#### Returns
[System\.Security\.Cryptography\.RSAParameters](https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography.rsaparameters 'System\.Security\.Cryptography\.RSAParameters')  
An RSAParameters object based on the provided RsaJsonWebKey\.