35bb8c9910
smart-byte-core
- `wire`: canonical CBOR for any serde type. `from_slice` refuses bytes that
are not the decoded object's own encoding. Serde otherwise accepts an array
of integers for a byte string, a byte string for text, and an array for a
struct, each a second encoding the SAID does not cover.
- Controller AIDs. Controller signatures are checked against the key states
replayed logs establish. One strict Ed25519 rule.
- The envelope: attested provenance, ownership chain and joule cost. Cargo
carries a registered type tag.
smart-byte-keri-witness
- Events are §2 SAIDs over canonical CBOR.
- The default verifier is spec v1. It replays one event at a time and says
which event it refused. It refuses `dip`, which skipped the pre-rotation
check entirely, plus zero thresholds, duplicate keys, rotations after an
empty `n`, and extension members.
- Extension mode, fixed:
- Witness receipts carried their own key, so anyone could receipt in any
witness's name. Witnesses are now named by their keys, and receipts sign
everything they claim.
- Duplicity evidence was gathered from unverified receipts.
- Recovery accepted any keys; it now needs its witnesses' receipts.
- OOBIs were signed by an embedded key; they are now controller signatures.
- Configuration traits were never enforced, so they are gone.
VC, BBS+, CRDT, mDL, lockstep, libp2p and the CLI move to the new envelope.
smart-byte-conformance
- kel_vectors.json: 25 vectors.
- envelope_vectors.json: 18 vectors, checked against the logs' key states.
- The SAID and signature vectors are rebuilt on the real objects, so all the
files describe one set of parties.
- Planted defects in every file are caught on their own vectors.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
65 lines
2.3 KiB
Rust
65 lines
2.3 KiB
Rust
//! W3C Verifiable Credentials and Decentralized Identifiers for Smart Byte.
|
|
//!
|
|
//! This crate ingests the deployed footprint of content-addressed signed
|
|
//! claims — W3C Verifiable Credential Data Model 2.0 (Rec) and Decentralized
|
|
//! Identifiers (Rec) — into the Smart Byte substrate.
|
|
//!
|
|
//! A [`VerifiableCredential`] is a structured claim issued by an
|
|
//! [`Issuer`] about one or more [`CredentialSubject`]s, sealed with
|
|
//! one of three families of [`Proof`]:
|
|
//!
|
|
//! * [`DataIntegrityProof`] — embedded W3C Data Integrity proof.
|
|
//! `eddsa-jcs-2022` is implemented natively (canonical JSON via
|
|
//! `serde_jcs` + Ed25519). RDFC variants are reserved behind the
|
|
//! `rdf-canon` feature.
|
|
//! * [`JwtProof`] — VC-JWT (RFC 7519 JWT carrying a VC payload).
|
|
//! * [`SdJwtProof`] — Selective-Disclosure JWT (IETF draft
|
|
//! `oauth-selective-disclosure-jwt-15`) for holder-driven selective
|
|
//! disclosure.
|
|
//!
|
|
//! A [`VerifiablePresentation`] wraps one or more credentials with a
|
|
//! holder-bound proof.
|
|
//!
|
|
//! Revocation and suspension are expressed via Bitstring Status List 2021
|
|
//! ([`status_list`]).
|
|
//!
|
|
//! Finally [`cargo_bridge`] packages a `VerifiableCredential` as a
|
|
//! `Cargo::Custom` payload on a Smart Byte [`Envelope`][smart_byte_core::Envelope],
|
|
//! so a VC's SAID is computed over its canonical JCS encoding and the
|
|
//! envelope signature reuses the smart-byte-core primitives.
|
|
|
|
#![forbid(unsafe_code)]
|
|
#![deny(missing_docs)]
|
|
|
|
pub mod cargo_bridge;
|
|
pub mod credential;
|
|
pub mod did;
|
|
pub mod error;
|
|
pub mod holder;
|
|
pub mod issuer;
|
|
pub mod jwt;
|
|
pub mod presentation;
|
|
pub mod proof;
|
|
pub mod sd_jwt;
|
|
pub mod status_list;
|
|
|
|
pub use cargo_bridge::{VC_CARGO_TYPE, vc_envelope, vc_from_envelope, vc_identity};
|
|
pub use credential::{
|
|
CredentialStatus, CredentialSubject, Evidence, TermsOfUse, VcBuilder,
|
|
VerifiableCredential, VC_CONTEXT_V2,
|
|
};
|
|
pub use did::{Did, DidError, DidKey};
|
|
pub use error::VcError;
|
|
pub use holder::Holder;
|
|
pub use issuer::Issuer;
|
|
pub use jwt::{issue_vc_jwt, verify_vc_jwt};
|
|
pub use presentation::VerifiablePresentation;
|
|
pub use proof::{
|
|
DataIntegrityProof, JwtProof, Proof, ProofPurpose, SdJwtProof,
|
|
issue_data_integrity, verify_data_integrity,
|
|
};
|
|
pub use sd_jwt::{Disclosure, issue_sd_jwt, present_sd_jwt, verify_sd_jwt};
|
|
pub use status_list::{
|
|
BitstringStatusList, StatusListCredential, StatusPurpose,
|
|
check_status,
|
|
};
|