aph_core/crypto/
mod.rs

1//! Cryptographic helpers for APH envelopes.
2//!
3//! Two layers live here:
4//!
5//! - **Envelope signing** — one module per §8.1/§8.2 combination of algorithm
6//!   and carriage, all three sharing [`proof_base`] so they cannot disagree
7//!   about which bytes a proof covers:
8//!
9//!   | Module | `proof.type` | Algorithm | `proofValue` carries |
10//!   |---|---|---|---|
11//!   | [`eddsa_jcs`] | `DataIntegrityProof` (`eddsa-jcs-2022`) | Ed25519 | multibase base58btc, 64 raw bytes |
12//!   | [`ecdsa_jcs`] | `DataIntegrityProof` (`ecdsa-jcs-2019`) | ES256 | multibase base58btc, P1363 `r‖s` |
13//!   | [`jws_envelope`] | `JsonWebSignature2020` | ES256 | a compact DETACHED JWS |
14//!
15//!   `eddsa-jcs-2022` is the protocol's default and the suite the channel
16//!   examples declare; the other two are §8.1 MUST-support and each now has a
17//!   published vector under `examples/`. [`did_key`] and [`multibase`] let a
18//!   verifier recover a `did:key` issuer's public key on either curve with no
19//!   network access at all. [`proof_base`] owns the canonicalization base each
20//!   proof covers (spec §7.2.1) — the one place that decides which bytes a
21//!   signature is over, so signer and verifier cannot drift apart.
22//! - **Shared primitives** — [`jcs`] canonicalization, [`jws_detached`], and
23//!   ES256 [`signing`] are shared with the AP2 payment-mandate ecosystem and
24//!   are vendored here so the APH crate stands alone with no external
25//!   protocol dependencies.
26//!
27//! # ⛔ The signature encoding depends on the CARRIAGE, not on the algorithm
28//!
29//! The same ES256 key produces two different wire forms in this crate, and
30//! both are correct:
31//!
32//! - an `ecdsa-jcs-2019` `proofValue` is P1363 `r‖s`, per the W3C suite
33//!   definition ([`ecdsa_jcs`]);
34//! - the signature inside a detached JWS is DER, and a Delegation Mandate
35//!   signature is DER, because that is the deployed AP2-interop wire
36//!   ([`jws_detached`], [`signing`]).
37//!
38//! Unifying them "for consistency" would fork one of the two wires. Both
39//! sides are pinned by tests that assert they DIFFER.
40
41pub mod did_key;
42pub mod ecdsa_jcs;
43pub mod eddsa_jcs;
44pub mod jcs;
45pub mod jws_detached;
46pub mod jws_envelope;
47pub mod multibase;
48pub mod proof_base;
49pub mod signing;
50
51pub(crate) mod base64url;
aph_core/crypto/mod.rs

aph_core/crypto/
mod.rs
