Crate ash_core 

ASH Core

ASH (Anti-tamper Security Hash) is a request integrity and anti-replay protection library.

This crate provides the core functionality for:

• Deterministic JSON and URL-encoded payload canonicalization
• Cryptographic proof generation and verification
• Constant-time comparison for timing-attack resistance
• Binding normalization for endpoint protection

Features

• Tamper Detection: Cryptographic proof ensures payload integrity
• Replay Prevention: One-time contexts prevent request replay
• Deterministic: Byte-identical output across all platforms
• WASM Compatible: Works in browsers and server environments

Example

use ash_core::{canonicalize_json, build_proof, AshMode};

// Canonicalize a JSON payload
let canonical = canonicalize_json(r#"{"z":1,"a":2}"#).unwrap();
assert_eq!(canonical, r#"{"a":2,"z":1}"#);

// Build a proof
let proof = build_proof(
    AshMode::Balanced,
    "POST /api/update",
    "context-id-123",
    None,
    &canonical,
).unwrap();

Security Notes

ASH verifies what is being submitted, not who is submitting it. It should be used alongside authentication systems (JWT, OAuth, etc.).

Modules

config

ASH Configuration Module.

Structs

AshError

Main error type for ASH operations.

BuildProofInput

Input for building a proof.

UnifiedProofResult

Result from unified proof generation.

VerifyInput

Input for verifying a proof.

Enums

AshErrorCode

Error codes for ASH protocol.

AshMode

Security mode for ASH verification.

Constants

ASH_SDK_VERSION

ASH SDK version (library version).

ASH_VERSION_PREFIX

ASH v1 protocol version prefix.

ASH_VERSION_PREFIX_V21

ASH v2.1 protocol version prefix.

Functions

build_proof

Build a cryptographic proof for request integrity.

build_proof_v21

Build v2.1 cryptographic proof (client-side).

build_proof_v21_scoped

Build v2.2 cryptographic proof with scoped fields.

build_proof_v21_unified

Build unified v2.3 cryptographic proof (client-side).

canonicalize_json

Canonicalize a JSON string to deterministic form.

canonicalize_query

Canonicalize a URL query string according to ASH v2.3.1 specification.

canonicalize_urlencoded

Canonicalize URL-encoded form data.

derive_client_secret

Derive client secret from server nonce (v2.1).

extract_scoped_fields

Extract scoped fields from a JSON value.

generate_context_id

Generate a unique context ID with “ash_” prefix.

generate_nonce

Generate a cryptographically secure random nonce.

hash_body

Compute SHA-256 hash of canonical body.

hash_proof

Hash a proof for chaining purposes.

hash_scoped_body

Hash scoped payload for client-side use.

normalize_binding

Normalize a binding string to canonical form (v2.3.2+ format).

normalize_binding_from_url

Normalize a binding from a full URL path (including query string).

timing_safe_equal

Perform a constant-time comparison of two byte slices.

verify_proof

Verify a proof using constant-time comparison.

verify_proof_v21

Verify v2.1 proof (server-side).

verify_proof_v21_scoped

Verify v2.2 proof with scoped fields.

verify_proof_v21_unified

Verify unified v2.3 proof (server-side).