aethel-sdk 0.5.0

Ergonomic Rust SDK over aethel-core's post-quantum identity primitives: generate, sign, verify, project, disclose, recover
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

//! The README quickstart, kept as an example so it is compiled and run rather
//! than believed. If this stops working, CI notices before a reader does.

use aethel_sdk::{verify, verify_presentation, Identity, IssuerPublicParameters};

fn main() -> Result<(), Box<dyn std::error::Error>> {
    // Entropy comes from the OS. The signing key is derived from it inside the
    // embedded component and never enters this process.
    let mut identity = Identity::generate()?;

    // Sign and verify.
    let message = b"the message that was actually signed";
    let signature = identity.sign(message)?;
    assert!(verify(identity.public_key(), message, &signature)?);
    assert!(!verify(
        identity.public_key(),
        b"something else",
        &signature
    )?);

    // The interoperable form of the public key: base58btc over the multicodec
    // code for ML-DSA-65. This is what goes in a DID document.
    let multikey = identity.public_key_multibase();
    assert!(multikey.starts_with('z'));

    // Persist it. `key` must be high-entropy key material, NOT a password.
    let key = b"a sealing key of thirty-two byte";
    let sealed = identity.export_sealed(key)?;
    let mut identity = Identity::open_sealed(&sealed, key)?;

    // Issue a credential over named attributes, and disclose only one of them.
    let credential = identity.issue_credential(
        b"the issuer's secret seed, 32 byte",
        &[("tier", 3), ("date_of_birth", 19_900_101)],
    )?;
    let presentation = identity.present(&credential, b"checkout-session", &["tier"])?;

    // The verifier learns the tier and nothing about the date of birth.
    assert_eq!(presentation.disclosed().get("tier"), Some(&3));
    assert!(!presentation.disclosed().contains_key("date_of_birth"));
    // Verification takes the issuer's public parameters, never the seed. Derive
    // them once from the seed and publish them; a verifier needs nothing secret.
    let issuer = IssuerPublicParameters::derive(b"the issuer's secret seed, 32 byte")?;
    assert!(verify_presentation(
        &issuer,
        &presentation,
        b"checkout-session",
    )?);

    Ok(())
}