kamu-snap-crypto

Framework-agnostic cryptography for Bank Indonesia SNAP BI integrations.

Part of the kamu-public-crates workspace.

What this crate is

The cryptographic spine shared by every PT IMMER SNAP BI consumer (client and server). Exposes:

30-second quickstart

use kamu_snap_crypto::HmacSigner;

let signer = HmacSigner::new(b"shared-secret")?;
let sig = signer.sign(b"payload");
println!("{}", sig.to_base64());

signer.verify(&sig, b"payload")?; // constant-time
# Ok::<(), kamu_snap_crypto::Error>(())

For a full SNAP BI service-call signing flow including stringToSign, timestamp, and headers, see examples/sign_snap_bi_request.rs.

SNAP BI recipes (feature snap-bi)

use http::Method;
use kamu_snap_crypto::snap_bi::{ServiceStringToSign, now_jakarta_seconds, sign_service};

let method = Method::POST;
let timestamp = now_jakarta_seconds();
let parts = ServiceStringToSign {
    method: &method,
    path: "/snap/v1.0/transfer-intrabank/payment",
    access_token: "bearer-token",
    body: br#"{"partnerReferenceNo":"abc"}"#,
    timestamp: &timestamp,
};
let sig = sign_service(b"client-secret", &parts)?;
// sig is encoding-agnostic — pick base64 or hex at call site
println!("{}", sig.to_base64());
# Ok::<(), kamu_snap_crypto::Error>(())

Webhook verification (feature webhook)

use http::HeaderMap;
use kamu_snap_crypto::webhook::{InacashCashoutVerifier, WebhookVerifier};

let verifier = InacashCashoutVerifier { secret: "shared-secret".into() };
let headers: HeaderMap = todo!();
let body: &[u8] = todo!();
verifier.verify(&headers, body)?;
# Ok::<(), kamu_snap_crypto::Error>(())

Security guarantees

• #![forbid(unsafe_code)]. No unsafe block anywhere in this crate.
• Constant-time verification: HMAC uses hmac::Mac::verify_slice; RSA uses rsa::signature::Verifier::verify. Both are constant-time per upstream guarantees.
• PKCS#8 enforcement: PKCS#1 PEMs are rejected by upstream parsers. Convert with openssl pkcs8 -topk8 -nocrypt -in pkcs1.pem -out pkcs8.pem.
• No HTTP framework coupling: leaf crate. wasm32-unknown-unknown compiles require the consumer to enable getrandom/js (pulled in via rsa).

Encodings

Signature is encoding-agnostic. Pick at the call site:

# use kamu_snap_crypto::{HmacSigner, Encoding};
# let signer = HmacSigner::new(b"x").unwrap();
let sig = signer.sign(b"hi");
sig.to_base64();
sig.to_hex_lower();
sig.to_base64_url_nopad();
sig.encode(Encoding::Base64);

Decoders mirror via Signature::from_base64, from_hex, from_base64_url_nopad, and the Signature::decode(s, enc) dispatcher.

Feature flags

Disable with default-features = false for pure-HMAC / pure-RSA usage (e.g. WASM).

Framework adapters

Inbound-verify glue per framework lives in adjacent crates:

• kamu-snap-crypto-actix — actix-web verify_request helper
• kamu-snap-crypto-axum — axum/http verify_request helper

Migration from v1.x

From<CryptoError> for ResponseError moved to kamu-snap-response behind its crypto feature.

License

Dual-licensed under either MIT or Apache-2.0 at your option (MIT OR Apache-2.0). Previously MIT-only in pt-immer/lib-snap.