Module token 

Contains methods for encrypting, decrypting, signing and verifying access tokens.

NOTE: The APIs in this module are experimental and likely to change in the future! This is because we plan to move much of the code here to the coset library, since much of this just builds on COSE functionality and isn’t ACE-OAuth specific.

In order to use any of these methods, you will need to provide a cipher which handles the cryptographic operations by implementing either CoseEncryptCipher, CoseMacCipher or CoseSignCipher, depending on the intended operation. If you plan to support CoseEncrypt or CoseSign rather than just CoseEncrypt0 or CoseSign1 (i.e., if you have multiple recipients with separate keys), you will also need to implement MultipleEncryptCipher or MultipleSignCipher. See the respective traits for details.

Example

The following shows how to create and sign an access token (assuming a cipher named FakeCrypto which implements CoseSignCipher exists.):

use dcaf::token::CoseCipher;


let rng = FakeRng;
let key = CoseKeyBuilder::new_symmetric_key(vec![1,2,3,4,5]).key_id(vec![0xDC, 0xAF]).build();
let claims = ClaimsSetBuilder::new()
     .audience(String::from("coaps://rs.example.com"))
     .issuer(String::from("coaps://as.example.com"))
     .claim(CwtClaimName::Cnf, key.clone().to_cbor_value()?)
     .build();
let token = sign_access_token::<FakeCrypto, FakeRng>(&key, claims, None, None, None, rng)?;
assert!(verify_access_token::<FakeCrypto>(&key, &token, None).is_ok());

Traits

CoseCipher

Trait for common parts required for CoseSignCipher, CoseEncryptCipher and CoseMacCipher.

CoseEncryptCipher

Provides basic operations for encrypting and decrypting COSE structures.

CoseMacCipher

Provides basic operations for generating and verifying MAC tags for COSE structures.

CoseSignCipher

Provides basic operations for signing and verifying COSE structures.

MultipleEncryptCipher

Intended for ciphers which can encrypt for multiple recipients. For this purpose, a method must be provided which generates the Content Encryption Key.

MultipleMacCipher

Marker trait intended for ciphers which can create MAC tags for multiple recipients.

MultipleSignCipher

Marker trait intended for ciphers which can create signatures for multiple recipients.

Functions

decrypt_access_token

Decrypts the given token and external_aad using the key and the cipher given by type parameter T, returning the decrypted ClaimsSet.

decrypt_access_token_multiple

Decrypts the given token and external_aad using the Key Encryption Key kek and the cipher given by type parameter T, returning the decrypted ClaimsSet.

encrypt_access_token

Encrypts the given claims with the given headers and external_aad using the key and the cipher given by type parameter T, returning the token as a serialized bytestring of the CoseEncrypt0 structure.

encrypt_access_token_multiple

Encrypts the given claims with the given headers and external_aad for each recipient by using the keys with the cipher given by type parameter T, returning the token as a serialized bytestring of the CoseEncrypt structure.

get_token_headers

Returns the headers of the given signed (CoseSign1 / CoseSign), MAC tagged (CoseMac0 / CoseMac), or encrypted (CoseEncrypt0 / CoseEncrypt) access token.

sign_access_token

Signs the given claims with the given headers and external_aad using the key and the cipher given by type parameter T, returning the token as a serialized bytestring of the CoseSign1 structure.

sign_access_token_multiple

Signs the given claims with the given headers and external_aad for each recipient by using the keys with the cipher given by type parameter T, returning the token as a serialized bytestring of the CoseSign structure.

verify_access_token

Verifies the given token and external_aad with the key using the cipher given by type parameter T, returning an error in case it could not be verified.

verify_access_token_multiple

Verifies the given token and external_aad with the key using the cipher given by type parameter T, returning an error in case it could not be verified.