Skip to main content

Crate identity_kit

Crate identity_kit 

Source
Expand description

DID, key management and verifiable credential primitives.

The crate is organised in two layers. The lower layer holds the DID data model (did), JOSE keys and signatures (jose), key stores (keys), the signing party (identity), DID resolution and dereferencing (resolver) and the did:key, did:jwk and did:web methods (methods). The upper layer builds JWT-based verifiable credentials and presentations on top of it (vc), SD-JWT verifiable credentials (sd_jwt_vc), the IETF Token Status List (status_list), the DIF Well Known DID Configuration (domain_linkage) and DIF Linked Verifiable Presentations (linked_vp), and never leaks back into the lower layer. prelude gathers the common types of the lower layer, prelude::credentials those of the upper layer.

§Cargo features

All features are additive. The default set enables both layers over software keys and the three DID methods; --no-default-features leaves the lower layer with the in-crate parsers and verifiers only. The complete list, with what each feature pulls in, is in the crate’s docs/DESIGN.md. status-list enables status_list on its own, so a build with vc but without sd-jwt checks the status claim of JWT credentials too; sd-jwt implies it. The features that add surface rather than enable a module:

Modules§

did
Decentralized identifiers (DIDs), DID URLs, DID documents and resolution types.
domain_linkagedomain-linkage
DIF Well Known DID Configuration: proving that the controller of an origin and the controller of a DID are the same entity.
identity
The signing party: which identifiers it controls and the keys that sign for them.
jose
JSON Object Signing and Encryption: keys, algorithms, signature verification and the compact JWS serialization.
keys
Key stores: private keys behind an opaque id, with signing as a remote operation.
linked_vplinked-vp
DIF Linked Verifiable Presentation: verifiable presentations a DID controller publishes for anyone to discover, through a LinkedVerifiablePresentation service in its DID document.
methodsdid-jwk or did-key or did-web
DID methods: did:key (key), did:jwk (jwk) and did:web (web).
prelude
The commonly used types and traits of each layer, for glob import.
resolver
DID resolution and production: the DidResolver and DidProducer traits a DID method implements, the Resolver registry that routes a DID to the resolver of its method, an optional TTL DocumentCache, and DID URL dereferencing. Beside DIDs, finding the key a token was signed with: KeyReference and KeyResolver.
sd_jwt_vcsd-jwt
Selective disclosure for JWTs (SD-JWT, RFC 9901) and SD-JWT-based verifiable credentials (SD-JWT VC), with the Token Status List and SD-JWT VC type metadata.
status_liststatus-list
The IETF Token Status List (draft-ietf-oauth-status-list-21): the status claim of a referenced token, the status list and the status list token.
vcvc
Verifiable credentials and presentations secured as JWTs.
vectorstest-vectors
The specification vectors the tests of this crate run against (feature test-vectors), so that a crate building on this one can test against the same examples: RFC 9901 (SD-JWT), SD-JWT VC, the Token Status List, VC-JOSE-COSE presentations, the DIF Well Known DID Configuration and DIF Linked Verifiable Presentation.

Macros§

claim_pathvc
A ClaimPath from components of mixed kinds: string literals for names, integers for indexes, () for every element.