Crate identity_kit 

DID, key management and verifiable credential primitives.

The crate is organised in two layers. The lower layer holds the DID data model (did), JOSE keys and signatures (jose), key stores (keys), DID resolution and dereferencing (resolver) and the did:key, did:jwk and did:web methods (methods). The upper layer builds JWT-based verifiable credentials and presentations on top of it (vc), SD-JWT verifiable credentials (sd_jwt_vc) and the DIF Well Known DID Configuration (domain_linkage), and never leaks back into the lower layer. prelude gathers the common types of the lower layer, prelude::credentials those of the upper layer.

Cargo features

All features are additive. The default set enables both layers over software keys and the three DID methods; --no-default-features leaves the lower layer with the in-crate parsers and verifiers only. The complete list, with what each feature pulls in, is in the crate’s docs/DESIGN.md; the ones that add surface rather than enable a module:

• utoipa: OpenAPI schemas (utoipa::ToSchema) for DidDocument, VerificationMethod, Service, Jwk, DomainLinkageConfiguration and TypeMetadata.
• test-vectors: keys::testsuite, the behavioural suite every key store must pass, and vectors, the specification vectors the tests of this crate run against.

Modules

did

Decentralized identifiers (DIDs), DID URLs, DID documents and resolution types.

domain_linkagedomain-linkage

DIF Well Known DID Configuration: proving that the controller of an origin and the controller of a DID are the same entity.

jose

JSON Object Signing and Encryption: keys, algorithms, signature verification and the compact JWS serialization.

keys

Key stores: private keys behind an opaque id, with signing as a remote operation.

methodsdid-jwk or did-key or did-web

DID methods: did:key (key), did:jwk (jwk) and did:web (web).

prelude

The commonly used types and traits of each layer, for glob import.

resolver

DID resolution and production: the DidResolver and DidProducer traits a DID method implements, the Resolver registry that routes a DID to the resolver of its method, an optional TTL DocumentCache, and DID URL dereferencing.

sd_jwt_vcsd-jwt

Selective disclosure for JWTs (SD-JWT, RFC 9901) and SD-JWT-based verifiable credentials (SD-JWT VC), with the Token Status List and SD-JWT VC type metadata.

vcvc

Verifiable credentials and presentations secured as JWTs.

vectorstest-vectors

The specification vectors the tests of this crate run against (feature test-vectors), so that a crate building on this one can test against the same examples: RFC 9901 (SD-JWT), SD-JWT VC, the Token Status List, and the DIF Well Known DID Configuration.

Macros

claim_pathsd-jwt

A ClaimPath from components of mixed kinds: string literals for names, integers for indexes, () for every element.