Struct DefaultVerifier 

pub struct DefaultVerifier;

A JwsVerifier over RustCrypto: ed25519-dalek for EdDSA, p256 for ES256, k256 for ES256K (feature secp256k1) and rsa for RS256 and PS256 (feature rsa).

ES384 is in the JwsAlgorithm vocabulary but not implemented here; verifying it returns VerificationError::UnsupportedAlgorithm.

Before the signature is checked, the key’s own restrictions are: a key whose alg names another algorithm, whose use is not sig or whose key_ops lacks verify is rejected.

ECDSA malleability

When an ECDSA signature (r, s) verifies, so does (r, n - s), where n is the group order. RFC 7518 §3.4 asks for no canonical s, and ES256 verification accepts both, so anyone holding an ES256 JWS can produce a second, different compact serialization of it that verifies just the same. ES256K accepts only the lower s, as k256 and most secp256k1 verifiers do (normalize_ecdsa_signature brings a signer’s output into that form).

The signature still means the same: the signer did sign those claims. What it rules out is treating a token’s bytes as unique. An application that keeps a replay cache or deduplicates tokens identifies a token by its claims (jti, iss, nonce), not by its compact serialization or a hash of it.

Examples

use identity_kit::jose::{DefaultVerifier, Jwk, JwsAlgorithm, JwsVerifier};

// RFC 8037 Appendix A.4 and A.5.
let key: Jwk = serde_json::from_str(
    r#"{"kty":"OKP","crv":"Ed25519","x":"11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo"}"#,
)?;
let token = "eyJhbGciOiJFZERTQSJ9.RXhhbXBsZSBvZiBFZDI1NTE5IHNpZ25pbmc.\
             hgyY0il_MGCjP0JzlnLWG1PPOt7-09PGcvMg3AIbQR6dWbhijcNR4ki4iylGjg5BhVsPt9g7sVvpAr_MuM0KAg";
let jws = identity_kit::jose::CompactJws::decode(token)?;
DefaultVerifier.verify(JwsAlgorithm::EdDSA, jws.signing_input(), jws.signature(), &key)?;

Trait Implementations

impl Clone for DefaultVerifier

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for DefaultVerifier

impl Debug for DefaultVerifier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for DefaultVerifier

fn default() -> Self

Returns the “default value” for a type.

impl Eq for DefaultVerifier

impl JwsVerifier for DefaultVerifier

fn verify( &self, alg: JwsAlgorithm, signing_input: &[u8], signature: &[u8], key: &Jwk, ) -> Result<(), VerificationError>

Verifies that signature over signing_input was made with the private counterpart of key under alg.

impl PartialEq for DefaultVerifier

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for DefaultVerifier