Struct CoseSigned 

pub struct CoseSigned<T> { /* private fields */ }

Generic COSE_Sign1 signed envelope.

Wraps any serializable payload T with a COSE_Sign1 signature.

Implementations

impl<T> CoseSigned<T>

where T: Serialize + DeserializeOwned,

pub fn kid(&self) -> Option<String>

Returns the key identifier (kid) from the protected header.

The kid can be a SPIFFE ID, DID, URL, or any resolvable identifier that can be used to obtain the public key for verification.

pub fn issuer(&self) -> Option<String>

👎Deprecated since 0.2.0: Use kid() instead

Returns the issuer (kid) from the protected header.

Alias for kid() for backward compatibility.

pub fn algorithm(&self) -> Option<SigningAlgorithm>

Returns the signing algorithm from the protected header.

pub fn challenge(&self) -> Option<Vec<u8>>

Returns the challenge from the protected header (if present).

The challenge is used for freshness binding in PIC PoC. It is included in the protected header and covered by the signature.

pub fn to_bytes(&self) -> Result<Vec<u8>, CoseError>

Serializes the signed envelope to CBOR bytes.

pub fn from_bytes(bytes: &[u8]) -> Result<CoseSigned<T>, CoseError>

Deserializes a signed envelope from CBOR bytes.

pub fn payload_unverified(&self) -> Result<T, CoseError>

Extracts the payload without verifying the signature.

Use with caution: this bypasses signature verification.

pub fn sign_with<F>( payload: &T, kid: &str, alg: SigningAlgorithm, sign_fn: F, ) -> Result<CoseSigned<T>, CoseError>

where F: FnOnce(&[u8]) -> Result<Vec<u8>, CoseError>,

Signs a payload using a custom signing function (crypto-agnostic).

The closure receives the to-be-signed bytes and returns the signature.

pub fn sign_with_challenge<F>( payload: &T, kid: &str, alg: SigningAlgorithm, challenge: Option<&[u8]>, sign_fn: F, ) -> Result<CoseSigned<T>, CoseError>

where F: FnOnce(&[u8]) -> Result<Vec<u8>, CoseError>,

Signs a payload with an optional challenge in the protected header.

The challenge is included in the protected header and covered by the signature, providing freshness binding for PIC PoC.

Arguments

• payload - The payload to sign
• kid - Key identifier (SPIFFE ID, DID, URL, etc.)
• alg - Signing algorithm
• challenge - Optional challenge bytes (PCC nonce)
• sign_fn - Signing function

pub fn verify_with<F>(&self, verify_fn: F) -> Result<T, CoseError>

where F: FnOnce(&[u8], &[u8]) -> Result<(), CoseError>,

Verifies the signature using a custom verification function (crypto-agnostic).

The closure receives (data, signature) and returns Ok(()) if valid.

impl<T> CoseSigned<T>

where T: Serialize + DeserializeOwned,

pub fn sign_ed25519( payload: &T, kid: &str, signing_key: &SigningKey, ) -> Result<CoseSigned<T>, CoseError>

Signs payload with Ed25519. Algorithm is set to EdDSA automatically.

pub fn sign_ed25519_with_challenge( payload: &T, kid: &str, challenge: Option<&[u8]>, signing_key: &SigningKey, ) -> Result<CoseSigned<T>, CoseError>

Signs payload with Ed25519 and an optional challenge.

pub fn verify_ed25519( &self, verifying_key: &VerifyingKey, ) -> Result<T, CoseError>

Verifies Ed25519 signature and returns the payload.

Trait Implementations

impl<T> Clone for CoseSigned<T>

where T: Clone,

fn clone(&self) -> CoseSigned<T>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<T> Debug for CoseSigned<T>

where T: Debug,

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.