Crate sd_cwt 

Selective Disclosure CBOR Web Token helpers.

This crate implements the SD-CWT disclosure and redaction mechanics from draft-ietf-spice-sd-cwt-08 on top of cose2. It deliberately reuses cose2 for COSE signing, verification and header storage; the APIs here cover SD-CWT-specific header parameters, salted disclosures, redacted claim markers, AEAD-encrypted disclosure wire structures, and restoration of a presented claims set.

Structs

AeadEncryptedDisclosure

One sd_aead_encrypted_claims entry.

Disclosure

One Salted Disclosed Claim plus the exact bstr-encoded bytes used for hashing.

DisclosureSet

A collection of Salted Disclosed Claims.

IssueResult

Result of converting a pre-issued claims value into an issued SD-CWT value.

RestoreReport

Result of restoring disclosed SD-CWT claims.

Sha256RedactionHasher

SHA-256 redaction hasher, the SD-CWT default when sd_alg is omitted.

Enums

AeadKeyContext

AEAD encrypted disclosure key context.

DisclosureKind

A decoded Salted Disclosed Claim entry.

RestoreMode

Controls how unmatched Redacted Claim Hashes are handled during restoration.

Constants

ALG_SHA_256

The COSE algorithm identifier for SHA-256.

CONTENT_FORMAT_KB_CWT

CoAP content-format number for application/kb+cwt.

CONTENT_FORMAT_SD_CWT

CoAP content-format number for application/sd-cwt.

CWT_CLAIM_CNONCE

SD-CWT cnonce CWT claim key.

CWT_CLAIM_VCT

SD-CWT vct CWT claim key.

HEADER_CWT_CLAIMS

COSE header parameter CWT_Claims.

HEADER_KCWT

COSE header parameter kcwt used by Key Binding Tokens.

HEADER_SD_AEAD

COSE header parameter sd_aead.

HEADER_SD_AEAD_ENCRYPTED_CLAIMS

COSE header parameter sd_aead_encrypted_claims.

HEADER_SD_ALG

COSE header parameter sd_alg.

HEADER_SD_CLAIMS

COSE header parameter sd_claims.

HEADER_TYP

COSE header parameter typ.

REDACTED_CLAIM_KEYS_SIMPLE

The CBOR simple value used as the redacted_claim_keys map key.

REDACTED_ELEMENT_TAG

The CBOR tag used for redacted array elements.

TO_BE_DECOY_TAG

The CBOR tag used in pre-issuance maps to request decoys.

TO_BE_REDACTED_TAG

The CBOR tag used in pre-issuance maps to mark a key or element for redaction.

Traits

RedactionHasher

Redaction hash algorithm used for Salted Disclosed Claims.

SaltGenerator

Source of 128-bit salts for issuance helpers.

Functions

aead_encrypted_disclosures_from_unprotected

Reads sd_aead_encrypted_claims from an unprotected header.

default_hasher_for_sd_alg

Returns the built-in SHA-256 hasher for sd_alg = -16 or an omitted sd_alg.

disclosures_from_unprotected

Reads sd_claims from an unprotected header.

is_redacted_claim_keys_label

Returns true when value is the SD-CWT redacted_claim_keys map label.

issue_from_preissuance

Converts a pre-issued claims value containing tag 58/62 requests into an issued value.

redacted_claim_keys_label

Returns the SD-CWT redacted_claim_keys map label, simple(59).

redacted_element

Wraps a redacted array-element hash as CBOR tag 60.

restore

Restores a claims value using the selected validation mode.

restore_for_holder

Restores a claims value using Holder validation rules.

restore_for_verifier

Restores a claims value using Verifier validation rules.

restore_payload_from_message

Decodes a COSE payload as CBOR and restores it using disclosures in the message header.

restore_payload_with_disclosures

Decodes a COSE payload as CBOR and restores it with caller-supplied disclosures.

sd_aead

Reads the sd_aead protected header parameter.

sd_alg

Reads the sd_alg protected header parameter.

set_aead_encrypted_disclosures

Writes sd_aead_encrypted_claims to an unprotected header.

set_disclosures

Writes sd_claims to an unprotected header, omitting the parameter when empty.

set_kb_cwt_typ

Sets the Key Binding Token content type (typ) header to application/kb+cwt (294).

set_sd_aead

Sets the sd_aead protected header parameter.

set_sd_alg

Sets the sd_alg protected header parameter.

set_sd_cwt_typ

Sets the SD-CWT content type (typ) header to application/sd-cwt (293).