Skip to content

feat: implement the public metadata issuance protocol #56

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
karx1 wants to merge 13 commits into
base: main
Choose a base branch
from
Open

feat: implement the public metadata issuance protocol #56

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
e4c99d6
Pin voprf version to fix compilation errors
karx1 Jun 11, 2026
21f7353
Implement draft-ietf-privacypass-auth-scheme-extensions
karx1 Jun 3, 2026
42ee3b4
Implement the public metadata issuance protocol
karx1 Jun 5, 2026
d77836e
Cache validated PBRSA keypairs
karx1 Jun 11, 2026
5c715f2
Document compatibility fixes
karx1 Jun 12, 2026
9b1b143
Add parse_authorization_str and verify_token, minor cleanups + fixes
karx1 Jun 8, 2026
66b6433
Add cross-compat tests
karx1 Jun 17, 2026
5974782
Remove TokenProtocol and switch to using Extensions types in functions
karx1 Jun 17, 2026
b66fe4c
Address thibmeu review comments
karx1 Jun 18, 2026
75ada93
Simplify TokenRequest::new_*, redeem_token_*, update ExtensionType do…
karx1 Jun 22, 2026
a003bc7
Don't support `TokenType::PublicMetadata` when deserializing generic …
karx1 Jun 23, 2026
895e6ab
Add comment about validation + update TokenRequest docs
karx1 Jun 24, 2026
7dea446
Adhere strictly to draft-ietf-privacypass-auth-scheme-extensions-03 a…
karx1 Jun 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ subtle = "2"
thiserror = "2"
tls_codec = { version = "0.4.2" }
tls_codec_derive = "0.4.2"
voprf = { version = "0.6.0-pre.0", features = ["serde"] }
voprf = { version = "=0.6.0-pre.0", features = ["serde"] } # version pinned to avoid incompatibility with rand_core in 0.6.0-pre.1
p384 = { version = "0.13.0", default-features = false, features = [
"hash2curve",
"voprf",
Expand Down
13 changes: 7 additions & 6 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,12 +9,13 @@ with an async API.

## Protocols

| Token type | Spec | Primitive | Cipher suites |
|---|---|---|---|
| Privately Verifiable | [RFC 9578 §5](https://www.rfc-editor.org/rfc/rfc9578.html#section-5) | VOPRF | P384-SHA384, Ristretto255-SHA512 |
| Publicly Verifiable | [RFC 9578 §6](https://www.rfc-editor.org/rfc/rfc9578.html#section-6) | Blind RSA | RSA-2048, SHA-384, PSS |
| Amortized (Batch VOPRF) | [draft-ietf-privacypass-batched-tokens §5](https://www.ietf.org/archive/id/draft-ietf-privacypass-batched-tokens-04.html#section-5) | VOPRF | P384-SHA384, Ristretto255-SHA512 |
| Generic Batch | [draft-ietf-privacypass-batched-tokens §6](https://www.ietf.org/archive/id/draft-ietf-privacypass-batched-tokens-04.html#section-6) | Mixed | All of the above |
| Token type | Spec | Primitive | Cipher suites |
| ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------- | -------------------------------- |
| Privately Verifiable | [RFC 9578 §5](https://www.rfc-editor.org/rfc/rfc9578.html#section-5) | VOPRF | P384-SHA384, Ristretto255-SHA512 |
| Publicly Verifiable | [RFC 9578 §6](https://www.rfc-editor.org/rfc/rfc9578.html#section-6) | Blind RSA | RSA-2048, SHA-384, PSS |
| Publicly Verifiable with Public Metadata | [draft-ietf-privacypass-public-metadata-issuance §6](https://www.ietf.org/archive/id/draft-ietf-privacypass-public-metadata-issuance-03.html#section-6) | Partially-Blind RSA | RSA-2048, SHA-384, PSS |
| Amortized (Batch VOPRF) | [draft-ietf-privacypass-batched-tokens §5](https://www.ietf.org/archive/id/draft-ietf-privacypass-batched-tokens-04.html#section-5) | VOPRF | P384-SHA384, Ristretto255-SHA512 |
| Generic Batch | [draft-ietf-privacypass-batched-tokens §6](https://www.ietf.org/archive/id/draft-ietf-privacypass-batched-tokens-04.html#section-6) | Mixed | All of the above |

The `auth` module provides construction and parsing of the HTTP
`WWW-Authenticate` / `Authorization` headers used in the Privacy Pass
Expand Down
Loading