Cryptographic primitives
Use the exact protocol representation, key algorithm, and binding.
OAS and its supporting crypto crates expose Ed25519 signing, hashing, derivation, canonicalization, encoding and threshold primitives. Their presence does not mean every SDK uses the same key-derivation algorithm or exposes every operation.
Select the correct contract
- OAS document/challenge protocols use their specified canonical JSON representation and proof binding.
- ACT signs the original CBOR claim bytes, not a re-encoded JSON or CBOR object.
- Encryption-key derivation depends on the exact SDK/binding; cross-language custody differs.
- Threshold shares and signing ceremonies depend on the resolved FROST version and custody configuration.
Published references
OAS crypto modules describe identity primitives. Shared crypto-WASM modules expose native and feature-gated WASM declarations. The public @openagentid/crypto-wasm@0.1.1 npm package includes its compiled WASM and Node wrapper. The complete ACT example connects its real act_verify export to SDK 0.7.2; no separate WASM build is required. That binding requires the receiver to supply its current host time because its default WASM system-clock path traps.
Use published vectors and meaningful negative tests for the exact primitive/version you deploy. Do not infer broad constant-time, secure-memory or side-channel guarantees from a package name or a managed-runtime wrapper. Review the actual implementation and deployment boundary.