Source: oas/oas/oas-attestation/src/data_integrity_2025.rs. SHA-256: 28cb729f15f34a8b2c6b569850b60134f9aba33eee273babf7a3e549089422f8.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

data_integrity_2025::DATA_INTEGRITY_PROOF_TYPE

Fixed proof type literal for W3C DataIntegrityProof.

pub const DATA_INTEGRITY_PROOF_TYPE: &str;

Source line: 90.

data_integrity_2025::ASSERTION_METHOD

Fixed proof purpose literal for issuer assertions.

pub const ASSERTION_METHOD: &str;

Source line: 93.

data_integrity_2025::CRYPTOSUITE_EDDSA_2022

W3C cryptosuite identifier for Ed25519 over JCS canonicalization.

pub const CRYPTOSUITE_EDDSA_2022: &str;

Source line: 100.

data_integrity_2025::CRYPTOSUITE_ECDSA_2019

W3C cryptosuite identifier for ECDSA P-256 over JCS canonicalization.

pub const CRYPTOSUITE_ECDSA_2019: &str;

Source line: 103.

data_integrity_2025::CRYPTOSUITE_BBS_2023

W3C cryptosuite identifier for BBS+ (selective disclosure capable).

pub const CRYPTOSUITE_BBS_2023: &str;

Source line: 106.

data_integrity_2025::algorithm_to_cryptosuite

Maps a JOSE-style algorithm identifier (as returned by [Signer::algorithm]) to its W3C Data Integrity cryptosuite identifier.

Examples

use oas_attestation::data_integrity_2025::algorithm_to_cryptosuite;

assert_eq!(algorithm_to_cryptosuite("EdDSA"), Some("eddsa-2022"));
assert_eq!(algorithm_to_cryptosuite("ES256"), Some("ecdsa-2019"));
assert_eq!(algorithm_to_cryptosuite("BBS"), Some("bbs-2023"));
assert_eq!(algorithm_to_cryptosuite("RS256"), None);

pub fn algorithm_to_cryptosuite(algorithm: &str) -> Option<&'static str>;

Source line: 121.

data_integrity_2025::cryptosuite_to_algorithm

Reverse mapping — given a W3C cryptosuite identifier, returns the expected JOSE-style algorithm identifier the verifier MUST report.

pub fn cryptosuite_to_algorithm(cryptosuite: &str) -> Option<&'static str>;

Source line: 132.

data_integrity_2025::sign_credential_data_integrity

Signs an [OasCredential] with a W3C DataIntegrityProof per OAS Spec §14.4 data-integrity-2025.

The signing payload is the JCS canonicalization of the credential without the proof field — the same scheme used by [crate::sign::sign_credential]. The cryptosuite identifier is derived from the signer's algorithm via [algorithm_to_cryptosuite].

Arguments

• credential - The unsigned credential.
• signer - Any [Signer] implementation.
• verification_method_id - The full verification method ID (e.g., "did:oas:test:hmr:auditor#key-1").
• created - ISO 8601 timestamp for the proof.

Errors

• [AttestationError::ProofGenerationFailed] if canonicalization or signing fails.
• [AttestationError::UnknownProofFormat] if the signer's algorithm has no registered cryptosuite mapping.

pub fn sign_credential_data_integrity(
    credential: &OasCredential,
    signer: &dyn Signer,
    verification_method_id: &str,
    created: &str,
) -> Result<OasCredential, AttestationError>;

Source line: 167.

data_integrity_2025::verify_credential_data_integrity

Verifies an [OasCredential] signed with a DataIntegrityProof per OAS Spec §14.4 data-integrity-2025.

1. Validates the credential structure.
2. Checks the proof exists and uses DataIntegrityProof.
3. Checks the proof has a cryptosuite field.
4. Cross-validates that the cryptosuite matches the verifier's algorithm() via [cryptosuite_to_algorithm] — preventing the verifier from accidentally accepting a proof signed with the wrong suite.
5. Reconstructs the JCS canonical bytes (without proof) and verifies the signature.

Errors

• [AttestationError::MissingProof] if no proof is present.
• [AttestationError::InvalidProofSignature] for any structural, suite-mismatch, or cryptographic failure.

pub fn verify_credential_data_integrity(
    credential: &OasCredential,
    verifier: &dyn Verifier,
) -> Result<(), AttestationError>;

Source line: 234.

data_integrity_2025::format_id

Returns the registered OAS proof format ID for data-integrity-2025.

pub const fn format_id() -> ProofFormatId;

Source line: 311.

data_integrity_2025::format_url

Returns the canonical OAS format identifier URL.

pub const fn format_url() -> &'static str;

Source line: 316.