Source: oas/oas/oas-crypto/src/lib.rs. SHA-256: d41cbcc68d6f87d9c0f487dfe80b5d398691b07a89fe2861a74728317110faaa.

This source reference follows declared modules and preserves feature attributes. It includes public declarations and implementation methods in those modules. Private-module exports and trait resolution still require the compiler; not every declaration is a crate-root import. Function bodies and constant values are omitted. Source comments describe their implementation context and are not a production deployment claim.

derivation

oas-crypto

Cryptographic primitives for the Open Agent Specification (OAS).

This crate provides the foundational cryptographic operations required by the OAS specification, including Ed25519 key management, HKDF-SHA256 key derivation, BLAKE3 content hashing, JCS canonicalization, and AgentLineageProof2025 generation and verification.

Crate Architecture

• [keypair] — Ed25519 keypair generation, signing, and verification
• [derivation] — HKDF-SHA256 child key derivation (OAS Spec §9.3)
• [proof] — AgentLineageProof2025 generation and verification (OAS Spec §9.4, §9.5)
• [hashing] — BLAKE3 content hashing
• [jcs] — JSON Canonicalization Scheme (RFC 8785)
• [encoding] — Multibase (base58btc) and base64url encoding

Security Properties

• All key types implement [zeroize::Zeroize] and [zeroize::ZeroizeOnDrop]
• No unsafe code (#![forbid(unsafe_code)])
• Constant-time signature verification via ed25519-dalek
• Pure Rust — no C FFI dependencies

Example

use oas_crypto::keypair::OasKeyPair;
use oas_crypto::derivation::derive_child_keypair;
use oas_crypto::proof::{AgentLineageProof, LineageProofBinding};

// Generate a parent (HMR) keypair
let parent = OasKeyPair::generate();

// Derive a child keypair
let child = derive_child_keypair(&parent, "/agent-my-bot").unwrap();

// Generate a lineage proof
let child_public_key = child.public_key_multibase();
let proof = AgentLineageProof::generate_bound(
    &parent,
    &LineageProofBinding {
        parent_did: "did:oas:myns:hmr:alice",
        child_did: "did:oas:myns:agent:my-bot",
        derivation_path: "/agent-my-bot",
        verification_method: "did:oas:myns:hmr:alice#key-1",
        child_verification_method: "did:oas:myns:agent:my-bot#key-1",
        child_public_key_multibase: &child_public_key,
        parent_document_digest: "blake3:abababababababababababababababababababababababababababababababab",
        parent_document_sequence: 1,
        generation: 1,
    },
).unwrap();

// Verification requires a key selected by validated external policy.
assert!(proof.verify_with_key(&parent.verifying_key_bytes()).is_ok());

pub mod derivation;

Source line: 60.

encoding

pub mod encoding;

Source line: 61.

error

pub mod error;

Source line: 62.

frost

#[cfg(feature = "frost")]
pub mod frost;

Source line: 64.

hashing

pub mod hashing;

Source line: 65.

jcs

pub mod jcs;

Source line: 66.

keypair

pub mod keypair;

Source line: 67.

proof

pub mod proof;

Source line: 68.

pub use error::CryptoError;

pub use error::CryptoError;

Source line: 70.