Skip to content
NOQTIS

nqdsse(3)

nqdsse, nqdssevrfy — sign and check DSSE envelopes

libnoqtis, -lnoqtis

#include <noqtis.h>

int
nqdsse(nqsalg alg, const uint8_t *sk, size_t sklen, const uint8_t *pk, size_t pklen, const char *type, const uint8_t *payload, size_t n, char *out, size_t cap, size_t *outlen);

int
nqdssevrfy(nqsalg alg, const uint8_t *pk, size_t pklen, const char *env, size_t n, uint8_t *payload, size_t cap, size_t *outlen, char type[256]);

() writes to out, of cap bytes, a DSSE envelope of the n payload bytes, signed with the key pair sk, pk of alg over the envelope's pre-authentication encoding

"DSSEv1" SP LEN(type) SP type SP LEN(payload) SP payload

(lengths in ASCII decimal), as canonical JSON:

{"payload":<base64>,"payloadType":<type>,
 "signatures":[{"keyid":<hex SHA-256 of pk>,"sig":<base64>}]}

type is 1 to 255 printable ASCII bytes with no space, quote or backslash, such as ‘application/vnd.in-toto+json’. The signature is checked before the envelope is written. *outlen gets the envelope's size, also when cap is too small.

() checks the envelope env of n bytes: one of its signatures (at most 16) must verify under pk over the pre-authentication encoding of its ‘payloadType’ and decoded ‘payload’. The payload then goes to payload (*outlen its size, also when cap is too small) and, when type is not NULL, the payload type to it, NUL-terminated.

Written, or checked.
[NQEBUF]
cap is too small.
[NQEVRFY]
nqdssevrfy(): no signature verifies.
[NQEDEC]
nqdssevrfy(): not an envelope.
[NQEARG]
A NULL argument, keys of the wrong size or not a pair, or a type that is not allowed.
[NQEMEM]
The allocation hook returned NULL.

noqtis-export(1), noqtis-verify(1), nqsign(3)

DSSE: Dead Simple Signing Envelope, https://github.com/secure-systems-lab/dsse/blob/master/envelope.md.