Module claims 

Claim objects: a signed payload that outlives a transport envelope.

A transport envelope (CoseEnvelope) is bound to one request and dies with its iat skew window and its nonce. An object signed offline by one device and delivered later by another needs the opposite: a self-contained COSE_Sign1 whose lifetime and replay are the application’s decision. That is this module:

sign_claims(signer, typ, claims, payload, aad) ──▶ tagged COSE_Sign1 ──▶ any channel, any delay
                                                         │
open_claims(resolver, bytes, typ, aad) ◀─────────────────┘  (signature only; caller checks exp/aud/cti)

The protected header is {1: alg, 4: kid, ? 15: CWT claims, 16: typ} (see header.rs for the CDDL); the parser accepts exactly what the signer writes. The mandatory typ (RFC 9596) is the domain separator: the envelope’s parser refuses label 16 and this one refuses its absence, so neither format opens as the other (tests/claims_domain_separation.rs). Algorithms are the envelope’s signature algorithms, Ed25519 and ESP256; HMAC / COSE_Mac0 is refused.

Replay: nothing here remembers anything. To make an object single-use, give it a cti and record the ones accepted.

Structs

CwtClaims

The CWT claims (RFC 8392 §3.1) a claim object may carry in protected label 15 (RFC 9597). Only the claims that are Some are written.

OpenedClaims

A claim object whose signature verified.

Enums

ClaimsError

A failure of sign_claims or open_claims.

Constants

MAX_AUD_LEN

The longest aud (bytes of UTF-8) a claim object carries.

MAX_CTI_LEN

The longest cti (bytes) a claim object carries.

MAX_TYP_LEN

The longest typ (bytes of UTF-8) a claim object carries.

Functions

open_claims

Open a claim object: parse it strictly, check its typ, and verify its signature with the key resolver returns for its kid.

sign_claims

Sign payload as a claim object: a tagged COSE_Sign1 (tag 18) whose protected header is {1: alg, 4: kid, ? 15: claims, 16: typ}, whose unprotected header is empty and whose payload is embedded.