Module thumbprint 

RFC 9679 COSE Key Thumbprints, and the 8-byte kid derived from them (ADR 0006 §3).

A thumbprint is SHA-256 over the deterministic CBOR encoding (RFC 8949 §4.2.1) of a COSE_Key holding only the key type’s required parameters (RFC 9679 §4). Deterministic map order sorts keys by their encoded bytes, so 1 (0x01) precedes -1 (0x20), -2 (0x21) and -3 (0x22).

Symmetric keys: RFC 9679 §7 allows their thumbprints only for keys with enough entropy to rule out precomputed tables. HmacSecret refuses secrets shorter than 32 bytes for exactly that reason (P0 scoping decision), and only the first 8 bytes of the digest ever reach the wire.

Constants

KID_LEN

The length of a kid on the wire (§3: bstr .size 8).

Functions

ec2_p256_thumbprint

COSE key type EC2 (kty 2), curve P-256 (crv 1), from the uncompressed coordinates (RFC 9679 §4.2 requires the uncompressed form).

kid_from_thumbprint

The kid for a thumbprint: its first KID_LEN bytes. The birthday bound is about 2³² keys, and a resolver returns several candidates on a collision (§3), so the full thumbprint, not the kid, is what names a key unambiguously (Opened::key_thumbprint).

okp_ed25519_thumbprint

COSE key type OKP (kty 1), curve Ed25519 (crv 6).

symmetric_thumbprint

COSE key type Symmetric (kty 4), from the secret k.