Identity & Authorization

The application-facing layer — threshold key enclaves, did:key identifiers, UCAN capability tokens, payload encryption, and WebAssembly code signing.

Everything below this section is code you call directly from an application. The primitives in Foundations, Signatures, and Threshold are the machinery; these five packages are the assembled product: a key that lives in two shares, an identifier derived from its public point, tokens that delegate narrow slices of authority over that key, and two supporting utilities for encrypting payloads and pinning executable code.

How the pieces compose

Choosing a package

A minimal end-to-end shape

package main

import (
	"fmt"

	"github.com/sonr-io/crypto/keys"
	"github.com/sonr-io/crypto/mpc"
)

func main() {
	// 1. Threshold key: both shares generated locally.
	enclave, err := mpc.NewEnclave()
	if err != nil {
		panic(err)
	}

	// 2. Identifier derived from the enclave's public point.
	did, err := keys.NewFromMPCPubKey(enclave.PubKeyBytes())
	if err != nil {
		panic(err)
	}
	fmt.Println("issuer:", did.String()) // did:key:z...

	// 3. Two-party signature over a message, verified against the public key.
	sig, err := enclave.Sign([]byte("hello"))
	if err != nil {
		panic(err)
	}
	ok, err := enclave.Verify([]byte("hello"), sig)
	fmt.Println("valid:", ok, err)
}

Every one of these packages is generic over, or built on, the curve abstraction described in Foundations → Curves. Curve, Point, and Scalar are not re-explained here.

Read this before you ship

This section is the least finished part of the repository. The pages below document the rough edges in place rather than around them, because several of them are the kind that silently weaken a security property instead of failing loudly.

Pages