feat: implement the public metadata issuance protocol by karx1 · Pull Request #56 · raphaelrobert/privacypass

karx1 · 2026-06-16T19:04:16Z

This PR implements the issuance protocol for Publicly Verifiable tokens with Public Metadata (token type 0xDA7A).

This is a revival of #25, rebased onto the current main branch and updated to support draft-ietf-privacypass-public-metadata-issuance-03. This PR also addresses the feedback from that PR.

This PR also pins voprf to version 0.6.0-pre.0, as cargo automatically updating to 0.6.0-pre.1 was causing compilation errors on a clean build with no Cargo.lock.

Finally, the functions verify_token and parse_authorization_str/parse_authorization_str_ext are some QoL additions that helped during development, but I'm happy to remove those if needed.

thibmeu

two main comments:

there should be cross implementation test, with typescript/go. Typescript provides a JSON that has been generated by the go implementation, might be the simplest to consume
I'm not sure the interface is the right one. I feel that there are way to extend method solely based on the type without introducing TokenProtocol structure

karx1 · 2026-06-18T19:12:24Z

I've addressed most of the review comments, and now I'm looking to see how to best address the compatibility requirements between the older and newer versions of draft-ietf-privacypass-auth-scheme-extensions, and will report back.

…c comment

…requests

karx1 · 2026-06-25T18:57:18Z

I've decided to drop the backwards compatibility handling and conform strictly to draft-ietf-privacypass-auth-scheme-extensions-03. I'll remove those changes now, but I'm happy to revisit putting it behind a cargo feature if you'd prefer to keep that behavior available.

karx1 · 2026-06-25T19:34:52Z

Also, RFC 9577 §2.2.2 says the token field might be a quoted-string, so I'm implementing changes accordingly.

…nd RFC 9577

thibmeu

a few more comments. the PR is starting to look better. some questions that remains unanswered:

should we implement edtension/challenge negotiation. this is only partial atm
generic batch is ok to be excluded. needs a clear documentation
i feel that having a method for origin/issuer to validate the unknown metadata (given there will only be a few standardsied and the logic may be complex) seems important, or clearly documented and explain how to validate manually

…(challenge extension parameter)

thibmeu

only one comment left about required extensions. overall good for me. thanks for the back and forth @karx1

@raphaelrobert remains authoritative for a review, approval, and eventual merge though

* Add Privacy Pass expiration extension helper Register the Expiration extension type and add typed encoding/decoding helpers for draft-ietf-privacypass-expiration-extension-00. This keeps token formats and redemption policy unchanged; callers still decide how to choose and enforce timestamps. Also move tests off 0x0001 as a dummy extension type and cover the draft example. * Rename expiration error variants

See crossbeam-rs/crossbeam#1276 for more info

raphaelrobert

Thanks for the PR, it looks pretty clean in general and would be a good addition to the crate.
I made a first pass with a few comments and questions.

raphaelrobert · 2026-08-23T15:51:09Z

-            });
+            let verified = public_keys
+                .iter()
+                .any(|public_key| verify_token(public_key, &token, None).is_ok());


Folding the token type and authenticator length checks into verify_token means their errors get swallowed by .is_ok(), so two RedeemTokenError variants are now unreachable through this method:

wrong token type -> InvalidSignature { token_type: PrivateP384 } short authenticator -> InvalidSignature { token_type: Public }

Whereas before those returned TokenTypeMismatch and InvalidAuthenticatorLength. private_tokens::Server::redeem_token still returns them, so the two protocols now disagree on the same failure.

Another effect of this: a malformed token now reserves and releases a nonce before being rejected.

We should probably have better tests for this.

raphaelrobert · 2026-08-23T15:54:41Z

+#[allow(clippy::type_complexity)]
+pub fn parse_www_authenticate_header_ext(
+    value: &HeaderValue,
+) -> Result<Vec<(Challenge, Option<ExtensionSet>, Option<Extensions>)>, ParseError> {


We could maybe extend `Challenge with these fields and reduce the type complexity here.

raphaelrobert · 2026-08-23T16:03:03Z

+    pub fn extensions(&self) -> &Option<Extensions> {
+        &self.extensions
+    }


Suggested change

pub fn extensions(&self) -> &Option<Extensions> {

&self.extensions

}

pub fn extensions(&self) -> Option<&Extensions> {

self.extensions.as_ref()

}

This would be more idiomatic and more in line with the rest of the API.

raphaelrobert · 2026-08-23T16:05:14Z

+            return Err(CreateExtensionsError::ExtensionsUnsorted);
+        }
+
+        #[cfg(not(any(test, feature = "test-utils")))]


Why is this gated?

raphaelrobert · 2026-08-23T16:08:27Z

    let (input, _) = opt_spaces(input)?;
    let (input, value) = match key.to_lowercase().as_str() {
-        "challenge" | "token-key" => base64_char(input)?,
+        "challenge" | "token-key" => {


The extension draft mandates double quotes for token and extensions. It does not mandate them for challenge or token-key, and RFC 9577 allows both forms. With strict_quotes applied here, parse_www_authenticate_header_ext rejects an otherwise valid header with an unquoted challenge, including the output of build_www_authenticate_header.

raphaelrobert · 2026-08-23T16:13:11Z

+
+/// Error that occurs during extension negotiation
+#[derive(Error, Debug)]
+pub enum NegotiationError {


CreateExtensionsError and ExpirationExtensionError went into common::errors. Maybe you also want to move this one for consistency?

raphaelrobert · 2026-08-23T16:15:41Z

+    },
+    #[error("Expected to have a PBRSA state but there was none")]
+    /// Error when there is no PBRSA state when using `TokenType::PublicMetadata`
+    NoPbrsaState,


I think this variant exists only because TokenState can represent a combination that should not occur, a PublicMetadata token input with pbrsa_state == None.

Idea (TBC): Modelling the state as an enum over the two protocol shapes makes that unrepresentable and lets both NoPbrsaState and the InvalidTokenType arm in response.rs go away.

raphaelrobert · 2026-08-23T16:17:20Z

+                derived_sk
+                    .blind_sign(token_request.blinded_msg)
+                    .inspect_err(|e| warn!(error:% = e; "Failed to blind_sign token"))
+                    .map_err(|source| IssueTokenResponseError::BlindSignatureFailed { source })?


I think we want a dedicated variant like KeyNotMetadataCapable here so that the callers have a bit more information.

raphaelrobert · 2026-08-23T16:19:28Z

+/// } ExtensionType;
+/// ```
+///
+/// Extension types are to be defined by the client, not by this crate


That's not entirely accurate, because EXPIRATION is defined below.

raphaelrobert · 2026-08-23T16:20:14Z

 #[derive(Clone, Debug, PartialEq, Eq, TlsSize, TlsDeserialize, TlsSerialize)]
 pub struct TokenChallenge {
-    token_type: TokenType,
+    pub(crate) token_type: TokenType,


There's a token_type() getter we can use instead of making this pub(crate).

RageKnify · 2026-08-26T16:47:23Z

Hey @raphaelrobert I've tried to address your feedback in karx1#2

Yash's internship has sadly already ended so I'll be taking over this project

I don't think it will be easy to take over this Pull Request so I will probably open another one

karx1 added 6 commits June 16, 2026 11:53

Pin voprf version to fix compilation errors

e4c99d6

Implement draft-ietf-privacypass-auth-scheme-extensions

21f7353

Implement the public metadata issuance protocol

42ee3b4

Cache validated PBRSA keypairs

d77836e

Document compatibility fixes

5c715f2

Add parse_authorization_str and verify_token, minor cleanups + fixes

9b1b143

thibmeu reviewed Jun 17, 2026

View reviewed changes

karx1 added 3 commits June 17, 2026 14:28

Add cross-compat tests

66b6433

Remove TokenProtocol and switch to using Extensions types in functions

5974782

Address thibmeu review comments

b66fe4c

thibmeu reviewed Jun 22, 2026

View reviewed changes

Comment thread src/common/extensions.rs Outdated

Comment thread src/public_tokens/request.rs

Simplify TokenRequest::new_*, redeem_token_*, update ExtensionType do…

75ada93

…c comment

thibmeu reviewed Jun 23, 2026

View reviewed changes

Comment thread src/generic_tokens/request.rs Outdated

thibmeu reviewed Jun 23, 2026

View reviewed changes

Comment thread src/public_tokens/server.rs

karx1 added 2 commits June 23, 2026 10:23

Don't support TokenType::PublicMetadata when deserializing generic …

a003bc7

…requests

Add comment about validation + update TokenRequest docs

895e6ab

karx1 added 2 commits June 25, 2026 15:08

Adhere strictly to draft-ietf-privacypass-auth-scheme-extensions-03 a…

7dea446

…nd RFC 9577

Merge branch 'main' into public-metadata

1a36b21

karx1 requested a review from thibmeu June 30, 2026 20:08

thibmeu reviewed Jul 1, 2026

View reviewed changes

Comment thread src/public_tokens/request.rs

Comment thread src/common/extensions.rs Outdated

Comment thread src/auth/authorize.rs Outdated

Comment thread src/public_tokens/request.rs

Comment thread src/public_tokens/request.rs

Comment thread README.md Outdated

karx1 added 5 commits July 1, 2026 15:45

Address thibmeu review comments

1fab2bd

Implement draft-ietf-privacypass-auth-scheme-extensions-03 section 4 …

a61216d

…(challenge extension parameter)

Add getters for fields on extension structs + Update docs

5975855

Fix clippy warnings

fdcc019

Accept OWS and empty elements in auth list parsing (RFC 9110 5.6.1)

d4854bd

thibmeu reviewed Jul 7, 2026

View reviewed changes

Comment thread src/common/extensions.rs Outdated

Fix required extension validation

78a6a2e

thibmeu mentioned this pull request Jul 8, 2026

Add Privacy Pass expiration extension helper karx1/privacypass#1

Merged

thibmeu and others added 4 commits July 8, 2026 10:58

Update crossbeam-epoch to fix cargo deny

987a565

See crossbeam-rs/crossbeam#1276 for more info

Merge branch 'main' into public-metadata

c85149f

Merge branch 'main' into public-metadata

c2d2560

raphaelrobert requested changes Aug 23, 2026

View reviewed changes

Conversation

karx1 commented Jun 16, 2026

Uh oh!

thibmeu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

karx1 commented Jun 18, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

karx1 commented Jun 25, 2026

Uh oh!

karx1 commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thibmeu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

thibmeu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

raphaelrobert left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

RageKnify commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

karx1 commented Jun 25, 2026 •

edited

Loading

RageKnify commented Aug 26, 2026 •

edited

Loading