contentauth / c2pa-rs

Rust SDK for the core C2PA (Coalition for Content Provenance and Authenticity) specification
Other
128 stars 57 forks source link

How to serialize claim and hash? #688

Open jesse-wei opened 1 week ago

jesse-wei commented 1 week ago

The C2PA attestation technical docs (section 7.2) states this operation:

the attestation is created over the hash of the serialized claim but omitting the attestation assertion (which has not been created yet.)

To support explicit attestations, the additional steps in the shaded box are required. As before, an Assertion Store is populated with the desired assertions, but it is referred to as a Partial Claim because one additional Assertion will be added before the Claim is finalized. The Partial Claim is then serialized and the Partial-Claim’s hash (which is generated using the same methodology as a standard Claim) is then attested using the appropriate platform attestation service. Next, the Attestation is packaged as an Attestation Assertion and added to the Assertion Store to create a finalized Assertion Store. Finally, the complete Claim (with the embedded Attestation Assertion) is signed by the Claim Generator.

How would I serialize a Partial Claim and get its hash? Based on sdk/examples/client/client.rs, I know I can create a Partial Claim like

    let mut builder = Builder::new();
    builder
        .set_claim_generator_info(ClaimGeneratorInfo::new(GENERATOR))
        .add_ingredient(parent)
        .add_assertion(Actions::LABEL, &actions)?
        .add_assertion(CreativeWork::LABEL, &creative_work)?
        .add_assertion(Exif::LABEL, &exif)?;

but I don't know how to serialize and hash this. I see some functions that perform hashing in data_hash.rs but am unsure how to apply them here. I think something like sign_file might be useful for serialization, but based on the figure in section 7.2, this serialization has to be done before signing.