Files

Christian Nennemann ba38569319 fix: update hash format validation to -01 spec (plain base64url, no prefix)

Go ValidateHashFormat was still validating the old -00 format
(algorithm:base64url with sha-256/sha-384/sha-512 prefix). Updated to
validate plain base64url without prefix per -01 spec and RFC 9449.
Python was already updated but uncommitted. Both refimpls now match.

2026-04-11 17:51:29 +02:00

go-lang

fix: update hash format validation to -01 spec (plain base64url, no prefix)

2026-04-11 17:51:29 +02:00

python

fix: update hash format validation to -01 spec (plain base64url, no prefix)

2026-04-11 17:51:29 +02:00

IMPROVEMENTS.md

fix: update hash format validation to -01 spec (plain base64url, no prefix)

2026-04-11 17:51:29 +02:00

README.md

feat: migrate refimpls from draft-00 to draft-01 claim names

2026-04-03 10:55:58 +02:00

README.md

WIMSE Execution Context Tokens — Reference Implementations

These reference implementations are aligned with draft-nennemann-wimse-ect-01.

The following claim name changes from -00 have been applied:

-00 (previous) -01 (current) Notes

par pred Predecessor task IDs

pol, pol_decision removed (use ect_ext) Policy claims moved to extension object

sub not defined Standard JWT claim, not part of ECT spec

typ: wimse-exec+jwt typ: exec+jwt (preferred) Both accepted for backward compat

MaxParLength MaxPredLength Renamed to match pred claim

-00 (previous)	-01 (current)	Notes
`par`	`pred`	Predecessor task IDs
`pol`, `pol_decision`	removed (use `ect_ext`)	Policy claims moved to extension object
`sub`	not defined	Standard JWT claim, not part of ECT spec
`typ: wimse-exec+jwt`	`typ: exec+jwt` (preferred)	Both accepted for backward compat
`MaxParLength`	`MaxPredLength`	Renamed to match `pred` claim

This directory contains reference implementations of Execution Context Tokens (ECTs) for the WIMSE (Workload Identity in Multi System Environments) draft. Each refimpl provides ECT creation, verification, DAG validation, and an in-memory audit ledger.

Implementations

Language	Path	Description
Go	go-lang/	Production-ready Go library and demo. Config via env; optional JTI replay cache.
Python	python/	Python 3.9+ library and demo. Same API surface and env-based config.

Scope (all refimpls)

ECT format: JWT (JWS Compact Serialization) with required/optional claims per the spec.
Creation: Build and sign ECTs with ES256; kid and typ in the JOSE header.
Verification: Full verification procedure (parse, typ/alg, key resolution, signature, claims, optional DAG).
DAG validation: Uniqueness, predecessor existence, temporal ordering, acyclicity, predecessor policy.
Ledger: Interface plus in-memory append-only store.

No WIT/WPT issuance or full WIMSE stack; refimpls use key resolution only. Suitable for conformance testing and as a template for production integrations.

Replay cache (multi-instance)

The optional JTI replay cache (JTICache / JtiCache) is in-memory only. For multiple verifier instances behind a load balancer, replay detection must be shared. Use a distributed store (e.g. Redis, database) and implement the same contract as JTISeen: a function that returns true if the JTI was already seen, and ensure each verified JTI is recorded (e.g. with TTL). See go-lang/README and python/README for configuration and how to plug in a custom JTISeen / jti_seen.

Quick start

cd refimpl/go-lang && go run ./cmd/demo
go test ./...

Python

cd refimpl/python && pip install -e . && python3 demo.py
python3 -m pytest tests/ -v

Specification

Current draft: draft-nennemann-wimse-ect-01
Refimpl implements: -01 claim names

License

Same as the Internet-Draft (IETF Trust). Code components under Revised BSD per BCP 78/79.