Eclipse Biscuit

Protocolo de Identidad

An authorization token with decentralized verification, offline attenuation and policy enforcement based on a logic language (Datalog). A Biscuit is signed with public-key cryptography so any service that knows the public key can verify it, and the holder can derive a new token with fewer rights, for instance a read-only or time-limited one, without contacting the issuer. Authorization policies are written in Datalog and can be supplied by the verifying application or carried by the token. Every token has unique revocation identifiers that reject it and all tokens attenuated from it. It suits capability-based authorization but can also express access control lists. Implementations exist in Rust, Haskell, Go, Java, JavaScript and WebAssembly, C, Python and C#; it is an Eclipse Foundation project .

Fundación
Enlaces
Visitar Sitio Web Ver esta herramienta en el grafo Sugerir una corrección

Detalles

Licencia Permissive (Apache-2.0). https://github.com/eclipse-biscuit/biscuit (specification); implementations: biscuit-rust, biscuit-wasm, biscuit-python, biscuit-haskell, biscuit-java and others
Estado de Desarrollo 🟢 Activo
Propietario Eclipse Foundation (project Eclipse Biscuit); maintained and led by Geoffroy Couprie, Clément Delafargue and Cédric Corbière, with dozens of contributors over the years
Órgano de Gobierno Eclipse Foundation (Eclipse Biscuit project, status Incubating); project leads Geoffroy Couprie, Clément Delafargue and Cédric Corbière
País Not stated by the project.
Año de Inicio 2019
Stack Protobuf-serialized tokens, Ed25519 signatures, Datalog-based authorization language; Rust reference implementation compiled to WebAssembly for JavaScript; other language libraries
Financiamiento Not stated by the project.
Última Investigación 29 oct 2026

Dominios de Caso de Uso

Identidad y Confianza

Capacidades

Atestaciones portátiles Divulgación contextual

Protocolo de Identidad Atributos

Orígenes An authorization token that blends public-key-verifiable tokens (as in JWT or macaroons) with offline attenuation and a logic-based policy language, so that services can verify and narrow permissions without a central authorization server
Base de Datos N/A
Lenguaje de Consulta Datalog-based policy language for authorization rules, checks and facts
Formatos de Datos Protobuf-encoded token with signed blocks; Ed25519 signatures; a base64 text form for transport
Soporte Móvil Library-level: Rust, WebAssembly and other language libraries; no application
Soporte Web Yes: online tooling lets tokens be created, attenuated, inspected and tested in a browser
Aplicaciones Nativas Library-level only
Términos Free and open source (Apache-2.0)
Fondos Not stated by the project.
Basado En Public-key tokens and capability security (JWT-style signatures, macaroon-style attenuation) with Datalog as the policy language
Permisos Capabilities and access control lists expressed as Datalog policies; attenuation can only add restrictions
Autenticación e Identidad Tokens are authorization credentials signed by the issuer's key; the token's blocks can carry facts about the holder, but identity itself is left to the application
Modelo de Almacenamiento Tokens are self-contained and carried by the holder; verifiers need only the issuer's public key
Interoperabilidad A protobuf schema and a published list of test cases let new implementations be built; implementations in nine languages are listed, with differing support for newer specification versions shown in the feature table
Portabilidad de Datos Tokens can be passed between parties and attenuated offline; they are not tied to a particular service beyond the issuer's public key
Gobernanza y Toma de Decisiones Eclipse Foundation project process with three named project leads; specification changes are made in the open repository and tracked in a roadmap issue
Madurez del Protocolo / Estandarización Specification v3.3 and a stable earlier version; an Eclipse Foundation project in Incubating status; not an IETF or W3C deliverable; the project says it is still seeking an audit
Estándares de Identidad No W3C DID or Verifiable Credentials mapping; the token is its own format
Métodos DID Soportados N/A
Gestión de Claves Ed25519 root key held by the issuer; attenuation blocks are signed with ephemeral keys derived along the chain
Tipos de Credenciales Authorization tokens with attenuation blocks; not identity credentials
Método de Verificación Any verifier with the root public key checks the signature chain and then runs the Datalog policies against the token's facts and the request
Funciones de Privacidad Limited: the token carries its facts and checks in the clear, and the authors note attenuation is visible to the verifier; the project does not claim anonymity or unlinkability
Métodos de Autenticación Public-key signatures on token blocks, with optional third-party blocks signed by other parties
Mecanismo de Revocación Unique revocation identifiers per block let a verifier reject a token and all tokens attenuated from it; expiry can be set by attenuation
Tipos de Agentes Soportados Services, users and applications that issue, hold or verify tokens
Tipos de Billetera/Cliente Libraries and online tooling; no wallet
Mecanismos de Recuperación Not stated by the project.
Cumplimiento / Regulaciones Not stated by the project.
Protocolos de Intercambio de Credenciales None defined: tokens are carried in headers or messages by the application
Marco de Confianza Trust in the issuer's public key; third-party blocks allow trust in other parties' signatures when the verifier chooses
Modelo de Costos Free to use
Resistencia a la Censura High for verification, since a verifier needs only a public key; issuance depends on the application