Eclipse Biscuit

Protocolo de Identidade

An authorization token with decentralized verification, offline attenuation and policy enforcement based on a logic language (Datalog). A Biscuit is signed with public-key cryptography so any service that knows the public key can verify it, and the holder can derive a new token with fewer rights, for instance a read-only or time-limited one, without contacting the issuer. Authorization policies are written in Datalog and can be supplied by the verifying application or carried by the token. Every token has unique revocation identifiers that reject it and all tokens attenuated from it. It suits capability-based authorization but can also express access control lists. Implementations exist in Rust, Haskell, Go, Java, JavaScript and WebAssembly, C, Python and C#; it is an Eclipse Foundation project .

Fundação
Links
Visitar Website Ver esta ferramenta no grafo Sugerir uma correção

Detalhes

Licença Permissive (Apache-2.0). https://github.com/eclipse-biscuit/biscuit (specification); implementations: biscuit-rust, biscuit-wasm, biscuit-python, biscuit-haskell, biscuit-java and others
Status de Dev 🟢 Ativo
Proprietário Eclipse Foundation (project Eclipse Biscuit); maintained and led by Geoffroy Couprie, Clément Delafargue and Cédric Corbière, with dozens of contributors over the years
Órgão de Governança Eclipse Foundation (Eclipse Biscuit project, status Incubating); project leads Geoffroy Couprie, Clément Delafargue and Cédric Corbière
País Not stated by the project.
Ano de Início 2019
Stack Protobuf-serialized tokens, Ed25519 signatures, Datalog-based authorization language; Rust reference implementation compiled to WebAssembly for JavaScript; other language libraries
Financiamento Not stated by the project.
Última Investigação 29 de out. de 2026

Domínios de Caso de Uso

Identidade e Confiança

Capacidades

Atestações portáteis Divulgação contextual

Protocolo de Identidade Atributos

Origens An authorization token that blends public-key-verifiable tokens (as in JWT or macaroons) with offline attenuation and a logic-based policy language, so that services can verify and narrow permissions without a central authorization server
Banco de Dados N/A
Linguagem de Consulta Datalog-based policy language for authorization rules, checks and facts
Formatos de Dados Protobuf-encoded token with signed blocks; Ed25519 signatures; a base64 text form for transport
Suporte Móvel Library-level: Rust, WebAssembly and other language libraries; no application
Suporte Web Yes: online tooling lets tokens be created, attenuated, inspected and tested in a browser
Aplicativos Nativos Library-level only
Termos Free and open source (Apache-2.0)
Fundos Not stated by the project.
Baseado Em Public-key tokens and capability security (JWT-style signatures, macaroon-style attenuation) with Datalog as the policy language
Permissões Capabilities and access control lists expressed as Datalog policies; attenuation can only add restrictions
Autenticação e Identidade Tokens are authorization credentials signed by the issuer's key; the token's blocks can carry facts about the holder, but identity itself is left to the application
Modelo de Armazenamento Tokens are self-contained and carried by the holder; verifiers need only the issuer's public key
Interoperabilidade A protobuf schema and a published list of test cases let new implementations be built; implementations in nine languages are listed, with differing support for newer specification versions shown in the feature table
Portabilidade de Dados Tokens can be passed between parties and attenuated offline; they are not tied to a particular service beyond the issuer's public key
Governança e Tomada de Decisão Eclipse Foundation project process with three named project leads; specification changes are made in the open repository and tracked in a roadmap issue
Maturidade / Padronização do Protocolo Specification v3.3 and a stable earlier version; an Eclipse Foundation project in Incubating status; not an IETF or W3C deliverable; the project says it is still seeking an audit
Padrões de Identidade No W3C DID or Verifiable Credentials mapping; the token is its own format
Métodos DID Suportados N/A
Gestão de Chaves Ed25519 root key held by the issuer; attenuation blocks are signed with ephemeral keys derived along the chain
Tipos de Credenciais Authorization tokens with attenuation blocks; not identity credentials
Método de Verificação Any verifier with the root public key checks the signature chain and then runs the Datalog policies against the token's facts and the request
Recursos de Privacidade Limited: the token carries its facts and checks in the clear, and the authors note attenuation is visible to the verifier; the project does not claim anonymity or unlinkability
Métodos de Autenticação Public-key signatures on token blocks, with optional third-party blocks signed by other parties
Mecanismo de Revogação Unique revocation identifiers per block let a verifier reject a token and all tokens attenuated from it; expiry can be set by attenuation
Tipos de Agentes Suportados Services, users and applications that issue, hold or verify tokens
Tipos de Carteira/Cliente Libraries and online tooling; no wallet
Mecanismos de Recuperação Not stated by the project.
Conformidade / Regulamentações Not stated by the project.
Protocolos de Troca de Credenciais None defined: tokens are carried in headers or messages by the application
Estrutura de Confiança Trust in the issuer's public key; third-party blocks allow trust in other parties' signatures when the verifier chooses
Modelo de Custo Free to use
Resistência à Censura High for verification, since a verifier needs only a public key; issuance depends on the application