Add Media over QUIC (MoQ) CAT support (draft-ietf-moq-c4m)

[zshenker]

Stacked on #6 (base: alg-confusion-fix). Merge after #6; GitHub will retarget this PR to main when #6 merges.

Summary

This PR adds the moqt and moqt-reval claims from draft-ietf-moq-c4m-01. With them, the library can issue and validate tokens for MoQ Transport relays, publishers, and clients.

• New moqt module.
  • It has typed MoqtClaim / MoqtScope / BinMatch scopes, MoqtAction codes 0–8, and MoqtRequest, which is an action plus a Full Track Name.
  • Matching is bytewise and case-sensitive, with exact, prefix, and suffix matches. A trailing nil pins the namespace length.
  • Parsing is strict: a malformed claim fails with Error::InvalidMoqtClaim. It is never ignored, so it can't widen access.
• Token API.
  • TokenBuilder::moqt / moqt_reval and Token::moqt_claim / moqt_reval, plus Token::moqt_claim_at / moqt_reval_at to read either claim at any label.
  • New VerificationOptions fields: verify_moqt, moqt_request, moqt_revalidation, and moqt_claim_labels (MoqtClaimLabels, defaulting to 327/328).
  • New errors: MoqtNotAuthorized and MoqtRevalidationUnsupported.
• moqt-reval handling. As the draft requires, recipients that can't revalidate reject tokens with a non-zero interval. The default for moqt_revalidation is Unsupported. Recipients that can revalidate reject intervals below their supported minimum.
• CborValue::Float. Floats are decoded at half, single, or double precision, and encoded at the shortest width that is exact. Without this, the draft's half-float moqt-reval test vector (f95cb0) fails to decode. It uses minicbor's half feature; the half crate is already in Cargo.lock through criterion.

Validator roles

The check is the same whoever does it, so there is one role-neutral API: verify the signature with verify_with_key and a typed VerifyingKey (from #6), then call verify_claims with a MoqtRequest. examples/moqt.rs covers three roles:

1. An edge relay validating a subscriber.
2. An ingest relay validating a publisher's PUBLISH_NAMESPACE and PUBLISH.
3. A publisher validating a relay's SUBSCRIBE using only an ES256 public key.

A relay can keep a token from session setup and re-check it for later actions such as REQUEST_UPDATE. It can do that through verify_claims, or by calling MoqtClaim::permits on a cached claim.

MoqtScope::matches_name exposes the same name matcher without the action check, for re-checking names against scopes already selected by action (for example each track routed to a publisher after PUBLISH_NAMESPACE, or SUBSCRIBE_NAMESPACE discovery).

Interpretation choices (flagged in docs and FOLLOWUPS)

• Which matches apply to which action. The draft doesn't say, so this PR decides:
  • Setup actions only need to appear in the scope's action list.
  • Namespace actions also check the namespace but skip the track match. Otherwise the draft's own publisher vector, [[2,6], ns, track], could never PUBLISH_NAMESPACE.
  • Track actions with no track always fail.
  • A request namespace shorter than the scope's is denied.
• Absent moqt claim. With verify_moqt(true), a token without a moqt claim authorizes no MoQ action. Draft §2 says that once a token is presented, all actions are blocked unless a scope enables them. (require_moqt was removed as redundant.)
• Claim keys. 327 and 328 are provisional values taken from the draft's test vectors; IANA lists them as TBD. Validators can override them with moqt_claim_labels to interoperate with issuers that use other labels.

Breaking changes (0.4.0 is unreleased)

• CborValue is now #[non_exhaustive] and has a new Float variant.
• VerificationOptions has new public fields, which breaks code that builds it with a struct literal.

Relationship to #6

This PR is based on #6 and uses its API: every signature check in the new tests, example, and README goes through verify_with_key with a typed VerifyingKey, so it adds no deprecation warnings. MoQ publishers and origins are expected to verify with public keys, which is exactly the algorithm-confusion case #6 fixes. test_moqt_hmac_forgery_over_public_key_is_rejected checks that an HMAC token forged over an ES256 public key is rejected before any moqt scope is consulted.

Deferred to FOLLOWUPS.md:

• Composite or / and / nor / crit claims.
• DPoP proof verification.
• Spec ambiguities to revisit as the draft evolves.

Testing

• src/tests_moqt.rs holds 26 tests. They are in a separate file to avoid conflicts with the edits Prevent algorithm-confusion forgery with typed VerifyingKey #6 makes to src/tests.rs. They cover:
  • Every EDN example in draft §4.
  • Publisher and subscriber role matrices.
  • Malformed-claim rejection.
  • Revalidation policy.
  • The draft's publisher, admin, and half-float payload vectors.
  • Float width encoding.
  • HS256 and ES256 round trips, using a fixed ES256 key (no RNG, so the tests don't depend on PS256-only dependencies).
  • Configurable claim labels.
  • Rejection of an HMAC forgery over an ES256 public key.
• On this branch, cargo fmt --check, cargo clippy --all-targets -- -D warnings, and cargo test (86 unit tests, 75 doctests) all pass.
• With Prevent algorithm-confusion forgery with typed VerifyingKey #6, Gate PS256 and the rsa dependency behind a default-on ps256 feature #9, Reject COSE structure tags that disagree with the algorithm on decode #10 and Allow injecting the clock and a clock-skew leeway for exp/nbf verification #11 merged locally together with this PR, clippy and cargo test pass both with default features (93 unit tests, 75 doctests) and with --no-default-features (87 unit tests, 75 doctests).
• All examples run.
• The crate builds on MSRV 1.88.

🤖 Generated with Claude Code