@axonmed/crypto

EXPERIMENTAL · Apache-2.0 · The public verifier layer for AXONMED.

Two primitives:

• vault — AES-256-GCM with HKDF-SHA256-derived per-user keys (Vault Encryption Protocol, VEP).
• attestation — Cohort Verification Hash (CVH) protocol: SHA-256 over RFC 8785 canonical JSON, signed by the AXONMED attestation key, and anchored on Solana via the Memo program.

Verify a published Finding

Every Finding on the AXONMED Findings Atlas links to a Solana memo signature. To verify:

pnpm add @axonmed/[email protected]

import {
  computeAttestationHash,
  parseMemoData,
  verifySignedAttestation,
} from '@axonmed/crypto/attestation'

// Pull the memo from the Solana transaction (e.g. via Helius getTransaction)
const memoText = '...'
const expectedHash = parseMemoData(memoText)
const attestationSignatureHex = '...' // 64-byte detached Ed25519 signature, hex-encoded
const attestationAuthority = '...' // AXONMED attestation authority public key

// The Finding's published metadata
const payload = {
  queryPlan: '...',
  cohortHash: '...',
  sampleSize: 87,
  resultDigest: '...',
  timestamp: 1747353600000,
  nonce: '...',
}

const recomputed = computeAttestationHash(payload)
const verified =
  expectedHash !== null &&
  recomputed === expectedHash &&
  verifySignedAttestation(payload, expectedHash, attestationSignatureHex, attestationAuthority)

console.log(verified ? 'verified' : 'MISMATCH')

If it verifies, the published Finding is byte-identical to the signed CVH and the detached signature matches the AXONMED attestation authority.

The public API is ESM-only and intentionally small:

• @axonmed/crypto exports the attestation and vault namespaces.
• @axonmed/crypto/attestation exports CVH hashing, Memo payload helpers, and detached Ed25519 verification.
• @axonmed/crypto/vault exports VEP key derivation plus AES-256-GCM encrypt/decrypt helpers.

Package Checks

pnpm -F @axonmed/crypto typecheck
pnpm -F @axonmed/crypto test
pnpm -F @axonmed/crypto build
pnpm -F @axonmed/crypto verify
(cd packages/crypto && npm pack --dry-run)

The npm package ships compiled ESM and .d.ts files from dist/, plus this README, Apache-2.0 license text, package metadata, and the local verifier self-check script. Source tests, env files, source maps, and key material are excluded from the published bundle.