DiME, the open and trust-based data format building secure Application-based Public-Key Infrastructures (APKIs) in a breeze.
A DiME envelope encapsulates other DiME items. This produces the consistent format for encoded DiME items and always starts with the header 'Di'. All DiME encoded strings are envelopes, no matter if they contain one or more items.
Envelopes may either be unsigned or signed. The main difference is that signed envelopes uses a digital signature to protect the integrity of the content. In some cases this may not be needed, as individual DiME items may themselves be digitally signed, thus making it unnessarcy to sign the encapsulating envelope..
Unsigned envelope
An unsigned envelope only consists of the header ('Di') and any items within separated by a colon (':'), known as an item separator. Below is an example of an anonymous envelope containing an identity item:
No separate validation is required for an unsigned envelope. However, items contained within may need to be verified independently.
Signed envelope
Signed envelopes are DiME envelopes that, besides containing one or more items, also carry a signature at the end that protects the integrity of all enclosed items. The following example shows a signed envelope where the signature is placed after the final item separator (':'):
The envelope signature should be verified before any processing of items inside a signed envelope. The public key to verify a signature may indicated by claims components following the header ('Di').
Claims
Claims are information associated with the envelope. These are stored in the component following the header ('Di'). This component is only included if the envelope is signed and, among other things, identified the entity that signed the enveloped and when it was issued.
For more details information around available claims refer to Claims.
