DAT C / C++ Library

Installation

Until it is officially merged into vcpkg, you will need to manually install and integrate the project using this repository.
https://github.com/microsoft/vcpkg/pull/52088
version: 4.7.0

Quick start

This complete flow retrieves certificates from CMS, creates a DAT containing JSON data, and verifies it.

Step by step

1. Connect to CMS

An issuing service uses a token for full certificates. Synchronizing immediately at startup prevents issuance before certificates are available.

2. Issue a DAT

This example puts public JSON in plain and protected user information as JSON in secure.

3. Verify a DAT

parse checks expiration and the signature, then decrypts secure. Use only a payload returned after successful verification.

Key functions

Function	Purpose
`dat_cms_manager_sync`	Synchronizes certificates immediately.
`dat_cms_manager_issue`	Allocates and returns a DAT string.
`dat_cms_manager_parse`	Allocates and returns a verified payload.
`dat_cms_manager_last_error`	Returns the last synchronization error.

Data regions

plain: bytes that are signed but not encrypted.
secure: encrypted bytes.
payload: trust it only after parse succeeds.

Options beyond JSON

The examples use familiar JSON. For faster processing, binary data can avoid JSON serialization and parsing while reducing data size.

Store simple values as text, or place structured data in binary formats such as Protobuf or MessagePack in plain and secure.

The current C issuance API accepts NUL-terminated strings. Encode arbitrary bytes as Base64Url or Hex, and read the result using the payload lengths.

Verify-only services

A service that does not issue DATs uses the verify-only option and a verify-only token, and calls only parse.

Shutdown and errors

Release dat, payload, and cms with their respective cleanup functions.

Use error codes and retry classifications instead of error messages.