Developers

An open, documented technical infrastructure.

Gankpo is an infrastructure that technical teams must be able to audit, integrate, and extend. This page gathers the essential architectural elements. Detailed documentation is available in thedocumentation centre.

Architecture at a glance

At the centre, gkp_core — the proprietary Rust cryptographic engine — exposes its functions to every application and service in the ecosystem: through native bindings for Gankpo Suite and Reader (Tauri), through a FFI C ABI binding for Gankpo Wallet, Docs, Reader Mobile (React Native / Capacitor), through a standalone binary for Gankpo CLI, and through an HTTP service for Gankpo Gateway.

Around this core, PKI adapters (X.509, OCSP, TSA) and bridges to the hardware keystores of the target platforms.

DIAGRAM GKP_CORE ARCHITECTURE640×320

Diagram: gkp_core at the centre, surrounded by applications, PKI integration services, and hardware keystores.

Technical architecture

The gkp_core engine centralises format, signature and verification operations shared by applications and integration services. Available interfaces are specified in the documentation supplied with each product.

Cryptographic primitives

Category	Implemented algorithms
Signatures issued	Ed25519 (native, via `ed25519-dalek` 2.1, RFC 8032)
Signatures verified (external PKI)	ECDSA P-256, ECDSA P-384, RSA (for X.509 certificates issued by third-party authorities)
Authenticated encryption (AEAD)	AES-256-GCM (NIST SP 800-38D), ChaCha20-Poly1305 (RFC 8439)
Hashing	BLAKE3, SHA-2 family (RFC 6234)
Key derivation	Argon2id (RFC 9106), HKDF-SHA-256 (RFC 5869)
Message authentication	HMAC-SHA-256 (RFC 2104)
Key exchange	X25519 (RFC 7748), ECIES
Certificate chains	X.509, CMS, OCSP via `webpki`

For the detailed mapping of standards ↔ RFC ↔ implementation module, see the Standards page.

Formats and specifications

Format .gkp v4.0.0 — self-contained electronic original. Magic bytes GKP2, 64-byte header, canonical CBOR metadata, AEAD envelope, append-only multi-signature chain.
Format .gksend — secure transmission envelope. Magic bytes GKSE, 32-byte header, CBOR manifest, AES-256-GCM payload.
QR credential GKP1: — QR-verifiable credential. Pipeline GKP1: → Base45 → zlib → COSE_Sign1 (ES256/P-256) → CBOR.
.gki draft — unsupported technical proposal for a portable identity format.
ISO 18013-5 — reference considered for mobile-document use cases; no certification is claimed.

Supported environments

Desktop: Tauri v2 (macOS, Windows, Linux).
Mobile phone: Capacitor 6 (iOS, Android) for Wallet and Docs; React Native 0.84 for Reader Mobile.
Tablet: Capacitor 6 (Android) and iPadOS.
Hardware keystores: Android StrongBox / TEE Keystore (Curve25519 hardware-backed on KeyMint v2+), macOS Keychain (dedicated module in gkp_core::secure_keystore::macos_keychain), Windows CNG TPM (module windows_tpm), PKCS#11 on Linux. On iOS, the wallet uses sovereign Curve25519 in software via libsodium unlocked by biometric iOS Keychain: Apple Secure Enclave is excluded because it imposes NIST curves incompatible with our sovereignty doctrine.

Start integrating

Gateway API quickstart — first call in under ten minutes.
Gateway API reference — full endpoint reference.
Web integration — components and embed.
Mobile SDK — iOS and Android integration.
Request developer access — the repository is opened on request to qualified technical partners.

Technical access

Request developer access.

The technical documentation is open. Source-code access is granted to qualified partners.