Validation of VC/VP in JSON-LD format when the Did documents contains multiple verification methods

[nitin-vavdiya]

Hi everyone,

There is a potential issue in the code when we verify VC/VP when the Did document contains multiple verification methods.

Let’s take an example, We have Did documents as below:

{
  "verificationMethod": [
    {
      "id": "did:web:somehost:BPNL0000001#key-1",
      "type": "JsonWebKey2020",
      "controller": "did:web:somehost:BPNL0000001",
      "publicKeyJwk": {
        "x": "eaz7fdqLpAkXcLXBjX_7Z9F0tXu8WJpVUyD7srem_i8",
        "y": "mvYAKOqv05X7zp6u5qa0OE3D5J5kzsg1Q-hkBq71qaU",
        "crv": "secp256k1",
        "kty": "EC"
      }
    },
    {
      "id": "did:web:somehost:BPNL0000001#key-2",
      "type": "JsonWebKey2020",
      "controller": "did:web:somehost:BPNL0000001",
      "publicKeyJwk": {
        "x": "TavA4AsRVyUqzCikxikzhA1QDKEtTq6MTRaG7vXjjFU",
        "y": "qNiK2kLmHfMaRzXFIZR5RY9JckP_zddmSdYViAC-OIA",
        "crv": "secp256k1",
        "kty": "EC"
      }
    }
  ]
}

and we have VC/VP in the form of JSON-LD with the below proof:

 "proof": {
  "created": "2023-07-19T09:11:41Z",
  "jws": "proof hash",
  "proofPurpose": "proofPurpose",
  "type": "JsonWebSignature2020",
  "verificationMethod": "did:web:somehost:BPNL0000001#key-2"
}

Now as per current implementation in DidMethodResolver.resolve(), it always picks the first verification method instead of matching with the correct verificationMethod from the proof, So in this case verification will fail.

Ref:

In the code base we have two places where we are selecting a verification method from the Did document:

1. DidMethodResolver.resolve(). → Always select the first verification method without matching proof id
2. DidPublicKeyResolverImpl.selectVerificationMethod(). → Select a verification method by matching kid in case VC/VP are in JWT format.

Is there any specific reason why DidMethodResolver.resolve() always chooses the first verification method instead of matching verificationMethod from the proof?

I understand that in the new IATP / DCP flow, VC/VP are in JWT format only