feat(sd-jwt-vc): Module for Issuer, Holder and verifier #1607

berendsliedrecht · 2023-10-17T13:09:06Z

Module for interacting with SD-JWTs as an issuer, holder and verifier.

The module is called SdJwtModule, however since we only deal with SdJwtVc I think it should be renamed to SdJwtVcModule.

As an issuer you get the SdJwtModule.create function which allows you to create an sd-jwt-vc where the framework sets all the required properties (like iat). It returns a record and a compact form of the sd-jwt-vc. Since key binding is required in sd-jwt-vc, a holderDidUrl is required for creation, which will be turned into a JWK and embedded in the payload as a cnf claim.

The holder gets the SdJwtModule.receive and SdJwtModule.present. The receive function simply validates that the signature is correct and the correct holder key is used. The present method allows a user to remove certain items from the sd-jwt-vc. The present method returns a compact format of the sd-jwt-vc which can be send to the verifier.

The verifier gets the SdJwtModule.verify method. This checks the keybinding, issuer signature and whether all the required fields are included.

Note: The module also exposes some repository functionality as we do not have a generic repository module, yet.

packages/core/src/crypto/jose/jwk/transform.ts

packages/sd-jwt/src/SdJwtService.ts

TimoGlastra · 2023-10-17T14:17:51Z

packages/sd-jwt/src/repository/SdJwtRecord.ts

+    }
+  }
+
+  public getTags() {


No tags at all will make it especially hard to query the credentials for input in a VP...

yeah I was wondering what the best tag structure would be for this. Right now I added the disclosure keys as an array, but I am not sure whether that is supported within askar.

Will likely also include the claimKeys, combined with the selectively disclosable keys.

You can add arrays. It will currently be added as an <attr>:<value>: 1/0 I think. So disclosureKeys:age: 1. Maybe askar also supports something for this natively, which we maybe should look into

Tags will be left as-is for now. Once we do the integration with openid they can be added as at that point we will know exactly how to query.

yarn.lock

packages/sd-jwt/package.json

codecov-commenter · 2023-10-20T11:54:06Z

Codecov Report

Merging #1607 (c95fe6a) into main (1785479) will increase coverage by 0.00%.
The diff coverage is 86.38%.

@@           Coverage Diff            @@
##             main    #1607    +/-   ##
========================================
  Coverage   85.66%   85.67%            
========================================
  Files         950      959     +9     
  Lines       22879    23082   +203     
  Branches     4022     4049    +27     
========================================
+ Hits        19600    19775   +175     
- Misses       3095     3123    +28     
  Partials      184      184

Files	Coverage Δ
packages/core/src/crypto/jose/jwk/Jwk.ts	`80.00% <100.00%> (ø)`
packages/core/src/crypto/jose/jwk/index.ts	`100.00% <100.00%> (ø)`
packages/core/src/index.ts	`100.00% <100.00%> (ø)`
...odules/generic-records/repository/GenericRecord.ts	`100.00% <ø> (ø)`
...ages/openid4vc-client/src/OpenId4VcClientModule.ts	`100.00% <ø> (ø)`
packages/sd-jwt-vc/src/SdJwtVcError.ts	`100.00% <100.00%> (ø)`
packages/sd-jwt-vc/src/SdJwtVcModule.ts	`100.00% <100.00%> (ø)`
...ckages/sd-jwt-vc/src/__tests__/sdjwtvc.fixtures.ts	`100.00% <100.00%> (ø)`
packages/sd-jwt-vc/src/index.ts	`100.00% <100.00%> (ø)`
packages/sd-jwt-vc/src/repository/SdJwtVcRecord.ts	`100.00% <100.00%> (ø)`
... and 5 more

packages/sd-jwt/src/SdJwtOptions.ts

TimoGlastra · 2023-10-27T08:39:12Z

packages/sd-jwt/src/SdJwtOptions.ts

+
+export type SdJwtReceiveOptions = {
+  issuerDid: Key
+  holderKey?: Key


These will both already be in the JWT right?

I changed it to issuerKey and holderkey which are used to confirm the signature and check whether the cnf claim is correct. If this info is invalid the sd-jwt cannot be used.

now using issuerDidUrl and holderDidUrl.

packages/sd-jwt/src/SdJwtOptions.ts

berendsliedrecht · 2023-10-27T08:52:40Z

Somehow I can't reply to your comment...

Why does the issuer need to provide both an issuerDid and an issuerKey? I think with other places we've required to pass a key reference within the did then (did:key:123#123) and based on that we can get the issuerDid and issuerKey.

Usually I try to avoid two params that can clash (as you can provide a key that doesn't belong to the did). We can call the parameter the keyId (or something like that, forgot what it's called) and also add it to the header of the JWT

Yeah I was thinking about this for a bit and a did with key reference would be good. I did not do it like that for now as you would need to resolve your own did. I will add it where you have to pass a did with key reference. It will make the method slower though.

TimoGlastra · 2023-10-30T10:49:41Z

Somehow I can't reply to your comment...

Why does the issuer need to provide both an issuerDid and an issuerKey? I think with other places we've required to pass a key reference within the did then (did🔑123#123) and based on that we can get the issuerDid and issuerKey.

Usually I try to avoid two params that can clash (as you can provide a key that doesn't belong to the did). We can call the parameter the keyId (or something like that, forgot what it's called) and also add it to the header of the JWT

Yeah I was thinking about this for a bit and a did with key reference would be good. I did not do it like that for now as you would need to resolve your own did. I will add it where you have to pass a did with key reference. It will make the method slower though.

I think that is fine for now. We have this in a few other places, where we resolve our own did. But I thin we should solve this generically by allowing the did to be retrieved from local storage / cache.

packages/sd-jwt/src/repository/SdJwtRecord.ts

TimoGlastra

Nice work @berendsliedrecht. Mostly some small improvements

packages/core/src/crypto/jose/jwk/Jwk.ts

packages/core/src/crypto/jose/jwk/transform.ts

packages/sd-jwt/README.md

packages/sd-jwt/package.json

packages/sd-jwt/src/SdJwtOptions.ts

packages/sd-jwt/src/SdJwtService.ts

berendsliedrecht · 2023-11-02T09:37:28Z

@karimStekelenburg @TimoGlastra Quickly before merging, should the module be called SdJwtVc or SdJwt? It is SdJwt right now but we only really handle SdJwtVc.

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

karimStekelenburg

Looking good overall. I left a few comments here and there, but they're mostly suggestions. I only see happy flow tests though. Doesn't have to bne noew, but I think we should add sad flow tests when we combine it with OID4VC.

karimStekelenburg · 2023-11-02T10:46:26Z

packages/sd-jwt/src/__tests__/SdJwtService.test.ts

+    })
+  })
+
+  describe('SdJwtService.present', () => {


Maybe add a test where the holder tries to disclose a non-disclosable value?

Yeah good point regarding the non-happy flow tests. I would like to add them in a separate PR to keep this one "small".

packages/sd-jwt/src/SdJwtOptions.ts

packages/sd-jwt/src/SdJwtApi.ts

packages/sd-jwt/package.json

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

genaris

I like the simplicity of the API, seems to be very fun to use!

Just left a comment regarding an old discussion that we never completely materialized in code (maybe for a further breaking change PR now we are introducing a new major version).

genaris · 2023-11-02T11:43:00Z

packages/sd-jwt/src/SdJwtApi.ts

+    return await this.sdJwtService.getAllCredentialRecords(this.agentContext)
+  }
+
+  public async findCredentialRecordsByQuery(query: Query<SdJwtRecord>): Promise<Array<SdJwtRecord>> {


Following the convention used in other module APIs (and services in general) we'd call it findAllCredentialRecordsByQuery, to make more explicit about the fact that we expect multiple records to be retrieved. Actually, in most modules we make naming simpler (e.g. findAllByQuery), but I see it's not the case here and W3cCredentialsApi (the API this module is based on I guess).

Of course if we change this here and leave W3cCredentialsApi as is, it would not be consistent. And if we change it in W3cCredentialsApi as well we'll introduce a breaking change. But I just wanted to point out this to bother you 😄

Ah good point! I think we can change this in a separate PR which changes both the w3c and this one.

I am actually not sure what the best name would be here. I think findAllByQuery is the best as it is already scoped under sdJwt within the agent.modules api.

I think all of them to findById, findAllByQuery. They will be removed in the future and I think they were too verbose before.

genaris · 2023-11-02T11:47:27Z

packages/sd-jwt/tests/sdJwtVc.e2e.test.ts

+    config: { label, walletConfig: { id: utils.uuid(), key: utils.uuid() } },
+    modules: {
+      sdJwt: new SdJwtModule(),
+      // @ts-ignore


What's the problem here that required a ts-ignore? It's about not using askar-nodejs as direct dependency?

The expected ariesAskar type did not match the one from the module as I think it used 0.2.0-dev.1 and I used 0.1.0. I think I can remove it again

genaris · 2023-11-02T11:48:00Z

packages/sd-jwt/tests/setup.ts

@@ -0,0 +1,3 @@
+import 'reflect-metadata'
+
+jest.setTimeout(120000)


Do you expect SD-JWT to take that long?

Copied from another test. It is quite quick, but askar and agent initialization makes some steps a bit slow. Better overestimate here I guess ;).

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

…oundation#1607) Signed-off-by: Berend Sliedrecht <blu3beri@proton.me> Signed-off-by: Martin Auer <martin.auer97@gmail.com>

…oundation#1607) Signed-off-by: Berend Sliedrecht <blu3beri@proton.me> Signed-off-by: Ariel Gentile <gentilester@gmail.com>

berendsliedrecht force-pushed the sd-jwt branch from 17e235e to d0d7f67 Compare October 17, 2023 13:16

TimoGlastra reviewed Oct 17, 2023

View reviewed changes

berendsliedrecht force-pushed the sd-jwt branch from d0d7f67 to 7a818ef Compare October 20, 2023 11:36

berendsliedrecht commented Oct 24, 2023

View reviewed changes

packages/sd-jwt/src/SdJwtOptions.ts Outdated Show resolved Hide resolved

TimoGlastra reviewed Oct 27, 2023

View reviewed changes

berendsliedrecht force-pushed the sd-jwt branch 2 times, most recently from a466b15 to 7385737 Compare October 30, 2023 09:40

berendsliedrecht force-pushed the sd-jwt branch from 056df0a to 413b6af Compare October 30, 2023 10:56

berendsliedrecht commented Oct 30, 2023

View reviewed changes

packages/sd-jwt/src/repository/SdJwtRecord.ts Outdated Show resolved Hide resolved

berendsliedrecht force-pushed the sd-jwt branch 2 times, most recently from 0bab1ab to 75569fe Compare October 30, 2023 12:04

berendsliedrecht marked this pull request as ready for review October 31, 2023 09:28

berendsliedrecht requested a review from a team as a code owner October 31, 2023 09:28

berendsliedrecht requested review from genaris, karimStekelenburg and TimoGlastra October 31, 2023 09:29

TimoGlastra approved these changes Nov 2, 2023

View reviewed changes

berendsliedrecht force-pushed the sd-jwt branch from 90fd94d to 6767112 Compare November 2, 2023 09:50

Berend Sliedrecht added 8 commits November 2, 2023 10:50

chore(sd-jwt): project setup

d50a28d

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

chore(sd-jwt): updated with api, module and service

cba3684

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

feat(sd-jwt): create sd-jwt as an issuer

f6042c0

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

chore(sd-jwt): update deps

60ffc12

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

fix(sd-jwt): revamped the create API

92f50ad

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

feat(sd-jwt): implemented sdJwt.receive

6a1dc9a

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

improved verification

4bf9709

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

update jwt-sd package

4d91c07

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

Berend Sliedrecht added 7 commits November 2, 2023 10:50

feat(sd-jwt): changed API to take did urls

aec8e8a

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

test(sd-jwt): include full e2e test

24f04ba

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

fix(sd-jwt): use the claim in the header

55a96c0

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

fix(sd-jwt): additional check for 'kty' claim

b857e4c

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

feat(sd-jwt): store holder did on record

10831cb

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

feat(sd-jwt): include repository commands in the API

625f09b

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

fix(sd-jwt): get the issuerDidUrl from the sd-jwt itself

d697756

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

berendsliedrecht force-pushed the sd-jwt branch 3 times, most recently from 97af36b to e7eb71b Compare November 2, 2023 10:13

karimStekelenburg reviewed Nov 2, 2023

View reviewed changes

karimStekelenburg self-requested a review November 2, 2023 11:18

fix(sd-jwt): resolved most of the feedback

7eed255

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

berendsliedrecht force-pushed the sd-jwt branch from e7eb71b to 7eed255 Compare November 2, 2023 11:22

karimStekelenburg approved these changes Nov 2, 2023

View reviewed changes

genaris approved these changes Nov 2, 2023

View reviewed changes

Berend Sliedrecht added 3 commits November 2, 2023 14:12

fix(sd-jwt): removed ts-ignore and updated public API

afdd0dc

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

fix(sd-jwt): made api more inline with w3c

270382d

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

chore(sd-jwt): update jwt-sd to next patch version

8fe5b77

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

berendsliedrecht changed the title ~~feat(sd-jwt): Module for Issuer, Holder and verifier~~ feat(sd-jwt-vc): Module for Issuer, Holder and verifier Nov 2, 2023

Berend Sliedrecht added 2 commits November 2, 2023 15:15

feat(sd-jwt-vc): rename sd-jwt to sd-jwt-vc

c5063e1

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

fix(sd-jwt-vc): remove cast

d0b3c98

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

berendsliedrecht force-pushed the sd-jwt branch from 8d5ed0f to 63a4987 Compare November 3, 2023 09:42

fix(sd-jwt-vc): updated jwt-sd

c95fe6a

Signed-off-by: Berend Sliedrecht <blu3beri@proton.me>

berendsliedrecht force-pushed the sd-jwt branch from 63a4987 to c95fe6a Compare November 3, 2023 10:36

berendsliedrecht merged commit ec3182d into openwallet-foundation:main Nov 3, 2023

berendsliedrecht deleted the sd-jwt branch November 3, 2023 11:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(sd-jwt-vc): Module for Issuer, Holder and verifier #1607

feat(sd-jwt-vc): Module for Issuer, Holder and verifier #1607

berendsliedrecht commented Oct 17, 2023 •

edited

Loading

TimoGlastra Oct 17, 2023

berendsliedrecht Oct 24, 2023

TimoGlastra Oct 27, 2023

berendsliedrecht Nov 2, 2023 •

edited

Loading

codecov-commenter commented Oct 20, 2023 •

edited

Loading

TimoGlastra Oct 27, 2023

berendsliedrecht Oct 27, 2023

berendsliedrecht Oct 27, 2023

berendsliedrecht commented Oct 27, 2023 •

edited

Loading

TimoGlastra commented Oct 30, 2023

TimoGlastra left a comment

berendsliedrecht commented Nov 2, 2023

karimStekelenburg left a comment

karimStekelenburg Nov 2, 2023

berendsliedrecht Nov 2, 2023

genaris left a comment

genaris Nov 2, 2023

berendsliedrecht Nov 2, 2023

berendsliedrecht Nov 2, 2023

berendsliedrecht Nov 2, 2023

genaris Nov 2, 2023

berendsliedrecht Nov 2, 2023

genaris Nov 2, 2023

berendsliedrecht Nov 2, 2023

		@@ -0,0 +1,3 @@
		import 'reflect-metadata'

		jest.setTimeout(120000)

feat(sd-jwt-vc): Module for Issuer, Holder and verifier #1607

feat(sd-jwt-vc): Module for Issuer, Holder and verifier #1607

Conversation

berendsliedrecht commented Oct 17, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

berendsliedrecht Nov 2, 2023 • edited Loading

Choose a reason for hiding this comment

codecov-commenter commented Oct 20, 2023 • edited Loading

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

berendsliedrecht commented Oct 27, 2023 • edited Loading

TimoGlastra commented Oct 30, 2023

TimoGlastra left a comment

Choose a reason for hiding this comment

berendsliedrecht commented Nov 2, 2023

karimStekelenburg left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

genaris left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

berendsliedrecht commented Oct 17, 2023 •

edited

Loading

berendsliedrecht Nov 2, 2023 •

edited

Loading

codecov-commenter commented Oct 20, 2023 •

edited

Loading

berendsliedrecht commented Oct 27, 2023 •

edited

Loading