This repository has been archived by the owner on Dec 12, 2024. It is now read-only.
Schema Signing & Verification #123
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,108 @@ | ||
| package keyaccess | ||
|
|
||
| import ( | ||
| "crypto" | ||
| "fmt" | ||
|
|
||
| "github.com/TBD54566975/ssi-sdk/cryptosuite" | ||
| didsdk "github.com/TBD54566975/ssi-sdk/did" | ||
| "github.com/goccy/go-json" | ||
| "github.com/lestrrat-go/jwx/jwk" | ||
| "github.com/mr-tron/base58" | ||
| "github.com/multiformats/go-multibase" | ||
| "github.com/multiformats/go-varint" | ||
| "github.com/pkg/errors" | ||
| "github.com/sirupsen/logrus" | ||
| ) | ||
|
|
||
| // GetVerificationInformation resolves a DID and provides a kid and public key needed for data verification | ||
| // it is possible that a DID has multiple verification methods, in which case a kid must be provided, otherwise | ||
| // resolution will fail. | ||
| func GetVerificationInformation(did didsdk.DIDDocument, maybeKID string) (kid string, pubKey crypto.PublicKey, err error) { | ||
| if did.IsEmpty() { | ||
| return "", nil, errors.Errorf("did doc: %+v is empty", did) | ||
| } | ||
| verificationMethods := did.VerificationMethod | ||
| if len(verificationMethods) == 0 { | ||
| return "", nil, errors.Errorf("did doc: %s has no verification methods", did.ID) | ||
| } | ||
|
|
||
| // handle the case where a kid is provided && there are multiple verification methods | ||
| if len(verificationMethods) > 1 { | ||
| if kid == "" { | ||
| return "", nil, errors.Errorf("kid is required for did: %s, which has multiple verification methods", did.ID) | ||
| } | ||
| for _, method := range verificationMethods { | ||
| if method.ID == kid { | ||
| kid = did.ID | ||
| pubKey, err = extractKeyFromVerificationMethod(verificationMethods[0]) | ||
| return | ||
| } | ||
| } | ||
| } | ||
| // TODO(gabe): some DIDs, like did:key have KIDs that aren't used, so we need to know when to use a kid vs the DID | ||
| kid = did.ID | ||
| pubKey, err = extractKeyFromVerificationMethod(verificationMethods[0]) | ||
| return | ||
| } | ||
|
|
||
| func extractKeyFromVerificationMethod(method didsdk.VerificationMethod) (pubKey crypto.PublicKey, err error) { | ||
| if method.PublicKeyMultibase != "" { | ||
| pubKeyBytes, multiBaseErr := multibaseToPubKeyBytes(method.PublicKeyMultibase) | ||
| if multiBaseErr != nil { | ||
| err = multiBaseErr | ||
| return | ||
| } | ||
| pubKey, err = cryptosuite.PubKeyBytesToTypedKey(pubKeyBytes, method.Type) | ||
| return | ||
| } else if method.PublicKeyBase58 != "" { | ||
| pubKeyDecoded, b58Err := base58.Decode(method.PublicKeyBase58) | ||
| if b58Err != nil { | ||
| err = b58Err | ||
| return | ||
| } | ||
| pubKey, err = cryptosuite.PubKeyBytesToTypedKey(pubKeyDecoded, method.Type) | ||
| return | ||
| } else if method.PublicKeyJWK != nil { | ||
| jwkBytes, jwkErr := json.Marshal(method.PublicKeyJWK) | ||
| if err != nil { | ||
| err = jwkErr | ||
| return | ||
| } | ||
| pubKey, err = jwk.ParseKey(jwkBytes) | ||
| return | ||
| } | ||
| err = errors.New("no public key found in verification method") | ||
| return | ||
| } | ||
|
|
||
| // multibaseToPubKey converts a multibase encoded public key to public key bytes for known multibase encodings | ||
| func multibaseToPubKeyBytes(mb string) ([]byte, error) { | ||
| if mb == "" { | ||
| err := fmt.Errorf("could not decode value: %s", mb) | ||
| logrus.WithError(err).Error() | ||
| return nil, err | ||
| } | ||
|
|
||
| encoding, decoded, err := multibase.Decode(mb) | ||
| if err != nil { | ||
| logrus.WithError(err).Error("could not decode did:key") | ||
| return nil, err | ||
| } | ||
| if encoding != didsdk.Base58BTCMultiBase { | ||
| err := fmt.Errorf("expected %d encoding but found %d", didsdk.Base58BTCMultiBase, encoding) | ||
| logrus.WithError(err).Error() | ||
| return nil, err | ||
| } | ||
|
|
||
| // n = # bytes for the int, which we expect to be two from our multicodec | ||
| _, n, err := varint.FromUvarint(decoded) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| if n != 2 { | ||
| return nil, errors.New("error parsing did:key varint") | ||
| } | ||
| pubKeyBytes := decoded[n:] | ||
| return pubKeyBytes, nil | ||
| } | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
moved this to its own package, since it has use outside of just cred verification