Support Selective Disclosure SD-JWT #1268

abdulmth · 2023-11-30T12:27:31Z

Add Rust and Wasm support for verifying selective disclosures JWT and key binding JWT using https://github.com/iotaledger/sd-jwt-payload.

UMR1352 · 2023-12-12T10:21:34Z

identity_credential/src/validator/jwt_credential_validation/jwt_credential_validator.rs

I'm not too convinced with how the validator has changed. Having to explicitly pass the optional SdObjectDecoder doesn't feel really confortable. Don't you think it might be worth having SdObjectDecoder work behind the scene? The APIs for JwtCredentialValidator remains the same, but internally use SdObjectDecoder if the JWT received as input is a SD-JWT. If a user knows for sure that they are working with a SD-JWT then they can use the SdObjectDecoder directly, maybe through some utility functions or even an extension trait provided by the library to make things more ergonomic.
Probably we can discuss a better way to handle this. What concerns me is that this won't scale well if we want to handle the validation of even more JWT types (say ZK-JWT for instance), as it could require to add yet another optional parameter to every method call.

I see now you have created an SdJwtValidator that only validates SD-JWT encoded credential. Even more of a reason to avoid polluting the APIs of JwtCredentialValidator if the two have different concerns.

The library's API didn't really change, since none of the public methods changed. validate_extended is not public.
I agree with you that this does not scale well. But If we want to separate the concerns, we pretty much have to duplicate the majority of the JwtCredentialValidator.

Don't you think it might be worth having SdObjectDecoder work behind the scene?

It doesn't work, it's tightly coupled with the signature. You can not reuse JwtCredentialValidator if you do the decoding yourself. You have to verify the signature first, which is a deep down part of the JwtCredentialValidator.

So all in all, we either have to duplicate JwtCredentialValidator, or we have to rewrite it completely to make it more generic (not solved problem), or we keep the current solution and make it a future problem :D, But for ZK, I don't think it would use any of the JwtCredentialValidator. I don't think it would have a big overlap for that to make sense.

My concern is only that the sd_jwt_payload is not an optional dependency if users only want JwtCredentialValidator. But I kept all selective disclosure concerns under a flag, in case we want to rewrite or rethink the architecture of the internal implementation of the JwtCredentialValidator.

@abdulmth the last thing you mentioned is definitely something worth discussing. I couldn't have thought about it, thanks for pointing it out.

identity_credential/src/validator/sd_jwt/kb_validation_options.rs

UMR1352 · 2024-01-12T16:06:38Z

We might want to further split some validation steps into smaller reusable and composable functions which probably better belong to JwtCredentialValidationUtils rather than JwtCredentialValidator

abdulmth · 2024-01-15T21:56:46Z

bindings/wasm/src/iota/iota_document.rs

@@ -704,7 +704,39 @@ impl WasmIotaDocument {
  ///
  /// Upon success a string representing a JWS encoded according to the Compact JWS Serialization format is returned.
  /// See [RFC7515 section 3.1](https://www.rfc-editor.org/rfc/rfc7515#section-3.1).
+  ///
+  /// @deprecated Use `createJws()` instead.


typo in the latest release. I added a new method and deprecated this one

abdulmth · 2024-01-15T22:09:43Z

We might want to further split some validation steps into smaller reusable and composable functions which probably better belong to JwtCredentialValidationUtils rather than JwtCredentialValidator

We can do that in a separate PR, this one is getting a bit too big.

I already adapted your PR here, we can close that one I think.

UMR1352

Looks good. Great job with the example!

eike-hass

Looks really good, I left a couple of minor suggestions. Please also add the new example to bindings/wasm/examples/src/tests to run it in CI.

eike-hass · 2024-01-16T14:33:34Z

bindings/wasm/examples/src/1_advanced/6_sd_jwt.ts

+
+/**
+ * Demonstrates how to create a selective disclosure verifiable credential and validate it
+ * using the standard [Selective Disclosure for JWTs (SD-JWT)](https://www.ietf.org/archive/id/draft-ietf-oauth-selective-disclosure-jwt-07.html).


Suggested change

* using the standard [Selective Disclosure for JWTs (SD-JWT)](https://www.ietf.org/archive/id/draft-ietf-oauth-selective-disclosure-jwt-07.html).

* using the [Selective Disclosure for JWTs (SD-JWT)](https://www.ietf.org/archive/id/draft-ietf-oauth-selective-disclosure-jwt-07.html) specification.

eike-hass · 2024-01-16T14:42:34Z

bindings/wasm/examples/src/1_advanced/6_sd_jwt.ts

+    // disclosures.
+    const strDisclosures = disclosures.map(disclosure => disclosure.toEncodedString());
+
+    let sdJwt = new SdJwt(jws.toString(), strDisclosures, undefined).presentation();


can we omit the third parameter?

Done, I kept it originally to hint that users can optionally add the KB. but it's demonstrated further down in the code so it's fine.

bindings/wasm/examples/src/1_advanced/6_sd_jwt.ts

eike-hass · 2024-01-16T14:56:30Z

bindings/wasm/examples/src/1_advanced/6_sd_jwt.ts

+    const kbJwt = await aliceDocument.createJws(aliceStorage, aliceFragment, bindingClaims.toString(), options);
+
+    // Create the final SD-JWT.
+    let finalSdJwt = new SdJwt(sdJwtReceived.jwt().toString(), toBeDisclosed, kbJwt.toString());


maybe sdJwtWithKb

eike-hass · 2024-01-16T14:59:47Z

bindings/wasm/src/credential/credential.rs

@@ -215,6 +218,26 @@ impl WasmCredential {
  pub fn set_proof(&mut self, proof: Option<WasmProof>) {
    self.0.set_proof(proof.map(|wasm_proof| wasm_proof.0))
  }
+
+  /// Serializes the `Credential` as a JWT claims set
+  /// in accordance with [VC Data Model v1.1](https://www.w3.org/TR/vc-data-model/#json-web-token).


We know Data Model 2.0 will be a thing, should we somehow anticipate that already?

They don't have it in the Data Model 2.0, it's in Securing Verifiable Credentials using JOSE and COSE.
I'm not sure what we can do here, it affects our JWT implementation for credentials everywhere, not only for SD JWT.

Sorry I wasn't clear. I was going for do we have any dependencies on Data Model 1.1 that we should abstract out already.

I don't think so, it can deal with any JSON value, so that wouldn't be an issue AFAIK.

eike-hass · 2024-01-16T15:14:40Z

Would there ever be an additional Proof in the credential? Is that something that we need to demonstrate?

abdulmth · 2024-01-17T10:49:49Z

Would there ever be an additional Proof in the credential? IS that something that need to demonstrate?

It's possible to add a proof property to a credential, but how is that relevant to SD JWT? We use JWT to validate the signature here so we don't need a proof property since it's not relevant to SD JWT 🤷🏻

eike-hass · 2024-01-17T18:45:06Z

Would there ever be an additional Proof in the credential? IS that something that need to demonstrate?

It's possible to add a proof property to a credential, but how is that relevant to SD JWT? We use JWT to validate the signature here so we don't need a proof property since it's not relevant to SD JWT 🤷🏻

That makes sense, thank you! Then I think there is nothing for us to demonstrate or additionally consider.

eike-hass

Looks good, awesone job 💪

abdulmth added 17 commits October 15, 2023 13:42

first encoder/decoder impl

7586ed8

implement poc validator

e1a3f3e

kb-jwt validator poc

b1ecf88

fix issuance date validation

0c24017

improve validator

a6c0938

improvements

ba1be31

improve example

95f4b60

tst

033792f

add tests

348484b

kb tests

37ea17f

fmt

67b0881

clippy

a6b0951

struct for key binding options

67d3dde

clippy

7dd781a

Merge branch 'main' into feat/poc-sd-jwt

344a0c3

fix example

14349c5

dprint fmt

aca2fff

abdulmth marked this pull request as ready for review December 12, 2023 00:07

abdulmth changed the title ~~[WIP] Support Selective Disclosure SD-JWT~~ Support Selective Disclosure SD-JWT Dec 12, 2023

fix license

6a5cc5a

abdulmth self-assigned this Dec 12, 2023

abdulmth added Added A new feature that requires a minor release. Part of "Added" section in changelog Rust Related to the core Rust code. Becomes part of the Rust changelog. labels Dec 12, 2023

abdulmth added this to the v1.1 milestone Dec 12, 2023

abdulmth requested a review from UMR1352 December 12, 2023 00:25

UMR1352 reviewed Dec 12, 2023

View reviewed changes

add wasm bindings

6459d98

UMR1352 approved these changes Jan 11, 2024

View reviewed changes

abdulmth added 2 commits January 11, 2024 22:12

decouple JwtValidator and SdJwtValidator

7800866

binding for validator

68622e7

abdulmth added 10 commits January 15, 2024 17:08

wasm bindings for validator

1106490

Merge branch 'main' into feat/poc-sd-jwt

d365a92

improvements

3bbb4f0

clippy

56e6bb7

fmt

4bf9990

skip serialization of none

8a215bc

improvements

6c30f93

api reference

7573000

fix wasm clippy issues

b2fe9d7

dprint

5b29f16

abdulmth commented Jan 15, 2024

View reviewed changes

make sd-jwt-payload optional

979c224

UMR1352 approved these changes Jan 16, 2024

View reviewed changes

abdulmth mentioned this pull request Jan 16, 2024

decouple JwtValidator from SdJwtValidator #1274

Closed

eike-hass self-requested a review January 16, 2024 13:08

eike-hass reviewed Jan 16, 2024

View reviewed changes

eike-hass added the Wasm Related to Wasm bindings. Becomes part of the Wasm changelog label Jan 16, 2024

abdulmth added 3 commits January 17, 2024 11:51

add example to CI, improvements

7cf7585

fmt

d28a27d

fix cypress test

ecddea3

eike-hass self-requested a review January 18, 2024 10:36

eike-hass approved these changes Jan 18, 2024

View reviewed changes

abdulmth merged commit c9512d2 into main Jan 18, 2024
12 checks passed

abdulmth deleted the feat/poc-sd-jwt branch January 18, 2024 10:39

eike-hass linked an issue Jan 26, 2024 that may be closed by this pull request

[Task] Implement SD-JWT #1270

Closed

8 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support Selective Disclosure SD-JWT #1268

Support Selective Disclosure SD-JWT #1268

abdulmth commented Nov 30, 2023 •

edited

Loading

UMR1352 Dec 12, 2023

UMR1352 Dec 12, 2023

abdulmth Dec 12, 2023

UMR1352 Dec 12, 2023

UMR1352 commented Jan 12, 2024

abdulmth Jan 15, 2024 •

edited

Loading

abdulmth commented Jan 15, 2024

UMR1352 left a comment

eike-hass left a comment •

edited

Loading

eike-hass Jan 16, 2024

eike-hass Jan 16, 2024

abdulmth Jan 17, 2024

eike-hass Jan 16, 2024

eike-hass Jan 16, 2024

abdulmth Jan 17, 2024

eike-hass Jan 17, 2024

abdulmth Jan 18, 2024

eike-hass commented Jan 16, 2024 •

edited

Loading

abdulmth commented Jan 17, 2024

eike-hass commented Jan 17, 2024 •

edited

Loading

eike-hass left a comment

	* using the standard [Selective Disclosure for JWTs (SD-JWT)](https://www.ietf.org/archive/id/draft-ietf-oauth-selective-disclosure-jwt-07.html).
	* using the [Selective Disclosure for JWTs (SD-JWT)](https://www.ietf.org/archive/id/draft-ietf-oauth-selective-disclosure-jwt-07.html) specification.

Support Selective Disclosure SD-JWT #1268

Support Selective Disclosure SD-JWT #1268

Conversation

abdulmth commented Nov 30, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

UMR1352 commented Jan 12, 2024

abdulmth Jan 15, 2024 • edited Loading

Choose a reason for hiding this comment

abdulmth commented Jan 15, 2024

UMR1352 left a comment

Choose a reason for hiding this comment

eike-hass left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

eike-hass commented Jan 16, 2024 • edited Loading

abdulmth commented Jan 17, 2024

eike-hass commented Jan 17, 2024 • edited Loading

eike-hass left a comment

Choose a reason for hiding this comment

abdulmth commented Nov 30, 2023 •

edited

Loading

abdulmth Jan 15, 2024 •

edited

Loading

eike-hass left a comment •

edited

Loading

eike-hass commented Jan 16, 2024 •

edited

Loading

eike-hass commented Jan 17, 2024 •

edited

Loading