Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RSA Proof wrong canonicalization #174

Open
fabrii opened this issue Jun 27, 2023 · 0 comments
Open

RSA Proof wrong canonicalization #174

fabrii opened this issue Jun 27, 2023 · 0 comments

Comments

@fabrii
Copy link

fabrii commented Jun 27, 2023

RsaSignature2018 is broken in VC context v1. More info in: w3c/vc-data-model#778

For that reason, in vc.js the canonicalization of a RsaSignature2018 proof is not being expanded. The result of the library is like this:

_:c14n0 <http://purl.org/dc/terms/created> "2023-06-03T20:00:01Z"^^<xsd:dateTime> .
_:c14n0 <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://w3id.org/security#RsaSignature2018> .
_:c14n0 <sec:proofPurpose> <https://w3id.org/security#assertionMethod> .
_:c14n0 <sec:verificationMethod> <urn:oid:2.16.858.0.0.0.3.0#1> .

when it should be like this:

_:c14n0 <http://purl.org/dc/terms/created> "2023-06-03T20:00:01Z"^^<http://www.w3.org/2001/XMLSchema#dateTime> .
_:c14n0 <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://w3id.org/security#RsaSignature2018> .
_:c14n0 <https://w3id.org/security#proofPurpose> <https://w3id.org/security#assertionMethod> .
_:c14n0 <https://w3id.org/security#verificationMethod> <urn:oid:2.16.858.0.0.0.3.0#1> .

After some discussion in w3c/vc-data-model#1151, seems that the correct solution to preserve interoperability with another implementations, is to expand the items as they should be.
For that, I am proposing a specific fix that can be done at LinkedDataSignature or JwsLinkedDataSignature.

I picture something like, if "RsaSignature2018" then apply a fix to expand correctly during canonicalization. Might be done in the createVerifyData method. At JwsLinkedDataSignature level, will be less "intrusive", and we could override that specific method.

Reproducer: https://github.com/fabrii/dc-playground

Thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant