Skip to content
This repository has been archived by the owner on Apr 29, 2024. It is now read-only.

Commit

Permalink
Use Respec
Browse files Browse the repository at this point in the history
  • Loading branch information
@clehner
clehner committed Apr 8, 2022
1 parent 5bb7c64 commit 26486f9
Showing 1 changed file with 101 additions and 46 deletions.
147 changes: 101 additions & 46 deletions index.html
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,34 +4,102 @@
<title>CACAO-ZCAP</title>
<meta charset=utf-8>
<style>
section:target {
outline: .5ex solid #ff9;
}
.mapping-table td:nth-child(2) {
text-align: center;
}
</style>
<script defer class="remove" src="https://www.w3.org/Tools/respec/respec-w3c"></script>
<script class="remove">
// https://respec.org/docs/
const respecConfig = {
shortName: "cacao-zcap",
specStatus: "unofficial",
edDraftURI: "https://demo.didkit.dev/2022/cacao-zcap/",
editors: [
{
name: "Charles E. Lehner", url: "https://www.w3.org/wiki/User:Cel",
company: "Spruce", companyURL: "https://spruceid.com/",
w3cid: 124982
}
],
subtitle: "Chain-Agnostic CApability Objects (CACAOs) as Authorization Capabilities (zCaps)",
group: "credentials",
wgPublicList: "public-credentials",
github: {
repoURL: "spruceid/cacao-zcap",
branch: "main"
},
localBiblio: {
"MULTIBASE": {
title: "The Multibase Encoding Scheme",
date: "February 2022",
href: "https://datatracker.ietf.org/doc/html/draft-multiformats-multibase-05",
authors: ["Juan Benet", "Manu Sporny"],
status: "Internet-Draft",
publisher: "IETF"
},
"SECURITY-VOCABULARY": {
title: "Security Linked Data Vocabulary",
href: "https://w3id.org/security",
authors: ["Manu Sporny", "David Longley"],
status: "CGDRAFT",
publisher: "Web Payments Community Group",
},
"DATA-INTEGRITY": {
title: "Data Integrity",
href: "https://w3c-ccg.github.io/data-integrity-spec/",
authors: ["David Longley", "Manu Sporny"],
status: "CGDRAFT",
publisher: "Credentials Community Group",
},
"ZCAP": {
title: "Authorization Capabilities for Linked Data v0.3",
href: "https://w3c-ccg.github.io/zcap-spec/",
status: "CGDRAFT",
authors: ["Christopher Lemmer Webber", "Manu Sporny", "Mark S. Miller"],
publisher: "Credentials Community Group"
},
"CACAO": {
title: "CACAO: Chain Agnostic CApability Object",
href: "https://github.com/ChainAgnostic/CAIPs/blob/91aaaff73038c2629ff11b88c2209f61521d8ece/CAIPs/caip-74.md",
authors: ["Sergey Ukustov"],
publisher: "CASA",
date: "March 2022"
},
"DAG-CBOR": {
title: "DAG-CBOR: CBOR IPLD format",
href: "https://ipld.io/specs/codecs/dag-cbor/spec/",
authors: ["Rod Vagg", "Volker Mische", "Mikeal Rogers"],
status: "Descriptive - Draft",
publisher: "IPLD",
date: "August 2019"
},
"DID-PKH": {
title: "The did:pkh Method",
href: "https://github.com/w3c-ccg/did-pkh/blob/ea93b0a5e0e8b54e572f3a6ca5a294f147901d2d/did-pkh-method-draft.md",
authors: ["Wayne Chang", "Charles Lehner", "Juan Caballero", "Joel Thorstensson"],
status: "W3C Community Group Draft",
publisher: "W3C Credentials Community Group",
date: "February 2022"
}
}
};
</script>
</head>
<body>
<h1>CACAO-ZCAP</h1>
<h2>Integration of CACAO with ZCAP</h2>
<p>This document: <a href="https://demo.didkit.dev/2022/cacao-zcap/">https://demo.didkit.dev/2022/cacao-zcap/</a></p>
<p>Source: <a href="https://github.com/spruceid/cacao-zcap">https://github.com/spruceid/cacao-zcap</a></p>
<p>This document is licensed under a <a ref="license" href="https://creativecommons.org/licenses/by/4.0/">Creative Commons Attribution 4.0 International License</a>.

<section id="abstract">
<h2><a href="#abstract">Abstract</a></h2>
</section>

<section id="sotd">
<h2><a href="#sotd">Status of This Document</a></h2>
<p>This document is an experimental draft specification.</p>
</section>

<section id="conformance">
</section>

<section id="context">
<h2><a href="#context">Context</a></h2>
<h2>Context</h2>
<p><a href="https://www.w3.org/TR/json-ld11/#dfn-context">JSON-LD Context</a> file: <a href="https://demo.didkit.dev/2022/cacao-zcap/context/v1.json">https://demo.didkit.dev/2022/cacao-zcap/context/v1.json</a></p>
<p>This context file is expected to be used in <code>@context</code> following the Security Vocabulary context (<a href="https://w3id.org/security/v2">https://w3id.org/security/v2</a>). i.e.:</p>
<p>This context file is expected to be used in <code>@context</code> following the [[SECURITY-VOCABULARY]] context (<a href="https://w3id.org/security/v2">https://w3id.org/security/v2</a>). i.e.:</p>
<pre>
{
"@context": [
Expand All @@ -44,7 +112,7 @@ <h2><a href="#context">Context</a></h2>
</section>

<section id="cacao-zcap-mapping">
<h2><a href="#cacao-zcap-mapping">CACAO-ZCAP Mapping</a></h2>
<h2>CACAO-ZCAP Mapping</h2>
<table class="mapping-table">
<thead>
<tr>
Expand Down Expand Up @@ -206,52 +274,50 @@ <h2><a href="#cacao-zcap-mapping">CACAO-ZCAP Mapping</a></h2>
</table>

<section id="id-cid-uuid-mapping">
<h3><a href="#id-cid-uuid-mapping">id CID UUID mapping</a></h3>
<p>The CACAO is serialized using
<a href="https://ipld.io/specs/codecs/dag-cbor/">DAG-CBOR</a>.
<h3>id CID UUID mapping</h3>
<p>The CACAO is serialized using [[DAG-CBOR]].
A SHA-256 hash is computed over this serialization.
The last 16 bytes of the hash (dropping the initial 16)
is used as "pseudo-random" input to a
<a href="https://datatracker.ietf.org/doc/html/rfc4122#section-4.4">RFC 4122 v4 UUID</a>.
is used as "pseudo-random" input to a [[RFC4122]] v4 UUID.
This UUID is represented as a URN by prefixing it with "urn:uuid:".
This URN is used as the id of the delegation object.</p>
</section>

<section id="iss-vm-mapping">
<h3><a href="#iss-vm-mapping">issuer-verificationMethod mapping</a></h3>
<p>The CACAO payload issuer property (<code>p.iss</code>) is defined by the <a href="https://github.com/ChainAgnostic/CAIPs/blob/8fdb5bfd1bdf15c9daf8aacfbcc423533764dfe9/CAIPs/caip-draft_cacao.md#container-format">CACAO CAIP</a> to be a <a href="https://github.com/w3c-ccg/did-pkh/blob/ea93b0a5e0e8b54e572f3a6ca5a294f147901d2d/did-pkh-method-draft.md">did:pkh</a> DID. The proof <a href="https://www.w3.org/TR/did-core/#dfn-verificationmethod"><code>verificationMethod</code></a> property is expected to be a <a href="https://www.w3.org/TR/did-core/#did-url-syntax">DID URL</a> resolving to a <a href="https://w3c-ccg.github.io/data-integrity-spec/#verification-methods">verification method</a>.
<h3>issuer-verificationMethod mapping</h3>
<p>The CACAO payload issuer property (<code>p.iss</code>) is defined by [[CACAO]] to be a [[DID-PKH]] DID. The proof <a href="https://www.w3.org/TR/did-core/#dfn-verificationmethod"><code>verificationMethod</code></a> property is expected to be a <a href="https://www.w3.org/TR/did-core/#did-url-syntax">DID URL</a> resolving to a <a href="https://w3c-ccg.github.io/data-integrity-spec/#verification-methods">verification method</a>.
CACAO-ZCAP converts between these two fields by assuming that the issuer DID has a <em>default verification method</em>, that the CACAO signature is created using the <a href="https://w3c-ccg.github.io/data-integrity-spec/#verification-material">verification material</a> of that <em>default verification method</em>, and that the <em>default verification method</em> allows creating a proof of type <a href="#CacaoZcapProof2022">CacaoZcapProof2022</a>.</p>
</section>

<section id="root-zcap-mapping">
<h3><a href="#root-zcap-mapping">Root ZCAP mapping</a></h3>
<h3>Root ZCAP mapping</h3>
<p>The first value of the CACAO payload resources array is used as the invocation target URI, that is the value of the zcap delegation's <code>invocationTarget</code> property. The invocation target URI is encoded into a root zcap URN to become the root capability id. The root zcap URN is constructed as the concatenation of <code>"urn:zcap:root:"</code> with <code>encodeURIComponent(invocationTarget)</code>. To transform the root zcap URN to the invocation target URI, the prefix <code>"urn:zcap:root:"</code> is removed and the remaining value is URL-decoded to return the invocation target id.</p>
</section>

<section id="intermediate-zcap-mapping">
<h3><a href="#intermediate-zcap-mapping">Intermediate ZCAP mapping</a></h3>
<h3>Intermediate ZCAP mapping</h3>
<p>If the proof <code>capabilityChain</code> array / CACAO resources array (<code>p.resources</code>) contain more than two elements,
the intermediate elements are passed through as URIs.</p>
</section>

<section id="previous-zcap-mapping">
<h3><a href="#previous-zcap-mapping">Previous ZCAP mapping</a></h3>
<p>The last value of the proof <code>capabilityChain</code> array / CACAO resources array (<code>p.resources</code>) represents the previous delegation. If the previous delegation is the root delegation, the <code>capabilityChain</code> array contains only the root delegation id, as a single value. If the previous delegation is a non-root delegation, the last value of the proof <code>capabilityChain</code> array is the previous delegation embedded as an object. The embedded previous delegation is represented in the last value of the CACAO resources array (<code>p.resources</code>) as a <a href="https://datatracker.ietf.org/doc/html/rfc2397">Data URI</a> containing the Base64-encoded JSON object serialized with <a href="https://www.rfc-editor.org/rfc/rfc8785">JSON Canonicalization Scheme (JCS)</a>.</p>
<h3>Previous ZCAP mapping</h3>
<p>The last value of the proof <code>capabilityChain</code> array / CACAO resources array (<code>p.resources</code>) represents the previous delegation. If the previous delegation is the root delegation, the <code>capabilityChain</code> array contains only the root delegation id, as a single value. If the previous delegation is a non-root delegation, the last value of the proof <code>capabilityChain</code> array is the previous delegation embedded as an object. The embedded previous delegation is represented in the last value of the CACAO resources array (<code>p.resources</code>) as a [[RFC2397]] Data URI containing the Base64-encoded JSON object serialized with [[RFC8785]] JSON Canonicalization Scheme (JCS).</p>
</section>

<section id="signature-proof-value-mapping">
<h3><a href="#signature-proof-value-mapping">signature-proofValue mapping</a></h3>
<p>In CACAO, the signature is represented with an <a href="https://ipld.io/docs/schemas/features/typekinds/">IPLD</a> <em>bytes</em> type. In ZCAP and data integrity proofs, the signature is typically represented in a string in the <a href="https://w3c-ccg.github.io/data-integrity-spec/#dfn-proofvalue">proofValue</a> property of the proof object. CACAO-ZCAP encodes the signature in the proofValue property using <a href="https://datatracker.ietf.org/doc/html/draft-multiformats-multibase">multibase</a>.</p>
<h3>signature-proofValue mapping</h3>
<p>In CACAO, the signature is represented with an <a href="https://ipld.io/docs/schemas/features/typekinds/">IPLD</a> <em>bytes</em> type. In ZCAP and data integrity proofs, the signature is typically represented in a string in the <a href="https://w3c-ccg.github.io/data-integrity-spec/#dfn-proofvalue">proofValue</a> property of the proof object. CACAO-ZCAP encodes the signature in the proofValue property using [[MULTIBASE]].</p>
</section>

</section>

<section id="terms">
<h2><a href="#terms">Terms</a></h2>
<h2>Terms</h2>
<p>This document defines the following terms, in the namespace <code>https://demo.didkit.dev/2022/cacao-zcap/#</code>.</p>

<section id="CacaoZcap2022">
<h3><a href="#CacaoZcap2022">CacaoZcap2022</a></h3>
<h3>CacaoZcap2022</h3>
<p>A CACAO interpreted as an authorization capability delegation.</p>
<p>The <code>proof</code> property should be an object of type <a href="#CacaoZcapProof2022">CacaoZcapProof2022</a>. The <code>invocationTarget</code> property should be the URL to which an entity is being authorized access.</p>
<dl>
Expand All @@ -271,7 +337,7 @@ <h3><a href="#CacaoZcap2022">CacaoZcap2022</a></h3>
</section>

<section id="CacaoZcapProof2022">
<h3><a href="#CacaoZcapProof2022">CacaoZcapProof2022</a></h3>
<h3>CacaoZcapProof2022</h3>
<p>A <a href="https://w3c-ccg.github.io/data-integrity-spec/#proofs">data integrity proof</a> over an authorization capability delegation document (<a href="#CacaoZcap2022">CacaoZcap2022</a>), together representing a CACAO.</p>
<dl>
<dt><a href="https://www.w3.org/2003/06/sw-vocab-status/note.html#vocab">Status</a></dt>
Expand All @@ -293,7 +359,7 @@ <h3><a href="#CacaoZcapProof2022">CacaoZcapProof2022</a></h3>
</section>

<section id="cacaoPayloadType">
<h3><a href="#cacaoPayloadType">cacaoPayloadType</a></h3>
<h3>cacaoPayloadType</h3>
<p>CACAO payload format type (CACAO header "t" value). e.g. "eip4361".</p>
<dl>
<dt><a href="https://www.w3.org/2003/06/sw-vocab-status/note.html#vocab">Status</a></dt>
Expand All @@ -304,7 +370,7 @@ <h3><a href="#cacaoPayloadType">cacaoPayloadType</a></h3>
</section>

<section id="cacaoSignatureType">
<h3><a href="#cacaoSignatureType">cacaoSignatureType</a></h3>
<h3>cacaoSignatureType</h3>
<p>CACAO signature type (CACAO signature "t" value). e.g. "eip191" or "eip1271".</p>
<dl>
<dt><a href="https://www.w3.org/2003/06/sw-vocab-status/note.html#vocab">Status</a></dt>
Expand All @@ -315,7 +381,7 @@ <h3><a href="#cacaoSignatureType">cacaoSignatureType</a></h3>
</section>

<section id="cacaoStatement">
<h3><a href="#cacaoStatement">cacaoStatement</a></h3>
<h3>cacaoStatement</h3>
<p>CACAO statement (CACAO payload "statement" value).</p>
<dl>
<dt><a href="https://www.w3.org/2003/06/sw-vocab-status/note.html#vocab">Status</a></dt>
Expand All @@ -326,7 +392,7 @@ <h3><a href="#cacaoStatement">cacaoStatement</a></h3>
</section>

<section id="cacaoRequestId">
<h3><a href="#cacaoRequestId">cacaoRequestId</a></h3>
<h3>cacaoRequestId</h3>
<p>CACAO request ID (CACAO payload "requestId" value).</p>
<dl>
<dt><a href="https://www.w3.org/2003/06/sw-vocab-status/note.html#vocab">Status</a></dt>
Expand All @@ -338,16 +404,5 @@ <h3><a href="#cacaoRequestId">cacaoRequestId</a></h3>

</section>

<section id="references">
<h2><a href="#references">References</a></h2>
<ul>
<li><a href="https://github.com/ChainAgnostic/CAIPs/blob/8fdb5bfd1bdf15c9daf8aacfbcc423533764dfe9/CAIPs/caip-draft_cacao.md">CACAO: Chain Agnostic CApability Object</a></li>
<li><a href="https://w3c-ccg.github.io/zcap-spec/">Authorization Capabilities for Linked Data v0.3</a> (<a href="https://github.com/w3c-ccg/zcap-spec/blob/79244f3dab64e6486cb2212705f7f104bd7288a8/index.html">79244f3dab</a>)</li>
<li><a href="https://w3c-ccg.github.io/data-integrity-spec/">Data Integrity 1.0</a> (<a href="https://github.com/w3c-ccg/data-integrity-spec/blob/22263882b1cab0aee153fe3a0a3684da36dde36f/index.html">22263882b1</a>)</li>
<li><a href="https://w3c-ccg.github.io/security-vocab/">The Security Vocabulary</a> (<a href="https://github.com/w3c-ccg/security-vocab/blob/8152248f69a030ca3ca9ee5a66b8df70f42fece5/index.html">8152248f69</a>)</li>
<li><a href="https://datatracker.ietf.org/doc/html/draft-multiformats-multibase">The Multibase Data Format</a></li>
</ul>
</section>

</body>
</html>

0 comments on commit 26486f9

Please sign in to comment.