Validate sd-jwt credentials vct schema

.gitignore

@@ -40,4 +40,6 @@ lerna-debug.log*
 !.vscode/extensions.json
 
 output/*.svg
-output/*.png
+output/*.png
+
+test/fixtures

package.json

@@ -11,6 +11,7 @@
 	"dependencies": {
 		"@auth0/mdl": "^2.0.1",
 		"@sd-jwt/core": "^0.10.0",
+		"@sd-jwt/sd-jwt-vc": "^0.10.0",
 		"ajv": "^8.17.1",
 		"asn1js": "^3.0.5",
 		"axios": "^1.7.9",

src/credential-verifiers/SDJWTVCVerifier.ts

@@ -1,12 +1,23 @@
+import axios from "axios"
 import { SDJwt } from "@sd-jwt/core";
+import { SDJwtVcInstance } from "@sd-jwt/sd-jwt-vc";
 import type { HasherAndAlg } from "@sd-jwt/types";
 import { Context, CredentialVerifier, PublicKeyResolverEngineI } from "../interfaces";
 import { CredentialVerificationError } from "../error";
-import { Result } from "../types";
+import { Result, Vct, VctUrls } from "../types";
 import { exportJWK, importJWK, importX509, JWK, jwtVerify, KeyLike } from "jose";
 import { fromBase64Url, toBase64Url } from "../utils/util";
 import { verifyCertificate } from "../utils/verifyCertificate";
 
+
+const VctUrls: VctUrls = {
+	'urn:eu.europa.ec.eudi:pid:1': 'https://demo-issuer.wwwallet.org/public/creds/pid/person-identification-data-arf-15-vctm-example-01.json',
+	'urn:eudi:pid:1': 'https://demo-issuer.wwwallet.org/public/creds/pid/person-identification-data-arf-18-vctm-example-01.json',
+	'urn:eudi:ehic:1': 'https://demo-issuer.wwwallet.org/public/creds/ehic/european-health-insurance-card-vctm-dc4eu-01.json',
+	'urn:eudi:pda1:1': 'https://demo-issuer.wwwallet.org/public/creds/pda1/portable-document-a1-vctm-dc4eu-01.json',
+	'urn:eu.europa.ec.eudi:por:1': 'https://demo-issuer.wwwallet.org/public/creds/por/power-of-representation-vctm-potential-01.json',
+};
+
 export function SDJWTVCVerifier(args: { context: Context, pkResolverEngine: PublicKeyResolverEngineI }): CredentialVerifier {
 	let errors: { error: CredentialVerificationError, message: string }[] = [];
 	const logError = (error: CredentialVerificationError, message: string): void => {
@@ -129,7 +140,6 @@ export function SDJWTVCVerifier(args: { context: Context, pkResolverEngine: Publ
 						error: CredentialVerificationError.CannotImportIssuerPublicKey,
 					}
 				}
-
 			}
 			if (parsedSdJwt && parsedSdJwt.payload && typeof parsedSdJwt.payload.iss === 'string' && typeof alg === 'string') {
 				const publicKeyResolutionResult = await args.pkResolverEngine.resolve({ identifier: parsedSdJwt.payload.iss });
@@ -198,6 +208,33 @@ export function SDJWTVCVerifier(args: { context: Context, pkResolverEngine: Publ
 		}
 	}
 
+	const verifyCredentialVct = async (rawCredential: string): Promise<Result<{}, CredentialVerificationError>> => {
+		const SdJwtVc = new SDJwtVcInstance({
+			verifier: () => true,
+		  hasher: hasherAndAlgorithm.hasher,
+		  hashAlg: hasherAndAlgorithm.alg as 'sha-256',
+		  loadTypeMetadataFormat: true,
+			vctFetcher: (urn) => {
+				const url = VctUrls[urn as Vct]
+				return axios.get(url).then(({ data }) => data)
+			}
+		});
+
+		const verified = await SdJwtVc.verify(rawCredential);
+
+		if (!verified.payload) {
+			return {
+				success: false,
+				error: CredentialVerificationError.VctSchemaError,
+			}
+		}
+
+		return {
+			success: true,
+			value: {},
+		}
+	}
+
 	const verifyKbJwt = async (rawPresentation: string, opts: {
 		expectedNonce?: string;
 		expectedAudience?: string;
@@ -289,6 +326,15 @@ export function SDJWTVCVerifier(args: { context: Context, pkResolverEngine: Publ
 				}
 			}
 
+			// Credential vct validation
+			const credentialVctVerificationResult = await verifyCredentialVct(rawCredential);
+			if (!credentialVctVerificationResult.success) {
+				return {
+					success: false,
+					error: errors.length > 0 ?  errors[0].error : CredentialVerificationError.UnknownProblem,
+				}
+			}
+
 			// KB-JWT validation
 			if (!rawCredential.endsWith('~')) { // contains kbjwt
 				const verifyKbJwtResult = await verifyKbJwt(rawCredential, opts);

src/error.ts

@@ -34,6 +34,7 @@ export enum CredentialVerificationError {
 	CannotResolveIssuerPublicKey = "CannotResolveIssuerPublicKey",
 	CannotImportIssuerPublicKey = "CannotImportIssuerPublicKey",
 	NotTrustedIssuer = "NotTrustedIssuer",
+	VctSchemaError = "VctSchemaError",
 
 	ExpiredCredential = "ExpiredCredential",
 

src/types.ts

@@ -42,3 +42,9 @@ export type ParsedCredential = {
 	}
 	signedClaims: CredentialClaims,
 };
+
+export type Vct = 'urn:eu.europa.ec.eudi:pid:1' | 'urn:eudi:pid:1' | 'urn:eudi:ehic:1' | 'urn:eudi:pda1:1' | 'urn:eu.europa.ec.eudi:por:1';
+
+export type VctUrls = {
+  [k in Vct]: string
+};

test/fixtures.ts

@@ -0,0 +1,147 @@
+import fs from 'node:fs'
+import Crypto from 'node:crypto'
+import { exec } from 'child_process'
+import { SignJWT } from 'jose'
+
+function generateCertificate () {
+	return new Promise(resolve => {
+		exec('openssl ecparam -name prime256v1 -genkey -noout -out ./test/fixtures/cert.key', () => {
+			exec('openssl req -new -x509 -key ./test/fixtures/cert.key -out ./test/fixtures/cert.pem -days 3650 -subj /CN=test/C=FR/ST=test/L=test/O=test', () => {
+        return resolve('ok');
+			});
+		});
+	});
+}
+
+const vctClaims =  {
+	"urn:eu.europa.ec.eudi:pid:1": {
+		"expiry_date": "2035-04-21",
+		"birth_place": "US",
+		"birth_date": "1990-10-15",
+		"issuance_date": "2025-03-04",
+		"document_number": "12313213",
+		"nationality": ["US"],
+		"email_address": "john@sample.com",
+		"age_over_18": false,
+		"mobile_phone_number": "+308388338382",
+		"resident_address": "23, Random str. 34793 Apt 3 USA",
+		"given_name_birth": "John",
+		"given_name": "John",
+		"family_name": "Doe",
+		"issuing_authority": "PID:00001",
+		"issuing_country": "GR",
+		"sex": 1,
+	},
+  "urn:eudi:pid:1": {
+    "family_name": "test",
+    "given_name": "test",
+    "birthdate": "1923-12-25",
+    "place_of_birth": {
+      "locality": "test",
+      "region": "test",
+      "country": "GR",
+    },
+    "nationalities": ["GR"],
+    "personal_administrative_number": "test",
+    "birth_given_name": "test",
+    "sex": 0,
+    "email": "test@test.test",
+    "date_of_expiry": "1925-01-17",
+    "issuing_authority": "test",
+    "issuing_country": "GR",
+  },
+  "urn:eudi:ehic:1": {
+    "personal_administrative_number": "test",
+    "issuing_authority": {
+      "id": "test",
+      "name": "test",
+    },
+    "issuing_country": "GR",
+    "date_of_expiry": "1925-01-17",
+    "document_number": "test",
+  },
+  "urn:eudi:pda1:1": {
+    "personal_administrative_number": "test",
+    "employer": "test",
+    "work_address": {
+      "formatted": "",
+      "street_address": "",
+    },
+    "legislation_country": "GR",
+    "issuing_authority": {
+      "id": "test",
+      "name": "test",
+    },
+    "issuing_country": "GR",
+    "date_of_expiry": "1925-01-17",
+    "date_of_issuance": "1925-01-17",
+    "document_number": "test",
+  },
+  "urn:eu.europa.ec.eudi:por:1": {
+    "legal_person_identifier": "test",
+  }
+};
+
+export function sdJwtFixture (vct: string = 'urn:eu.europa.ec.eudi:pid:1') {
+	const claims = vctClaims[vct];
+
+	return new Promise(async resolve => {
+		await generateCertificate();
+		const certPem = fs.readFileSync('./test/fixtures/cert.pem').toString('utf8');
+		const privateKeyPem = fs.readFileSync('./test/fixtures/cert.key').toString('utf8');
+
+		const cert = Crypto.createPublicKey(certPem);
+		const privateKey = Crypto.createPrivateKey(privateKeyPem);
+		const x5c = [
+			certPem
+			.replace('-----BEGIN CERTIFICATE-----\n', '')
+			.replace('\n-----END CERTIFICATE-----\n', '')
+		];
+
+		const header = {
+			"typ": "vc+sd-jwt",
+			"vctm": [
+				"eyJ2Y3QiOiJ1cm46ZXUuZXVyb3BhLmVjLmV1ZGk6cGlkOjEiLCJuYW1lIjoiVmVyaWZpYWJsZSBJRCIsImRlc2NyaXB0aW9uIjoiVGhpcyBpcyBhIFZlcmlmaWFibGUgSUQgZG9jdW1lbnQgaXNzdWVkIGJ5IHRoZSB3ZWxsIGtub3duIFZJRCBJc3N1ZXIiLCJkaXNwbGF5IjpbeyJsYW5nIjoiZW4tVVMiLCJuYW1lIjoiVmVyaWZpYWJsZSBJRCIsInJlbmRlcmluZyI6eyJzaW1wbGUiOnsibG9nbyI6eyJ1cmkiOiJodHRwOi8vd2FsbGV0LWVudGVycHJpc2UtaXNzdWVyOjgwMDMvaW1hZ2VzL2xvZ28ucG5nIiwidXJpI2ludGVncml0eSI6InNoYTI1Ni1hY2RhMzQwNGMyY2Y0NmRhMTkyY2YyNDVjY2M2YjkxZWRjZTg4NjkxMjJmYTVhNjYzNjI4NGYxYTYwZmZjZDg2IiwiYWx0X3RleHQiOiJWSUQgTG9nbyJ9LCJiYWNrZ3JvdW5kX2NvbG9yIjoiIzRjYzNkZCIsInRleHRfY29sb3IiOiIjRkZGRkZGIn0sInN2Z190ZW1wbGF0ZXMiOlt7InVyaSI6Imh0dHA6Ly93YWxsZXQtZW50ZXJwcmlzZS1pc3N1ZXI6ODAwMy9pbWFnZXMvdGVtcGxhdGUtcGlkLnN2ZyJ9XX19XSwiY2xhaW1zIjpbeyJwYXRoIjpbImdpdmVuX25hbWUiXSwiZGlzcGxheSI6W3sibGFuZyI6ImVuLVVTIiwibGFiZWwiOiJHaXZlbiBOYW1lIiwiZGVzY3JpcHRpb24iOiJUaGUgZ2l2ZW4gbmFtZSBvZiB0aGUgVklEIGhvbGRlciJ9XSwic3ZnX2lkIjoiZ2l2ZW5fbmFtZSJ9LHsicGF0aCI6WyJmYW1pbHlfbmFtZSJdLCJkaXNwbGF5IjpbeyJsYW5nIjoiZW4tVVMiLCJsYWJlbCI6IkZhbWlseSBOYW1lIiwiZGVzY3JpcHRpb24iOiJUaGUgZmFtaWx5IG5hbWUgb2YgdGhlIFZJRCBob2xkZXIifV0sInN2Z19pZCI6ImZhbWlseV9uYW1lIn0seyJwYXRoIjpbImJpcnRoX2RhdGUiXSwiZGlzcGxheSI6W3sibGFuZyI6ImVuLVVTIiwibGFiZWwiOiJCaXJ0aCBkYXRlIiwiZGVzY3JpcHRpb24iOiJUaGUgYmlydGggZGF0ZSBvZiB0aGUgVklEIGhvbGRlciJ9XSwic3ZnX2lkIjoiYmlydGhfZGF0ZSJ9LHsicGF0aCI6WyJpc3N1aW5nX2F1dGhvcml0eSJdLCJkaXNwbGF5IjpbeyJsYW5nIjoiZW4tVVMiLCJsYWJlbCI6Iklzc3VpbmcgYXV0aG9yaXR5IiwiZGVzY3JpcHRpb24iOiJUaGUgaXNzdWluZyBhdXRob3JpdHkgb2YgdGhlIFZJRCBjcmVkZW50aWFsIn1dLCJzdmdfaWQiOiJpc3N1aW5nX2F1dGhvcml0eSJ9LHsicGF0aCI6WyJpc3N1YW5jZV9kYXRlIl0sImRpc3BsYXkiOlt7ImxhbmciOiJlbi1VUyIsImxhYmVsIjoiSXNzdWFuY2UgZGF0ZSIsImRlc2NyaXB0aW9uIjoiVGhlIGRhdGUgdGhhdCB0aGUgY3JlZGVudGlhbCB3YXMgaXNzdWVkIn1dLCJzdmdfaWQiOiJpc3N1YW5jZV9kYXRlIn0seyJwYXRoIjpbImV4cGlyeV9kYXRlIl0sImRpc3BsYXkiOlt7ImxhbmciOiJlbi1VUyIsImxhYmVsIjoiSXNzdWFuY2UgZGF0ZSIsImRlc2NyaXB0aW9uIjoiVGhlIGRhdGUgdGhhdCB0aGUgY3JlZGVudGlhbCB3aWxsIGV4cGlyZSJ9XSwic3ZnX2lkIjoiZXhwaXJ5X2RhdGUifV19"
+			],
+			"x5c": [
+				x5c
+			],
+			"alg": "ES256"
+		};
+
+
+		const disclosures = Object.keys(claims).map(key => {
+			const salt = (Math.random() + 1).toString(36)
+			const rawDisclosure = [salt, key, claims[key]]
+			const disclosure = Buffer.from(JSON.stringify(rawDisclosure)).toString('base64url')
+
+			const hash = Crypto.createHash('sha256')
+			const _sd = hash.update(disclosure).digest('base64url')
+
+
+			return { _sd, disclosure, rawDisclosure }
+		});
+
+		const body = {
+			"cnf": {
+				"jwk": cert.export({ format: 'jwk' })
+			},
+			"vct": vct,
+			"jti": "urn:vid:95611a1e-73cf-4fa7-8a27-f14c8251a54e",
+			"iat": 1741106975,
+			"exp": 1772642975,
+			"iss": "http://wallet-enterprise-issuer:8003",
+			"sub": "XqrJ53-wjsBZ3ARisBruvdpFOjvtRXlLg3fQbnfb_mU",
+			"_sd_alg": "sha-256",
+			"_sd": disclosures.map(({ _sd }) => _sd)
+		}
+
+
+    const jwt = await new SignJWT(body)
+      .setProtectedHeader(header)
+      .sign(privateKey);
+		const sdJwt = jwt + '~' + disclosures.map(({ disclosure }) => disclosure).join('~') + '~';
+
+		return resolve({ sdJwt, privateKey, cert, certPem });
+	});
+}

yarn.lock

@@ -421,7 +421,7 @@
   resolved "https://registry.yarnpkg.com/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.32.0.tgz#1a40b4792c08094b6479c48c90fe7f4b10ec2f54"
   integrity sha512-5hqO5S3PTEO2E5VjCePxv40gIgyS2KvO7E7/vvC/NbIW4SIRamkMr1hqj+5Y67fbBWv/bQLB6KelBQmXlyCjWA==
 
-"@sd-jwt/core@^0.10.0":
+"@sd-jwt/core@0.10.0", "@sd-jwt/core@^0.10.0":
   version "0.10.0"
   resolved "https://registry.yarnpkg.com/@sd-jwt/core/-/core-0.10.0.tgz#74a1b6e017423266d94302f907c4d3f2792b3b64"
   integrity sha512-EuFsIHP76fwNi97dGcz2jdEenHL/AkDGcqrEA00k82Uw0HP/hvbAfB+yyPxYrd3dVaxe5PWSKvDkgDK6kKk+6Q==
@@ -439,6 +439,15 @@
     "@sd-jwt/types" "0.10.0"
     "@sd-jwt/utils" "0.10.0"
 
+"@sd-jwt/jwt-status-list@0.10.0":
+  version "0.10.0"
+  resolved "https://registry.yarnpkg.com/@sd-jwt/jwt-status-list/-/jwt-status-list-0.10.0.tgz#68743a65481b863df64da10246e2e7c42fd691bd"
+  integrity sha512-TVLLQ7qjZKKEXODXUAxoWvJmnH3bSNXsttp0hxVP/qv42Rk7OFKIjepkzy6lh+RQRWw3NK/rHiz95/Fz1m4xBQ==
+  dependencies:
+    "@sd-jwt/types" "0.10.0"
+    base64url "^3.0.1"
+    pako "^2.1.0"
+
 "@sd-jwt/present@0.10.0":
   version "0.10.0"
   resolved "https://registry.yarnpkg.com/@sd-jwt/present/-/present-0.10.0.tgz#a4f12c1d0f5172be4a007fba447561033f20a5a5"
@@ -448,6 +457,17 @@
     "@sd-jwt/types" "0.10.0"
     "@sd-jwt/utils" "0.10.0"
 
+"@sd-jwt/sd-jwt-vc@^0.10.0":
+  version "0.10.0"
+  resolved "https://registry.yarnpkg.com/@sd-jwt/sd-jwt-vc/-/sd-jwt-vc-0.10.0.tgz#d8c31ca412c78ee9a0af776d2bd8c9ef6c1778c1"
+  integrity sha512-418TX436dBK7FnwsLJXUXnTQByZQOonCuJ4vKyrOJ27mZXxkiFiLSaUojqoFerSw5u29nwrcRRJzd1NLdLWqkQ==
+  dependencies:
+    "@sd-jwt/core" "0.10.0"
+    "@sd-jwt/jwt-status-list" "0.10.0"
+    "@sd-jwt/utils" "0.10.0"
+    ajv "^8.17.1"
+    ajv-formats "^3.0.1"
+
 "@sd-jwt/types@0.10.0", "@sd-jwt/types@^0.10.0":
   version "0.10.0"
   resolved "https://registry.yarnpkg.com/@sd-jwt/types/-/types-0.10.0.tgz#427e60a8a09b194e99c0a0497546bd39a3eb79bd"
@@ -537,7 +557,14 @@
     loupe "^3.1.2"
     tinyrainbow "^1.2.0"
 
-ajv@^8.17.1:
+ajv-formats@^3.0.1:
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/ajv-formats/-/ajv-formats-3.0.1.tgz#3d5dc762bca17679c3c2ea7e90ad6b7532309578"
+  integrity sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ==
+  dependencies:
+    ajv "^8.0.0"
+
+ajv@^8.0.0, ajv@^8.17.1:
   version "8.17.1"
   resolved "https://registry.yarnpkg.com/ajv/-/ajv-8.17.1.tgz#37d9a5c776af6bc92d7f4f9510eba4c0a60d11a6"
   integrity sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==
@@ -580,6 +607,11 @@ base64-js@^1.3.1:
   resolved "https://registry.yarnpkg.com/base64-js/-/base64-js-1.5.1.tgz#1b1b440160a5bf7ad40b650f095963481903930a"
   integrity sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==
 
+base64url@^3.0.1:
+  version "3.0.1"
+  resolved "https://registry.yarnpkg.com/base64url/-/base64url-3.0.1.tgz#6399d572e2bc3f90a9a8b22d5dbb0a32d33f788d"
+  integrity sha512-ir1UPr3dkwexU7FdV8qBBbNDRUhMmIekYMFZfi+C/sLNnRESKPl23nB9b2pltqfOQNnGzsDdId90AEtG5tCx4A==
+
 buffer@^6.0.3:
   version "6.0.3"
   resolved "https://registry.yarnpkg.com/buffer/-/buffer-6.0.3.tgz#2ace578459cc8fbe2a70aaa8f52ee63b6a74c6c6"
@@ -825,6 +857,11 @@ node-gyp-build-optional-packages@5.1.1:
   dependencies:
     detect-libc "^2.0.1"
 
+pako@^2.1.0:
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/pako/-/pako-2.1.0.tgz#266cc37f98c7d883545d11335c00fbd4062c9a86"
+  integrity sha512-w+eufiZ1WuJYgPXbV/PO3NCMEc3xqylkKHzp8bxp1uW4qaSNQUkwmLLEc3kKsfz8lpV1F8Ht3U1Cm+9Srog2ug==
+
 pathe@^1.1.2:
   version "1.1.2"
   resolved "https://registry.yarnpkg.com/pathe/-/pathe-1.1.2.tgz#6c4cb47a945692e48a1ddd6e4094d170516437ec"