Fix Encoding-Decoding

a-sit-plus · Dec 7, 2023 · 8c57d91 · 8c57d91
1 parent 71256ae
commit 8c57d91
Show file tree

Hide file tree

Showing 14 changed files with 246 additions and 249 deletions.
diff --git a/kmp-crypto b/kmp-crypto
diff --git a/vclib-aries/src/commonMain/kotlin/at/asitplus/wallet/lib/aries/MessageWrapper.kt b/vclib-aries/src/commonMain/kotlin/at/asitplus/wallet/lib/aries/MessageWrapper.kt
@@ -54,7 +54,7 @@ class MessageWrapper(
 
     private fun parseJwsMessage(joseObject: JwsSigned, serialized: String): ReceivedMessage {
         Napier.d("Parsing JWS ${joseObject.serialize()}")
-        if (!verifierJwsService.verifyJwsObject(joseObject, serialized))
+        if (!verifierJwsService.verifyJwsObject(joseObject))
             return ReceivedMessage.Error
                 .also { Napier.w("Signature invalid") }
         if (joseObject.header.contentType == JwsContentTypeConstants.DIDCOMM_PLAIN_JSON) {
@@ -99,7 +99,7 @@ class MessageWrapper(
             JwsContentTypeConstants.DIDCOMM_SIGNED_JSON,
             jwm.serialize().encodeToByteArray(),
             JwsContentTypeConstants.DIDCOMM_PLAIN_JSON
-        )
+        )?.serialize()
     }
 
 }
diff --git a/vclib-openid/src/commonMain/kotlin/at/asitplus/wallet/lib/oidc/OidcSiopVerifier.kt b/vclib-openid/src/commonMain/kotlin/at/asitplus/wallet/lib/oidc/OidcSiopVerifier.kt
@@ -143,7 +143,7 @@ class OidcSiopVerifier(
             JwsHeader(algorithm = JwsAlgorithm.ES256),
             requestObjectSerialized.encodeToByteArray(),
             true
-        )
+        )?.serialize()
         return AuthenticationRequestParameters(clientId = relyingPartyUrl, request = signedJws)
     }
 
@@ -293,7 +293,7 @@ class OidcSiopVerifier(
         val jwsSigned = JwsSigned.parse(idTokenJws)
             ?: return AuthnResponseResult.ValidationError("idToken", params.state)
                 .also { Napier.w("Could not parse JWS from idToken: $idTokenJws") }
-        if (!verifierJwsService.verifyJwsObject(jwsSigned, idTokenJws))
+        if (!verifierJwsService.verifyJwsObject(jwsSigned))
             return AuthnResponseResult.ValidationError("idToken", params.state)
                 .also { Napier.w { "JWS of idToken not verified: $idTokenJws" } }
         val idToken = IdToken.deserialize(jwsSigned.payload.decodeToString())

diff --git a/vclib-openid/src/commonMain/kotlin/at/asitplus/wallet/lib/oidc/OidcSiopWallet.kt b/vclib-openid/src/commonMain/kotlin/at/asitplus/wallet/lib/oidc/OidcSiopWallet.kt
@@ -121,7 +121,7 @@ class OidcSiopWallet(
     private fun extractRequestObject(params: AuthenticationRequestParameters): AuthenticationRequestParameters? {
         params.request?.let { requestObject ->
             JwsSigned.parse(requestObject)?.let { jws ->
-                if (verifierJwsService.verifyJwsObject(jws, requestObject)) {
+                if (verifierJwsService.verifyJwsObject(jws)) {
                     return kotlin.runCatching {
                         jsonSerializer.decodeFromString<AuthenticationRequestParameters>(jws.payload.decodeToString())
                     }.getOrNull()
@@ -224,8 +224,8 @@ class OidcSiopWallet(
             nonce = params.nonce,
         )
         val jwsPayload = idToken.serialize().encodeToByteArray()
-        val jwsHeader = JwsHeader(JwsAlgorithm.ES256)
-        val signedIdToken = jwsService.createSignedJwsAddingParams(jwsHeader, jwsPayload)
+        val jwsHeader = JwsHeader(algorithm = JwsAlgorithm.ES256)
+        val signedIdToken = jwsService.createSignedJwsAddingParams(jwsHeader, jwsPayload)?.serialize()
             ?: return KmmResult.failure<AuthenticationResponseParameters>(OAuth2Exception(Errors.USER_CANCELLED))
                 .also { Napier.w("Could not sign id_token") }
 

diff --git a/vclib-openid/src/commonMain/kotlin/at/asitplus/wallet/lib/oidvci/WalletService.kt b/vclib-openid/src/commonMain/kotlin/at/asitplus/wallet/lib/oidvci/WalletService.kt
@@ -102,7 +102,7 @@ class WalletService(
                 ).serialize().encodeToByteArray(),
                 addKeyId = true,
                 addJsonWebKey = true
-            )!!
+            )!!.serialize()
         )
         return when (credentialScheme.credentialFormat) {
             ConstantIndex.CredentialFormat.ISO_18013 -> CredentialRequestParameters(

diff --git a/vclib/src/commonMain/kotlin/at/asitplus/wallet/lib/agent/HolderAgent.kt b/vclib/src/commonMain/kotlin/at/asitplus/wallet/lib/agent/HolderAgent.kt
@@ -242,7 +242,7 @@ class HolderAgent(
         val jws = jwsService.createSignedJwt(JwsContentTypeConstants.JWT, jwsPayload)
             ?: return null
                 .also { Napier.w("Could not create JWS for presentation") }
-        return Holder.CreatePresentationResult.Signed(jws)
+        return Holder.CreatePresentationResult.Signed(jws.serialize())
     }
 
 

diff --git a/vclib/src/commonMain/kotlin/at/asitplus/wallet/lib/agent/IssuerAgent.kt b/vclib/src/commonMain/kotlin/at/asitplus/wallet/lib/agent/IssuerAgent.kt
@@ -242,7 +242,7 @@ class IssuerAgent(
 
     private suspend fun wrapVcInJws(vc: VerifiableCredential): String? {
         val jwsPayload = vc.toJws().serialize().encodeToByteArray()
-        return jwsService.createSignedJwt(JwsContentTypeConstants.JWT, jwsPayload)
+        return jwsService.createSignedJwt(JwsContentTypeConstants.JWT, jwsPayload)?.serialize()
     }
 
     private fun getRevocationListUrlFor(timePeriod: Int) =

diff --git a/vclib/src/commonMain/kotlin/at/asitplus/wallet/lib/agent/Validator.kt b/vclib/src/commonMain/kotlin/at/asitplus/wallet/lib/agent/Validator.kt
@@ -65,7 +65,7 @@ class Validator(
         val jws = JwsSigned.parse(it)
             ?: return false
                 .also { Napier.w("Revocation List: Could not parse JWS") }
-        if (!verifierJwsService.verifyJwsObject(jws, it))
+        if (!verifierJwsService.verifyJwsObject(jws))
             return false
                 .also { Napier.w("Revocation List: Signature invalid") }
         val payload = jws.payload.decodeToString()
@@ -140,7 +140,7 @@ class Validator(
         val jws = JwsSigned.parse(it)
             ?: return Verifier.VerifyPresentationResult.InvalidStructure(it)
                 .also { Napier.w("VP: Could not parse JWS") }
-        if (!verifierJwsService.verifyJwsObject(jws, it))
+        if (!verifierJwsService.verifyJwsObject(jws))
             return Verifier.VerifyPresentationResult.InvalidStructure(it)
                 .also { Napier.w("VP: Signature invalid") }
         val payload = jws.payload.decodeToString()
@@ -290,7 +290,7 @@ class Validator(
         val jws = JwsSigned.parse(it)
             ?: return Verifier.VerifyCredentialResult.InvalidStructure(it)
                 .also { Napier.w("VC: Could not parse JWS") }
-        if (!verifierJwsService.verifyJwsObject(jws, it))
+        if (!verifierJwsService.verifyJwsObject(jws))
             return Verifier.VerifyCredentialResult.InvalidStructure(it)
                 .also { Napier.w("VC: Signature invalid") }
         val payload = jws.payload.decodeToString()

diff --git a/vclib/src/commonMain/kotlin/at/asitplus/wallet/lib/jws/JwsService.kt b/vclib/src/commonMain/kotlin/at/asitplus/wallet/lib/jws/JwsService.kt
@@ -9,6 +9,7 @@ import at.asitplus.wallet.lib.agent.CryptoService
 import at.asitplus.wallet.lib.agent.DefaultVerifierCryptoService
 import at.asitplus.wallet.lib.agent.VerifierCryptoService
 import io.github.aakira.napier.Napier
+import io.ktor.util.*
 import io.matthewnelson.encoding.core.Decoder.Companion.decodeToByteArray
 import io.matthewnelson.encoding.core.Encoder.Companion.encodeToByteArray
 import io.matthewnelson.encoding.core.Encoder.Companion.encodeToString
@@ -23,9 +24,9 @@ interface JwsService {
         type: String,
         payload: ByteArray,
         contentType: String? = null
-    ): String?
+    ): JwsSigned?
 
-    suspend fun createSignedJws(header: JwsHeader, payload: ByteArray): String?
+    suspend fun createSignedJws(header: JwsHeader, payload: ByteArray): JwsSigned?
 
     /**
      * Appends correct values for [JweHeader.keyId], [JwsHeader.algorithm] and [JwsHeader.jsonWebKey],
@@ -36,7 +37,7 @@ interface JwsService {
         payload: ByteArray,
         addKeyId: Boolean = true,
         addJsonWebKey: Boolean = true
-    ): String?
+    ): JwsSigned?
 
     fun encryptJweObject(
         type: String,
@@ -53,7 +54,7 @@ interface JwsService {
 
 interface VerifierJwsService {
 
-    fun verifyJwsObject(jwsObject: JwsSigned, serialized: String? = null): Boolean
+    fun verifyJwsObject(jwsObject: JwsSigned): Boolean
 
     fun verifyJws(jwsObject: JwsSigned, signer: JsonWebKey): Boolean
 
@@ -65,7 +66,7 @@ class DefaultJwsService(private val cryptoService: CryptoService) : JwsService {
         type: String,
         payload: ByteArray,
         contentType: String?
-    ): String? {
+    ): JwsSigned? {
         val jwsHeader = JwsHeader(
             algorithm = cryptoService.algorithm,
             keyId = cryptoService.publicKey.keyId,
@@ -75,29 +76,28 @@ class DefaultJwsService(private val cryptoService: CryptoService) : JwsService {
         return createSignedJws(jwsHeader, payload)
     }
 
-    override suspend fun createSignedJws(header: JwsHeader, payload: ByteArray): String? {
+    override suspend fun createSignedJws(header: JwsHeader, payload: ByteArray): JwsSigned? {
         if (header.algorithm != cryptoService.algorithm
             || header.keyId?.let { it != cryptoService.publicKey.keyId } == true
             || header.jsonWebKey?.let { it != cryptoService.jsonWebKey } == true
         ) {
             return null.also { Napier.w("Algorithm or keyId not matching to cryptoService") }
         }
-        val signatureInput = header.serialize().encodeToByteArray().encodeToString(Base64UrlStrict) +
-                "." + payload.encodeToString(Base64UrlStrict)
-        val signatureInputBytes = signatureInput.encodeToByteArray()
+
+        val signatureInputBytes = prepareJwsSignatureInput(header, payload).encodeToByteArray()
         val signature = cryptoService.sign(signatureInputBytes).getOrElse {
             Napier.w("No signature from native code", it)
             return null
         }
-        return JwsSigned(header, payload, signature, signatureInput).serialize()
+        return JwsSigned(header, payload, signature)
     }
 
     override suspend fun createSignedJwsAddingParams(
         header: JwsHeader,
         payload: ByteArray,
         addKeyId: Boolean,
         addJsonWebKey: Boolean
-    ): String? {
+    ): JwsSigned? {
         var copy = header.copy(algorithm = cryptoService.algorithm)
         if (addKeyId)
             copy = copy.copy(keyId = cryptoService.publicKey.keyId)
@@ -211,7 +211,7 @@ class DefaultVerifierJwsService(
      * Verifies the signature of [jwsObject], by extracting the public key from [JwsHeader.keyId] (`kid`),
      * or from [JwsHeader.jsonWebKey] (`jwk`), or from [JwsHeader.certificateChain] (`x5c`).
      */
-    override fun verifyJwsObject(jwsObject: JwsSigned, serialized: String?): Boolean {
+    override fun verifyJwsObject(jwsObject: JwsSigned): Boolean {
         val header = jwsObject.header
         val publicKey = header.publicKey
             ?: return false
@@ -222,11 +222,12 @@ class DefaultVerifierJwsService(
             algorithm = header.algorithm,
             publicKey = publicKey
         )
-        val falseVar = false //workaround kotlin bug for linking xcframework
-        return verified.getOrElse {
-            Napier.w("No verification from native code")
-            falseVar
-        }
+//        val falseVar = false //workaround kotlin bug for linking xcframework
+//        return verified.getOrElse {
+//            Napier.w("No verification from native code", it)
+//            falseVar
+//        }
+        return verified.getOrThrow()
     }
 
     /**

diff --git a/vclib/src/commonTest/kotlin/at/asitplus/wallet/lib/agent/ValidatorVcTest.kt b/vclib/src/commonTest/kotlin/at/asitplus/wallet/lib/agent/ValidatorVcTest.kt
@@ -1,10 +1,10 @@
 package at.asitplus.wallet.lib.agent
 
 import at.asitplus.crypto.datatypes.JwsAlgorithm
-import at.asitplus.crypto.datatypes.io.Base64UrlStrict
 import at.asitplus.crypto.datatypes.jws.JwsContentTypeConstants
 import at.asitplus.crypto.datatypes.jws.JwsHeader
 import at.asitplus.crypto.datatypes.jws.JwsSigned
+import at.asitplus.crypto.datatypes.jws.prepareJwsSignatureInput
 import at.asitplus.wallet.lib.data.*
 import at.asitplus.wallet.lib.jws.DefaultJwsService
 import at.asitplus.wallet.lib.jws.JwsService
@@ -14,7 +14,6 @@ import io.kotest.datatest.withData
 import io.kotest.matchers.nulls.shouldNotBeNull
 import io.kotest.matchers.shouldBe
 import io.kotest.matchers.types.shouldBeInstanceOf
-import io.matthewnelson.encoding.core.Encoder.Companion.encodeToString
 import kotlinx.datetime.Clock
 import kotlinx.datetime.Instant
 import kotlin.time.Duration.Companion.hours
@@ -243,10 +242,8 @@ class ValidatorVcTest : FreeSpec() {
                     verifier.identifier,
                     attributeTypes = listOf(ConstantIndex.AtomicAttribute2023.vcType)
                 ).getOrThrow()
-            ) {
-                issueCredential(it, expirationDate = null)
-                    .let { wrapVcInJws(it) }
-                    .let { signJws(it) }
+            ) { it ->
+                signJws(wrapVcInJws(issueCredential(it, expirationDate = null)))
                     ?.let {
                         verifier.verifyVcJws(it).shouldBeInstanceOf<Verifier.VerifyCredentialResult.Success>()
                     }
@@ -260,10 +257,13 @@ class ValidatorVcTest : FreeSpec() {
                     verifier.identifier,
                     attributeTypes = listOf(ConstantIndex.AtomicAttribute2023.vcType)
                 ).getOrThrow()
-            ) {
-                issueCredential(it, expirationDate = Clock.System.now() + 1.hours)
-                    .let { wrapVcInJws(it, expirationDate = Clock.System.now() - 1.hours) }
-                    .let { signJws(it) }
+            ) { it ->
+                signJws(
+                    wrapVcInJws(
+                        issueCredential(it, expirationDate = Clock.System.now() + 1.hours),
+                        expirationDate = Clock.System.now() - 1.hours
+                    )
+                )
                     ?.let {
                         verifier.verifyVcJws(it)
                             .shouldBeInstanceOf<Verifier.VerifyCredentialResult.InvalidStructure>()
@@ -278,18 +278,16 @@ class ValidatorVcTest : FreeSpec() {
                     verifier.identifier,
                     attributeTypes = listOf(ConstantIndex.AtomicAttribute2023.vcType)
                 ).getOrThrow()
-            ) {
-                it.let {
-                    issueCredential(it, expirationDate = Clock.System.now() + 1.hours)
+            ) { it ->
+                signJws(
+                    wrapVcInJws(
+                        issueCredential(it, expirationDate = Clock.System.now() + 1.hours),
+                        expirationDate = Clock.System.now() + 2.hours
+                    )
+                )?.let {
+                    verifier.verifyVcJws(it)
+                        .shouldBeInstanceOf<Verifier.VerifyCredentialResult.InvalidStructure>()
                 }
-                    .let {
-                        wrapVcInJws(it, expirationDate = Clock.System.now() + 2.hours)
-                    }
-                    .let { signJws(it) }
-                    ?.let {
-                        verifier.verifyVcJws(it)
-                            .shouldBeInstanceOf<Verifier.VerifyCredentialResult.InvalidStructure>()
-                    }
             }
         }
 
@@ -300,12 +298,8 @@ class ValidatorVcTest : FreeSpec() {
                     verifier.identifier,
                     attributeTypes = listOf(ConstantIndex.AtomicAttribute2023.vcType)
                 ).getOrThrow()
-            ) {
-                it.let { issueCredential(it) }
-                    .let {
-                        wrapVcInJws(it, issuanceDate = Clock.System.now() + 2.hours)
-                    }
-                    .let { signJws(it) }
+            ) { it ->
+                signJws(wrapVcInJws(issueCredential(it), issuanceDate = Clock.System.now() + 2.hours))
                     ?.let {
                         verifier.verifyVcJws(it)
                             .shouldBeInstanceOf<Verifier.VerifyCredentialResult.InvalidStructure>()
@@ -338,10 +332,8 @@ class ValidatorVcTest : FreeSpec() {
                     verifier.identifier,
                     attributeTypes = listOf(ConstantIndex.AtomicAttribute2023.vcType)
                 ).getOrThrow()
-            ) {
-                issueCredential(it, issuanceDate = Clock.System.now() - 1.hours)
-                    .let { wrapVcInJws(it, issuanceDate = Clock.System.now()) }
-                    .let { signJws(it) }
+            ) { it ->
+                signJws(wrapVcInJws(issueCredential(it, issuanceDate = Clock.System.now() - 1.hours), issuanceDate = Clock.System.now()))
                     ?.let {
                         verifier.verifyVcJws(it)
                             .shouldBeInstanceOf<Verifier.VerifyCredentialResult.InvalidStructure>()
@@ -405,7 +397,7 @@ class ValidatorVcTest : FreeSpec() {
     private suspend fun signJws(vcJws: VerifiableCredentialJws): String? {
         val vcSerialized = vcJws.serialize()
         val jwsPayload = vcSerialized.encodeToByteArray()
-        return issuerJwsService.createSignedJwt(JwsContentTypeConstants.JWT, jwsPayload)
+        return issuerJwsService.createSignedJwt(JwsContentTypeConstants.JWT, jwsPayload)?.serialize()
     }
 
     private suspend fun wrapVcInJwsWrongKey(vcJws: VerifiableCredentialJws): String? {
@@ -415,13 +407,10 @@ class ValidatorVcTest : FreeSpec() {
             type = JwsContentTypeConstants.JWT
         )
         val jwsPayload = vcJws.serialize().encodeToByteArray()
-        val signatureInput =
-            jwsHeader.serialize().encodeToByteArray().encodeToString(Base64UrlStrict) +
-                    "." + jwsPayload.encodeToString(Base64UrlStrict)
-        val signatureInputBytes = signatureInput.encodeToByteArray()
-        val signature = issuerCryptoService.sign(signatureInputBytes)
+        val signatureInput = prepareJwsSignatureInput(jwsHeader, jwsPayload).encodeToByteArray()
+        val signature = issuerCryptoService.sign(signatureInput)
             .getOrElse { return null }
-        return JwsSigned(jwsHeader, jwsPayload, signature, signatureInput).serialize()
+        return JwsSigned(jwsHeader, jwsPayload, signature).serialize()
     }
 
 }
diff --git a/vclib/src/commonTest/kotlin/at/asitplus/wallet/lib/agent/ValidatorVpTest.kt b/vclib/src/commonTest/kotlin/at/asitplus/wallet/lib/agent/ValidatorVpTest.kt
@@ -135,7 +135,7 @@ class ValidatorVpTest : FreeSpec({
             audienceId = verifier.identifier,
         ).serialize()
         val jwsPayload = vpSerialized.encodeToByteArray()
-        val vpJws = holderJwsService.createSignedJwt(JwsContentTypeConstants.JWT, jwsPayload)
+        val vpJws = holderJwsService.createSignedJwt(JwsContentTypeConstants.JWT, jwsPayload)?.serialize()
         vpJws.shouldNotBeNull()
 
         verifier.verifyPresentation(vpJws, challenge)
@@ -156,7 +156,7 @@ class ValidatorVpTest : FreeSpec({
             jwtId = vp.id,
         ).serialize()
         val jwsPayload = vpSerialized.encodeToByteArray()
-        val vpJws = holderJwsService.createSignedJwt(JwsContentTypeConstants.JWT, jwsPayload)
+        val vpJws = holderJwsService.createSignedJwt(JwsContentTypeConstants.JWT, jwsPayload)?.serialize()
         vpJws.shouldNotBeNull()
 
         verifier.verifyPresentation(vpJws, challenge)
@@ -176,7 +176,7 @@ class ValidatorVpTest : FreeSpec({
             jwtId = "wrong_jwtId",
         ).serialize()
         val jwsPayload = vpSerialized.encodeToByteArray()
-        val vpJws = holderJwsService.createSignedJwt(JwsContentTypeConstants.JWT, jwsPayload)
+        val vpJws = holderJwsService.createSignedJwt(JwsContentTypeConstants.JWT, jwsPayload)?.serialize()
         vpJws.shouldNotBeNull()
 
         verifier.verifyPresentation(vpJws, challenge)
@@ -198,7 +198,7 @@ class ValidatorVpTest : FreeSpec({
             audienceId = verifier.identifier,
         ).serialize()
         val jwsPayload = vpSerialized.encodeToByteArray()
-        val vpJws = holderJwsService.createSignedJwt(JwsContentTypeConstants.JWT, jwsPayload)
+        val vpJws = holderJwsService.createSignedJwt(JwsContentTypeConstants.JWT, jwsPayload)?.serialize()
         vpJws.shouldNotBeNull()
 
         verifier.verifyPresentation(vpJws, challenge)