JSON-LD Signature Support

[rado0x54]

What's here:

This PR adds support for JSON LD Credentials via vc-js and provides signature suite implementation for

• EcdsaSecp256k1RecoverySignature2020
• Ed25519Signature2018

Other LD Context definitions and LD-Signature algorithms can be included dynamically within Veramo, but they need to be wrapped.
LinkedDataSignature Interfaces must be wrapped into VeramoLdSignature that allow for the translation of the Veramo (typed) ecosystem into vc-js. Futhermore, VeramoLdSignature offer quite the powerful callbacks into the documentLoader and signature process in order to solve incompatibilities between Veramo and vc-js. Please have a specific look at those functions.

Open Points (TBD link to related tickets).

• A challenge/response mechanism for VPs is currently not implemented in Veramos SDR flow and hardcoded challenge/responses are implemented for LD-based VPs

fixes #273

new credential-ld package

Support for LD-Signatures is optional.
If the @veramo/credential-ld plugin is not used, then creation and verification of LD VC/VPs will fail with an error that hints at installing the package.

---

Improved API to create VC/VP

This PR also introduces a few improvements to the ways credentials and presentations are created and verified.
For creation, the data types of the payloads required have been relaxed See CredentialPayload/PresentationPayload.
Credential and Presentation related data types are now defined in @veramo/core, since they are shared by multiple
packages (credential-w3c and credential-ld).

fixes #756

---

Introduced API for verification!!

Finally, you can call agent.verifyCredential() and agent.verifyPresentation() and get a result instead of trying to force these through the MessageHandler.

The result is just a boolean for this PR, but it will be improved by #375

---

new package for common converters

A new @veramo/utils package is now available that provides some common methods to help with low level conversions and the interpreting of some types.

--

Follow up work

• add support for EcdsaSecp256k1Signature2019
• add support for Ed25519Signature2020
• add support for EthereumEIP712Signature2021 Support LD Signature and Verification for EIP712 (TypedData) #422
• fix output of createCredential for JWT; people don't realize that Veramo returns the internal, parsed credential. Same for VP-JWT
• extend verification result from boolean to a more expressive output Generalized Verification API in Veramo Core #375

[codecov]

Codecov Report

Merging #525 (59f24ba) into next (88264db) will increase coverage by 11.20%.
The diff coverage is 81.60%.

❗ Current head 59f24ba differs from pull request most recent head 790fb8c. Consider uploading reports for the commit 790fb8c to get more accurate results

@@             Coverage Diff             @@
##             next     #525       +/-   ##
===========================================
+ Coverage   67.58%   78.78%   +11.20%     
===========================================
  Files          62      100       +38     
  Lines        1530     3111     +1581     
  Branches      247      567      +320     
===========================================
+ Hits         1034     2451     +1417     
- Misses        400      658      +258     
+ Partials       96        2       -94     

[mirceanis]

relates to #375

[rado0x54]

• Add (optional) KeyID or VerificationMethodID to CreateCredential and pick key according to input.
• Add a "VeramoPresentationContext" that allows for issuanceDate and "remove" dynamic deletion within presentations.

[nklomp]

Does anybody know what the state of this ticket is?

Given we want to be working with veramo but are also mostly using json-ld based credentials, this ticket is very much of interest to us. Is there anything we can do to help/expedite this?

Also @mirceanis in the last commit 0fededc you removed ed25519 support. Do you happen to remember the reason for it?

[mirceanis]

@nklomp I'm working on adding this feature.
That commit is a temporary removal because of conflicts in the dependency tree. It will be back.

The JSON-LD landscape is incredibly fragile and I'm trying to add support for it in a way that it is optional to use in case of further conflicts.
I expect to see a flood of support tickets once that is added because of this fragility.

[nklomp]

@mirceanis Happy to hear that. As mentioned we are happy to help out wherever we can, because we do believe that once this is implemented in Veramo, it can basically become the goto solution for verifiable data no matter what type of VCs you are using

[mirceanis]

become the goto solution for verifiable data no matter what type of VCs you are using
We share the same hope :)

It would be helpful to know which signature suites/verification methods are most commonly used so that I can prioritize them. Each implementation has some quirks that need to be ironed out for them to come together in the same framework.

[nklomp]

@mirceanis Sorry totally overlooked you asked a question.

What we are seeing and what is also my assumption is that most json-ld implementation are using ed25519 keys and then specifically Ed25519Signature2018 and these days Ed25519Signature2020 signature suites and verification methods, because of the blockchain heritage of a lot of DID methods. The latter version basically is a representation of the key in multibase format, so for ed25519 it is prefixing the proofValue of the verification method with the character 'z'.

Ed25519Signature2020: https://w3c-ccg.github.io/lds-ed25519-2020/
Ed25519Signature2018: https://w3c-ccg.github.io/lds-ed25519-2018/

The next interesting implementation is the ecdsa suites and verification methods, because of hardware support in mobile devices (as RSA), but they are less widely used in json-ld than ed25519 TTBOMK

[simonas-notcat]

Awesome work @rado0x54 @mirceanis !!

[siacomuzzi]

Great work, thank you!
Do you have plans to publish these changes to npm?

[mirceanis]

You can already use this from npm if you install all your veramo dependencies from the @next dist tag.
For example: yarn add @veramo/core@next instead of yarn add @veramo/core

This is not yet in the latest release channel because the API is still not stable enough and it does not work on all the platforms where we want it. It only work in nodejs, but not in a browser or in react-native.
JSON-LD is a beast that is hard to manage because of very convoluted dependencies of various signature suites and the general fragile nature of managing @context.

I'm working to fix these issues and unblock the release as well. Stay tuned.