PYIC-5099: Enable RSA signature validation

[MikeCollingwood]

Proposed changes

What changed

• Derive signing algorithm from signing key: link
• Use signing algorithm to verify with correct algorithm: link
• Added test case for verifying with RSA: link
• Updated the local running cri config: link

Why did it change

• So we can validate RSA-signed VCs we expect from DWP

Issue tracking

• PYIC-5099

Remaining to do:

• Change the config manually for the DWP KBV stub to be an RSA key

[Joe-Edwards-GDS]

Digging a bit further into our libraries, it looks like you might be able to do this completely automatically.

Have a look at DefaultJWSVerifierFactory.createJWSVerifier() and JWK.parse()

[MikeCollingwood]

I saw JWK.parse, and am now updating to use the key to determine the algorithm. Will also look at createJWSVerifier

[MikeCollingwood]

Trying to play around with createJWSVerifier but it feels like it may not be as much of a simplification as wanted compared to the new version of the getVerifier method.

            var signingKeyJws = JWSObject.parse(signingKey);
            var keyFactory = KeyFactory.getInstance(signingKeyJws.getHeader().getAlgorithm().toString());
            keyFactory.generatePublic(new PKCS8EncodedKeySpec(signingKey.getBytes())
            );

            new DefaultJWSVerifierFactory().createJWSVerifier(signingKeyJws.getHeader(), Key);

            var formattedVc = EC.equals(signingKeyJws.getHeader().getAlgorithm()) ? transcodeSignatureIfDerFormat(vc) : vc;

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
88.6% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud