-
Notifications
You must be signed in to change notification settings - Fork 7
/
jws.go
138 lines (108 loc) · 3.84 KB
/
jws.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
/*
Copyright SecureKey Technologies Inc. All Rights Reserved.
SPDX-License-Identifier: Apache-2.0
*/
package proof
import (
"encoding/base64"
"encoding/json"
"errors"
"strings"
"github.com/trustbloc/did-go/doc/ld/processor"
)
const (
securityContext = "https://w3id.org/security/v2"
securityContextJWK2020 = "https://w3id.org/security/jws/v1"
)
const (
jwtPartsNumber = 3
jwtHeaderPart = 0
jwtSignaturePart = 2
)
// CreateDetachedJWTHeader creates detached JWT header.
func CreateDetachedJWTHeader(alg string) string {
jwtHeaderMap := map[string]interface{}{
"alg": alg,
"b64": false,
"crit": []string{"b64"},
}
jwtHeaderBytes, err := json.Marshal(jwtHeaderMap)
if err != nil {
panic(err)
}
return base64.RawURLEncoding.EncodeToString(jwtHeaderBytes)
}
// GetJWTSignature returns signature part of JWT.
func GetJWTSignature(jwt string) ([]byte, error) {
jwtParts := strings.Split(jwt, ".")
if len(jwtParts) != jwtPartsNumber || jwtParts[jwtSignaturePart] == "" {
return nil, errors.New("invalid JWT")
}
return base64.RawURLEncoding.DecodeString(jwtParts[jwtSignaturePart])
}
func getJWTHeader(jwt string) (string, error) {
jwtParts := strings.Split(jwt, ".")
if len(jwtParts) != jwtPartsNumber {
return "", errors.New("invalid JWT")
}
return jwtParts[jwtHeaderPart], nil
}
// createVerifyJWS creates a data to be used to create/verify a digital signature in the
// form of JSON Web Signature (JWS) with detached content (https://tools.ietf.org/html/rfc7797).
// The algorithm of building the payload is similar to conventional Create Verify Hash algorithm.
// It differs by using https://w3id.org/security/v2 as context for JSON-LD canonization of both
// JSON and Signature documents and by preliminary JSON-LD compacting of JSON document.
// The current implementation is based on the https://github.com/digitalbazaar/jsonld-signatures.
func createVerifyJWS(suite signatureSuite, jsonldDoc map[string]interface{}, p *Proof,
opts ...processor.Opts) ([]byte, error) {
proofOptions := p.JSONLdObject()
canonicalProofOptions, err := prepareJWSProof(suite, proofOptions, opts...)
if err != nil {
return nil, err
}
proofOptionsDigest := suite.GetDigest(canonicalProofOptions)
canonicalDoc, err := prepareDocumentForJWS(suite, jsonldDoc, opts...)
if err != nil {
return nil, err
}
docDigest := suite.GetDigest(canonicalDoc)
verifyData := append(proofOptionsDigest, docDigest...)
jwtHeader, err := getJWTHeader(p.JWS)
if err != nil {
return nil, err
}
return append([]byte(jwtHeader+"."), verifyData...), nil
}
func prepareJWSProof(suite signatureSuite, proofOptions map[string]interface{},
opts ...processor.Opts) ([]byte, error) {
// TODO proof contexts shouldn't be hardcoded in jws, should be passed in jsonld doc by author [Issue#1833]
proofOptions[jsonldContext] = []interface{}{securityContext, securityContextJWK2020}
proofOptionsCopy := make(map[string]interface{}, len(proofOptions))
for key, value := range proofOptions {
proofOptionsCopy[key] = value
}
delete(proofOptionsCopy, jsonldJWS)
delete(proofOptionsCopy, jsonldProofValue)
return suite.GetCanonicalDocument(proofOptionsCopy, opts...)
}
func prepareDocumentForJWS(suite signatureSuite, jsonldObject map[string]interface{},
opts ...processor.Opts) ([]byte, error) {
// copy document object without proof
doc := GetCopyWithoutProof(jsonldObject)
if suite.CompactProof() {
docCompacted, err := getCompactedWithSecuritySchema(doc, opts...)
if err != nil {
return nil, err
}
doc = docCompacted
}
// build canonical document
return suite.GetCanonicalDocument(doc, opts...)
}
func getCompactedWithSecuritySchema(docMap map[string]interface{},
opts ...processor.Opts) (map[string]interface{}, error) {
contextMap := map[string]interface{}{
"@context": securityContext,
}
return processor.Default().Compact(docMap, contextMap, opts...)
}