Passport Reader by 0xVikasRushi · Pull Request #178 · worldfnd/provekit

0xVikasRushi · 2025-09-04T21:27:15Z

Added sod, dsc parsing
Added passport extractor
Added circuits inputs for complete_age_check
mock data generator with mimic us real passport data

codspeed-hq · 2025-09-04T21:38:58Z

CodSpeed WallTime Performance Report

Merging #178 will improve performances by 33.33%

_{Comparing vr/passport-parser (bce9885) with main (56f91aa)}

⚠️

Unknown Walltime execution environment detected

Using the Walltime instrument on standard Hosted Runners will lead to inconsistent data.

For the most accurate results, we recommend using CodSpeed Macro Runners: bare-metal machines fine-tuned for performance measurement consistency.

Summary

⚡ 1 improvement
✅ 34 untouched

Benchmarks breakdown

	Benchmark	`BASE`	`HEAD`	Change
⚡	`reduce_add_rc`	4 ns	3 ns	+33.33%

Copilot

Pull Request Overview

This PR introduces a comprehensive passport reader system that replaces the previous mock test data generation with real passport SOD parsing and certificate validation capabilities. The key changes include:

Replace mock data generators with real passport SOD (Security Object Document) parsing
Add DSC (Document Signer Certificate) and CSCA (Country Signing Certificate Authority) validation
Implement circuit input generation for complete age verification workflows

Reviewed Changes

Copilot reviewed 17 out of 19 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`src/lib.rs`	New main library interface implementing PassportReader with validation and circuit input generation
`src/parser/*.rs`	Parser modules for binary data, SOD structures, DSC certificates, and type definitions
`src/mock_generator.rs`	Mock data generation utilities for testing with synthetic passport data
`src/mock_keys.rs`	Mock RSA private keys for testing certificate validation
`csca_registry/csca_public_key.json`	USA CSCA public key registry for certificate chain validation
`Cargo.toml`	Updated dependencies for X.509 parsing, ASN.1 handling, and cryptographic operations

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-09-15T10:20:55Z

+thread_local! {
+    static CSCA_JSON_PATH: RefCell<Option<String>> = RefCell::new(None);
+}


Thread-local storage with RefCell can cause issues in multi-threaded environments. Consider using a global static with Mutex or RwLock for thread-safe access, or document that this should only be used in single-threaded contexts.

Copilot · 2025-09-15T10:20:56Z

+                signing_time:   signed_attrs.signing_time.map(|ut| {
+                    let time_str = ut.to_string();
+                    chrono::DateTime::parse_from_rfc3339(&format!("{}T00:00:00Z", time_str))
+                        .unwrap_or_else(|_| chrono::Utc::now().into())
+                        .with_timezone(&chrono::Utc)


The signing time parsing assumes the UtcTime string can be directly formatted as a date, but this may not always be valid. The fallback to current time could mask parsing errors and return incorrect timestamps.

Suggested change

signing_time: signed_attrs.signing_time.map(|ut| {

let time_str = ut.to_string();

chrono::DateTime::parse_from_rfc3339(&format!("{}T00:00:00Z", time_str))

.unwrap_or_else(|_| chrono::Utc::now().into())

.with_timezone(&chrono::Utc)

signing_time: signed_attrs.signing_time.and_then(|ut| {

// Try to parse the UtcTime using chrono. If parsing fails, return None.

let time_str = ut.to_string();

chrono::DateTime::parse_from_rfc3339(&format!("{}T00:00:00Z", time_str))

.ok()

.map(|dt| dt.with_timezone(&chrono::Utc))

Copilot · 2025-09-15T10:20:56Z

+        if msg_digest.len() > 2 && msg_digest[0] == 0x04 {
+            msg_digest = msg_digest[2..].to_vec();
+        }


The magic numbers 0x04 and offset 2 should be documented or defined as named constants to explain what ASN.1 structure is being parsed here.

Copilot · 2025-09-15T10:20:56Z

+        let hex_der = hex::decode(binary.to_hex().trim_start_matches("0x")).unwrap();
+        let content_info: ContentInfo = der::decode(&hex_der).expect("CMS decode failed");


Converting binary data to hex string and then back to bytes is inefficient. Consider working directly with the binary data without the intermediate hex conversion.

Suggested change

let hex_der = hex::decode(binary.to_hex().trim_start_matches("0x")).unwrap();

let content_info: ContentInfo = der::decode(&hex_der).expect("CMS decode failed");

let content_info: ContentInfo = der::decode(binary.as_bytes()).expect("CMS decode failed");

Bisht13 · 2025-09-15T10:18:13Z

@@ -0,0 +1 @@
+<!DOCTYPE html>


why is this needed?

yeah. while running cargo test. i was getting this error without katex-header.html. not sure what is the reason

Bisht13 · 2025-09-15T15:19:31Z

+        utils::{get_oid_name, strip_length_prefix, OidEntry},
+    },
+    std::collections::HashMap,
+    x509_parser::prelude::*,


Can we import only the required items?

Bisht13 · 2025-09-15T15:21:34Z

+    pub serial_number:           Binary,
+    pub signature_algorithm:     SignatureAlgorithm,
+    pub issuer:                  String,
+    pub validity_not_before:     String,


We should use some Date format instead of String

Bisht13 · 2025-09-15T15:51:57Z

+        let dsc_signature = self.sod.signer_info.signature.to_number_array();
+        dsc_pubkey
+            .verify(
+                Pkcs1v15Sign::new::<Sha256>(),


Don't show US passports use RSASSA-PSS? Maybe we can change it to something like this

match sod.signer_info.signature_algorithm.name { SignatureAlgorithmName::Sha256WithRsaEncryption => { dsc_pubkey.verify(Pkcs1v15Sign::new::<Sha256>(), &signed_attr_hash, &dsc_signature) } SignatureAlgorithmName::RsassaPss => { // Use PSS verification with proper parameters dsc_pubkey.verify(Pss::new::<Sha256>(), &signed_attr_hash, &dsc_signature) } // ... other algorithms }

yeah, changed that

Bisht13 · 2025-09-15T15:56:52Z

+            .signed_attrs
+            .message_digest
+            .to_number_array();
+        if msg_digest.len() > 2 && msg_digest[0] == 0x04 {


Is it okay to hardcode DER header length?

Yeah, it works but hardcoding assumes a 2-byte OCTET STRING header since its ANS.1 Encoded

Bisht13 · 2025-09-15T16:06:21Z

+
+pub const MAX_SIGNED_ATTRIBUTES_SIZE: usize = 200;
+pub const MAX_DG1_SIZE: usize = 95;
+pub const SIG_BYTES: usize = 256;


Missing 4096-bit RSA support?

wWe’re directly parsing the CSCA key using RsaPublicKey::from_public_key_der(), so we don’t need that.

For csc_pubkey: [u8; SIG_BYTES * 2], we’re basically defining a fixed buffer (around 512 bytes)

Bisht13 · 2025-09-15T16:08:01Z

+    }
+
+    /// Convert to circuit inputs for Noir Circuits
+    pub fn to_circuit_inputs(


Inconsistent Error Handling

Many internal parsing details are public

No clear API boundary between internal parsing and external interface

Bisht13 · 2025-09-15T16:08:52Z

+
+    /// Converts a parsed `X509Certificate` into the internal `DSC` struct.
+    pub fn from_x509(cert: X509Certificate<'_>) -> DSC {
+        let registry = load_oids();


Use lazy_static!, heavy allocation used in multiple places.

Bisht13 · 2025-09-15T16:09:52Z

+    }
+
+    pub fn to_number_array(&self) -> Vec<u8> {
+        self.data.clone()


Unnecessary clone, return and use &[u8] where possible.

Bisht13 · 2025-09-15T16:11:47Z

+      "filename": "cert-00267-pubkey.pem",
+      "public_key": "MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAw4VGHnr3jsI//bv4fKBmGYLcrdcABkQNmVr8xkmlS7xxkDEQCohnzKSk8v0T+L0yp3h+WctO1ZwsaJfU0HDdMogDmEv3SeoNImOuqiofzkDLdH6/IWA/JfEwBYDz+1cn7/rbHuFCwo/dkPNJkeE7OrLGd9g6tsj8YibMZrB8N7nIVgEa9QOEiqXmUUV4KNKKRZJLu/RaWzZGNq+JqlXgANKvSwKWVW+aINb84UfkBIdbPfIkEq6JMdok+YIQyHemEP6nxnHAVQwOYRkgHidw9YHXZZkHgh75efixMoAy3LQxvoknECrlpZgxqIpdup+AwsEW8hoJZbpd3Dxeb27AAF3Rl9LBGPi1thd1A4Qb/AjVDtIyQaU62cHo7fEGcW5kVg/BLGhKH+RJKOqEZoG8b80X0jv/Z2VNNtDU/8flcKG9DkD+d+kgjMQAyPCOjC2achDcK5Zc1Q8/tq0T25x6GoRjbxadqR6MKrAYaP8KOLCrL0MJsjvcfD3M+hdyJXJPN/7TeCyKbK+dBvVCk9BePi6lBKmp6lEHjyyydgNBBzZPrTNf5l60Oh9eWpaIoTHcmToS6zKVffFb/dWnkCTF1BBuy1VgJNeIspn8n1PhY5Q23qvV8q+Q1Ta1X3TFGkvAb1SXGiPQW4Hd2JrFJEBo8Ah8nn8rQKX999PLI+An1acCAwEAAQ==",
+      "subject": "C=US, O=U.S. Government, OU=Department of State, OU=MRTD, OU=Certification Authorities, OU=U.S. Department of State MRTD CA",
+      "notBefore": "Dec 18 16:21:01 2014 GMT",


We should use ISO 8601 or Unix timestamp for time format.

Bisht13 · 2025-09-15T16:12:17Z

Please add a README as well.

Add passport reader

feat: passport reader crate

e01f8ad

0xVikasRushi commented Sep 4, 2025

View reviewed changes

Comment thread playground/passport-input-gen/src/parser/oid_registry.rs

chore: add comments to dsc, sod

b148894

0xVikasRushi marked this pull request as ready for review September 5, 2025 17:39

0xVikasRushi added 5 commits September 13, 2025 02:44

feat: sod to passport circuit

e4ea348

fix: include csca keys

570411b

chore: cleanup

5d6152d

feat: mock data inputs

eb2f9d6

fix: timestamp

8bcb710

Bisht13 requested a review from Copilot September 15, 2025 10:18

Copilot AI reviewed Sep 15, 2025

View reviewed changes

Bisht13 requested changes Sep 15, 2025

View reviewed changes

0xVikasRushi added 3 commits September 17, 2025 14:22

chore: updated with important oid

9fb942d

fix: clean code

0b578c5

feat: add readme to passport input gen

bce9885

Bisht13 approved these changes Sep 18, 2025

View reviewed changes

Bisht13 merged commit da40895 into main Sep 18, 2025
4 of 5 checks passed

Bisht13 deleted the vr/passport-parser branch September 18, 2025 16:52

dcbuild3r pushed a commit that referenced this pull request May 16, 2026

Merge pull request #178 from worldfnd/vr/passport-parser

6143e55

Add passport reader

		let hex_der = hex::decode(binary.to_hex().trim_start_matches("0x")).unwrap();
		let content_info: ContentInfo = der::decode(&hex_der).expect("CMS decode failed");

Conversation

0xVikasRushi commented Sep 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

codspeed-hq Bot commented Sep 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging #178 will improve performances by 33.33%

Summary

Benchmarks breakdown

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 15, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

0xVikasRushi Sep 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Bisht13 commented Sep 15, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

0xVikasRushi commented Sep 4, 2025 •

edited

Loading

codspeed-hq Bot commented Sep 4, 2025 •

edited

Loading

0xVikasRushi Sep 17, 2025 •

edited

Loading