decentralized-identity / decentralized-identity/edv-spec

Storage of encrypted content encryption keys in an EDV

Open
#45 9 comments 0 reactions 0 assignees View on GitHub
ready for PR
Dominant language
HTML
Stars
15
Forks
4
Avg merge
4d 10h
Merged PRs (30d)
4

Description

In some instances a group of documents inside an EDV may have a common level of access meaning they could be encrypted with a common encryption key and that encryption key is then encrypted once (via key agreement and key wrapping) to each of the valid recipients. This optimisation can be useful to bypass the need to perform the key agreement and key wrapping step on each document inside the group.

How this would look for instance is an EDV persists a document of the following structure.

```
{
"id":"z19x9iFMnfo4YLsShKAvnJk4L",
"sequence":0,
"jwe":{
"protected": {
"enc":"C20P",
"kid": "https://edv.example.com/document/4287248957624"
}, // base64 decoded
"iv":"FoJ5uPIR6HDPFCtD",
"ciphertext":"tIupQ-9MeYLdkAc1Us0Mdlp1kZ5Dbavq0No-eJ91cF0R0hE",
"tag":"TMRcEPc74knOIbXhLDJA_w"
}
}
```

Where the kid references another document in the EDV of the following structure

```
{
"id":"z19x9iFMnfo4YLsShKAvnJk4L",
"jwe":{
"protected": {
"enc":"A256KW"
}, // base64 decoded
"recipients":[
{
"header":{
"kid":"urn:123",
"alg":"ECDH-ES",
"epk":{
"kty":"OKP",
"crv":"X25519",
"x":"d7rIddZWblHmCc0mYZJw39SGteink_afiLraUb-qwgs"
},
"apu":"d7rIddZWblHmCc0mYZJw39SGteink_afiLraUb-qwgs",
"apv":"dXJuOjEyMw"
}
}
],
"iv":"FoJ5uPIR6HDPFCtD",
"ciphertext":"tIupQ-9MeYLdkAc1Us0Mdlp1kZ5Dbavq0No-eJ91cF0R0hE", < - encrypted content encryption key
"tag":"TMRcEPc74knOIbXhLDJA_w"
}
}
```

Where the decryption of the above document yields the content encryption/decryption key for the first document.

**Questions**

1. The above approach can be implemented with EDV's today where an encrypted content encryption key is stored as an encrypted document, however if we wanted greater semantic separation we could elect to store encrypted content encryption keys under a new endpoint `/keys` instead of storing these as encrypted documents.

2. Should this pattern feature anywhere in the spec or is it more of a candidate for an implementation guide?

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.