decentralized-identity / decentralized-identity/edv-spec
Storage of encrypted content encryption keys in an EDV
- Dominant language
- HTML
- Stars
- 15
- Forks
- 4
- Avg merge
- 4d 10h
- Merged PRs (30d)
- 4
Description
In some instances a group of documents inside an EDV may have a common level of access meaning they could be encrypted with a common encryption key and that encryption key is then encrypted once (via key agreement and key wrapping) to each of the valid recipients. This optimisation can be useful to bypass the need to perform the key agreement and key wrapping step on each document inside the group.
How this would look for instance is an EDV persists a document of the following structure.
```
{
"id":"z19x9iFMnfo4YLsShKAvnJk4L",
"sequence":0,
"jwe":{
"protected": {
"enc":"C20P",
"kid": "https://edv.example.com/document/4287248957624"
}, // base64 decoded
"iv":"FoJ5uPIR6HDPFCtD",
"ciphertext":"tIupQ-9MeYLdkAc1Us0Mdlp1kZ5Dbavq0No-eJ91cF0R0hE",
"tag":"TMRcEPc74knOIbXhLDJA_w"
}
}
```
Where the kid references another document in the EDV of the following structure
```
{
"id":"z19x9iFMnfo4YLsShKAvnJk4L",
"jwe":{
"protected": {
"enc":"A256KW"
}, // base64 decoded
"recipients":[
{
"header":{
"kid":"urn:123",
"alg":"ECDH-ES",
"epk":{
"kty":"OKP",
"crv":"X25519",
"x":"d7rIddZWblHmCc0mYZJw39SGteink_afiLraUb-qwgs"
},
"apu":"d7rIddZWblHmCc0mYZJw39SGteink_afiLraUb-qwgs",
"apv":"dXJuOjEyMw"
}
}
],
"iv":"FoJ5uPIR6HDPFCtD",
"ciphertext":"tIupQ-9MeYLdkAc1Us0Mdlp1kZ5Dbavq0No-eJ91cF0R0hE", < - encrypted content encryption key
"tag":"TMRcEPc74knOIbXhLDJA_w"
}
}
```
Where the decryption of the above document yields the content encryption/decryption key for the first document.
**Questions**
1. The above approach can be implemented with EDV's today where an encrypted content encryption key is stored as an encrypted document, however if we wanted greater semantic separation we could elect to store encrypted content encryption keys under a new endpoint `/keys` instead of storing these as encrypted documents.
2. Should this pattern feature anywhere in the spec or is it more of a candidate for an implementation guide?
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.