decentralized-identity / decentralized-identity/veramo

Improve key/suite/algorithm choice when creating VC/VP

Open
#926 2 comments 0 reactions 0 assignees View on GitHub
enhancement pinned triage
Dominant language
TypeScript
Stars
543
Forks
137
Avg merge
12m
Merged PRs (30d)
2

Description

## Background

It is very ambiguous exactly what key or algorithm will be used when creating a credential or presentation in Veramo 3.1 (&next).

Some keys can be used to sign using multiple algorithms / signature suites. For example, a Secp256k1 key can be used for: `ES256K`(jwt), `ES256K-R`(jwt), `EthereumEIP712Signature2021`(JSON), `EcdsaSecp256k1RecoverySignature2020`(JSON-LD), `EcdsaSecp256k1Signature 2019(JSON-LD)`, and a few others.

Some issuer DIDs have multiple keys that can be used for signing. If a new key is added specifically to sign new credentials, it won't automatically be used, especially if another managed key of the same type is found first.

## Proposal

I propose the following changes to the `createVerifiable*()` method arguments:

* `proofType` will describe the algorithm (e.g. `EdDSA`, `Ed25519Signature2018`), instead of `jwt`/`lds`/`712`
* `keyRef` will specify either the `id` of the verification method from the issuer DID document, or the internal `kid` known by `@veramo/key-manager`/`@veramo/did-manager`

The algorithm for creating proofs would change to:
* inspect the credential payload and extract the issuer DID
* first filter the keys associated with that DID by `keyRef`, if one is supplied,
* then filter the keys based on the matching `proofType`.
* If no key is left after filtering, throw an error.
* decide which plugin (jwt/ld/712) can generate the proof and call it with the filtered parameters.
* if an error is thrown by the called plugin and there are other keys/algorithms left after the filters, try the next one.

## Implications

* DID document of the issuer must be resolved when the `keyRef` does not refer to an internal key ID
* Since the implementations of JWT vs JSON-LD vs JSON proofs are provided by different plugins, the credential issuer plugin must also maintain a list of algorithms and their corresponding plugin implementation.
* Creating JSON-LD Presentations containing non LD credentials may fail because of LD reasons.
* The key metadata provided by `KMS` implementations becomes very important to decide if an algorithm or proof type is supported by a key. If this metadata is not available, some heuristics can be hardcoded, based on known key types.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.