oydid 0.5.4 → 0.5.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 171ab373123506d42a8dd20b80df654ebd3cf35ac1d53e65f36580b4a3d92374
-  data.tar.gz: 2bab378e7f1d284f7e730f32acb52964f7c84456ae5a41a786429d0f6ff11134
+  metadata.gz: 4a02a41e3567cca1fb47d9f5577892707d4a3841d9505138d1164aa5e84ced98
+  data.tar.gz: 519f74a4640ebe9b8936ab1b9bc60fcd84601c6b9ee750538f28c8e1fd2b3990
 SHA512:
-  metadata.gz: e3d84952f40b4b7680f1c49cb351516b25b901f696f4db73222a3a5f82a645ee23da62881f24237e29cac195da2857f4392ab289ba78d29f83a14332d970ea91
-  data.tar.gz: 555e144d9581d897b91eadd480267c9e76bfed1145077cf524537d13cc571be3efca39512aefdb7ce798390de22fc87ea922ac6e53db3e67dfba8dfa65cedd08
+  metadata.gz: 54a1637fd933c8f077eead73351ebca631a8d33992d72870e8e08d6776d034b54ca9bf0350c630b85b0b69afcb6e3840ce01096f4806beabc7a3019897c193d3
+  data.tar.gz: 2b4d266c2bd558aea5be65c8579567e135ce05ff4277c3ae0ef0727ee65214c86149f7e2a3ec31288b783543327416817764ccda6364f42f270470482f5c6aad

data/VERSION

@@ -1 +1 @@
-0.5.4
+0.5.5

data/lib/oydid/basic.rb

@@ -54,7 +54,11 @@ class Oydid
     end
 
     def self.get_digest(message)
-        retVal = Multihashes.decode Oydid.multi_decode(message).first
+        decoded_message, error = Oydid.multi_decode(message)
+        if decoded_message.nil?
+            return [nil, error]
+        end
+        retVal = Multihashes.decode decoded_message
         if retVal[:hash_function].to_s != ""
             return [retVal[:hash_function].to_s, ""]
         end
@@ -144,6 +148,29 @@ class Oydid
         end
     end
 
+    def self.getPrivateKey(enc, pwd, dsk, dfl, options)
+        if enc.to_s == "" # usually read from options[:doc_enc]
+            if pwd.to_s == "" # usually read from options[:doc_pwd]
+                if dsk.to_s == "" # usually read from options[:doc_key]
+                    if dfl.to_s == "" # default file name for key
+                        return [nil, "no reference"]
+                    else
+                        privateKey, msg = read_private_key(dfl.to_s, options)
+                    end
+                else
+                    privateKey, msg = read_private_key(dsk.to_s, options)
+                end
+            else
+                privateKey, msg = generate_private_key(pwd, 'ed25519-priv', options)
+            end
+        else
+            privateKey, msg = decode_private_key(enc.to_s, options)
+        end
+        return [privateKey, msg]
+    end
+
+    # if the identifier is already the public key there is no validation if it is a valid key
+    # (this is a privacy-preserving feature)
     def self.getPubKeyFromDID(did)
         identifier = did.split(LOCATION_PREFIX).first.split(CGI.escape LOCATION_PREFIX).first rescue did
         identifier = identifier.delete_prefix("did:oyd:")
@@ -166,6 +193,52 @@ class Oydid
         end
     end
 
+    # available key_types
+    # * doc - document key
+    # * rev - revocation key
+    def self.getDelegatedPubKeysFromDID(did, key_type = "doc")
+        # retrieve DID
+        did_document, msg = read(did, {})
+        keys, msg = getDelegatedPubKeysFromFullDidDocument(did_document, key_type)
+        if keys.nil?
+            return [nil, msg]
+        else
+            return [keys, ""]
+        end
+    end
+
+    def self.getDelegatedPubKeysFromFullDidDocument(did_document, key_type = "doc")
+        # get current public key
+        case key_type
+        when "doc"
+            keys = [did_document["doc"]["key"].split(":").first] rescue nil
+        when "rev"
+            keys = [did_document["doc"]["key"].split(":").last] rescue nil
+        else
+            return [nil, "invalid key type: " + key_type]
+        end
+        if keys.nil?
+            return [nil, "cannot retrieve current key"]
+        end
+
+        # travers through log and get active delegation public keys
+        log = did_document["log"]
+        log.each do |item|
+            if item["op"] == 5 # DELEGATE
+                # !!!OPEN: check if log entry is confirmed / referenced in a termination entry
+                item_keys = item["doc"]
+                if key_type == "doc" && item_keys[0..3] == "doc:"
+                    keys << item_keys[4-item_keys.length..]
+                elsif key_type == "rev" && item_keys[0..3] == "rev:"
+                    keys << item_keys[4-item_keys.length..]
+                end
+            end
+        end unless log.nil?
+
+        # return array
+        return [keys.uniq, ""]
+    end
+
     def self.sign(message, private_key, options)
         code, length, digest = multi_decode(private_key).first.unpack('SCa*')
         case Multicodecs[code].name
@@ -203,7 +276,7 @@ class Oydid
         end
     end
 
-    def self.encrypt(message, public_key, options)
+    def self.encrypt(message, public_key, options = {})
         begin
             code, length, digest = multi_decode(public_key).first.unpack('CCa*')
             case Multicodecs[code].name
@@ -229,7 +302,7 @@ class Oydid
         end
     end
 
-    def self.decrypt(message, private_key, options)
+    def self.decrypt(message, private_key, options = {})
         begin
             cipher = [JSON.parse(message)["value"]].pack('H*')
             nonce = [JSON.parse(message)["nonce"]].pack('H*')
@@ -333,7 +406,10 @@ class Oydid
             doc_location = doc_location.sub("%3A%2F%2F","://").sub("%3A", ":")
             retVal = HTTParty.get(doc_location + "/doc/" + doc_identifier)
             if retVal.code != 200
-                msg = retVal.parsed_response("error").to_s rescue "invalid response from " + doc_location.to_s + "/doc/" + doc_identifier.to_s
+                msg = retVal.parsed_response["error"].to_s rescue ""
+                if msg.to_s == ""
+                    msg = "invalid response from " + doc_location.to_s + "/doc/" + doc_identifier.to_s
+                end
                 return [nil, msg]
             end
             if options.transform_keys(&:to_s)["trace"]

data/lib/oydid/didcomm.rb

@@ -102,12 +102,12 @@ class Oydid
     # DID Auth for data container with challenge ---
     def self.token_from_challenge(host, pwd, options = {})
         sid = SecureRandom.hex(20).to_s
+        public_key = public_key(generate_private_key(pwd, options).first, options).first
         retVal = HTTParty.post(host + "/oydid/init",
                     headers: { 'Content-Type' => 'application/json' },
-                    body: { "session_id": sid }.to_json )
+                    body: { "session_id": sid, "public_key": public_key }.to_json )
         challenge = retVal.parsed_response["challenge"]
         signed_challenge = sign(challenge, Oydid.generate_private_key(pwd, options).first, options).first
-        public_key = public_key(generate_private_key(pwd, options).first, options).first
         retVal = HTTParty.post(host + "/oydid/token",
                     headers: { 'Content-Type' => 'application/json' },
                     body: {

data/lib/oydid/log.rb

@@ -5,11 +5,9 @@ class Oydid
     # log functions -----------------------------
     def self.add_hash(log)
         log.map do |item|
-            i = item.dup
-            i.delete("previous")
-            item["entry-hash"] = multi_hash(canonical(item), LOG_HASH_OPTIONS).first
-            if item.transform_keys(&:to_s)["op"] == 1
-                item["sub-entry-hash"] = multi_hash(canonical(i), LOG_HASH_OPTIONS).first
+            item["entry-hash"] = multi_hash(canonical(item.slice("ts","op","doc","sig","previous")), LOG_HASH_OPTIONS).first
+            if item.transform_keys(&:to_s)["op"] == 1 # REVOKE
+                item["sub-entry-hash"] = multi_hash(canonical(item.slice("ts","op","doc","sig")), LOG_HASH_OPTIONS).first
             end
             item
         end
@@ -37,7 +35,8 @@ class Oydid
 
         case log_location
         when /^http/
-            log_location = log_location.sub("%3A%2F%2F","://")
+            log_location = log_location.gsub("%3A",":")
+            log_location = log_location.gsub("%2F%2F","//")
             retVal = HTTParty.get(log_location + "/log/" + did_hash)
             if retVal.code != 200
                 msg = retVal.parsed_response("error").to_s rescue 
@@ -61,29 +60,55 @@ class Oydid
         end
     end
 
+    def self.retrieve_log_item(log_hash, log_location, options)
+        if log_location.to_s == ""
+            log_location = DEFAULT_LOCATION
+        end
+        if !log_location.start_with?("http")
+            log_location = "https://" + log_location
+        end
+
+        case log_location
+        when /^http/
+            log_location = log_location.gsub("%3A",":")
+            log_location = log_location.gsub("%2F%2F","//")
+            retVal = HTTParty.get(log_location + "/log/" + log_hash + "/item")
+            if retVal.code != 200
+                msg = retVal.parsed_response("error").to_s rescue 
+                        "invalid response from " + log_location.to_s + "/log/" + log_hash.to_s + "/item"
+                return [nil, msg]
+            end
+            if options.transform_keys(&:to_s)["trace"]
+                if options[:silent].nil? || !options[:silent]
+                    puts "GET log entry for " + log_hash + " from " + log_location
+                end
+            end
+            retVal = JSON.parse(retVal.to_s) rescue nil
+            return [retVal, ""]
+        else
+            return [nil, "cannot read from " + log_location]
+        end
+    end
+
     def self.dag_did(logs, options)
         dag = DAG.new
         dag_log = []
         log_hash = []
-        
+
         # calculate hash values for each entry and build vertices
         i = 0
         create_entries = 0
         create_index = nil
         terminate_indices = []
         logs.each do |el|
-            if el["op"].to_i == 2
+            case el["op"].to_i
+            when 0 # TERMINATE
+                terminate_indices << i
+            when 2 # CREATE
                 create_entries += 1
                 create_index = i
             end
-            if el["op"].to_i == 0
-                terminate_indices << i
-            end
-            log_options = options.dup
-            el_hash = el["doc"].split(LOCATION_PREFIX).first.split(CGI.escape LOCATION_PREFIX).first
-            log_options[:digest] = Oydid.get_digest(el_hash).first
-            log_options[:encode] = Oydid.get_encoding(el_hash).first
-            log_hash << Oydid.multi_hash(Oydid.canonical(el), LOG_HASH_OPTIONS).first
+            log_hash << Oydid.multi_hash(Oydid.canonical(el.slice("ts","op","doc","sig","previous")), LOG_HASH_OPTIONS).first
             dag_log << dag.add_vertex(id: i)
             i += 1
         end unless logs.nil?
@@ -94,7 +119,7 @@ class Oydid
             return [nil, nil, nil, "missing TERMINATE entries" ]
         end 
 
-        # create edges between vertices
+        # create provisional edges between vertices
         i = 0
         logs.each do |el|
             el["previous"].each do |p|
@@ -127,6 +152,47 @@ class Oydid
                 return [nil, nil, nil, "cannot resolve DID" ]
             end
         end 
+
+        # create actual edges between vertices (but only use last terminate index for delegates)
+        dag = DAG.new
+        dag_log = []
+        log_hash = []
+
+        # calculate hash values for each entry and build vertices
+        i = 0
+        create_entries = 0
+        create_index = nil
+        terminate_indices = []
+        logs.each do |el|
+            case el["op"].to_i
+            when 0 # TERMINATE
+                terminate_indices << i
+            when 2 # CREATE
+                create_entries += 1
+                create_index = i
+            end
+            log_hash << Oydid.multi_hash(Oydid.canonical(el.slice("ts","op","doc","sig","previous")), LOG_HASH_OPTIONS).first
+            dag_log << dag.add_vertex(id: i)
+            i += 1
+        end unless logs.nil?
+        i = 0
+        logs.each do |el|
+            el["previous"].each do |p|
+                position = log_hash.find_index(p)
+                if !position.nil?
+                    if logs[position]["op"].to_i == 5 # DELEGATE
+                        if i == terminate_index
+                            # only delegates in the last terminate index are relevant
+                            dag.add_edge from: dag_log[position], to: dag_log[i]
+                        end
+                    else
+                        dag.add_edge from: dag_log[position], to: dag_log[i]
+                    end
+                end
+            end unless el["previous"] == []
+            i += 1
+        end unless logs.nil?
+
         return [dag, create_index, terminate_index, ""]
     end
 
@@ -154,9 +220,29 @@ class Oydid
         result
     end
 
+    def self.dag2array_terminate(dag, log_array, index, result, options)
+        if options.transform_keys(&:to_s)["trace"]
+            if options[:silent].nil? || !options[:silent]
+                puts "    vertex " + index.to_s + " at " + log_array[index]["ts"].to_s + " op: " + log_array[index]["op"].to_s + " doc: " + log_array[index]["doc"].to_s
+            end
+        end
+        dag.vertices[index].predecessors.each do |p|
+            if p[:id] != index
+                if options.transform_keys(&:to_s)["trace"]
+                    if options[:silent].nil? || !options[:silent]
+                        puts "    vertex " + p[:id].to_s + " at " + log_array[p[:id]]["ts"].to_s + " op: " + log_array[p[:id]]["op"].to_s + " doc: " + log_array[p[:id]]["doc"].to_s
+                    end
+                end
+                result << log_array[p[:id]]
+            end
+        end unless dag.vertices[index].nil?
+        result << log_array[index]
+        result
+    end
+
     def self.dag_update(currentDID, options)
         i = 0
-        doc_location = ""
+        doc_location = options[:doc_location].to_s
         initial_did = currentDID["did"].to_s.dup
         initial_did = initial_did.delete_prefix("did:oyd:")
         if initial_did.include?(LOCATION_PREFIX)
@@ -164,6 +250,13 @@ class Oydid
             initial_did = tmp[0] 
             doc_location = tmp[1]
         end
+        if initial_did.include?(CGI.escape LOCATION_PREFIX)
+            tmp = initial_did.split(CGI.escape LOCATION_PREFIX)
+            initial_did = tmp[0] 
+            doc_location = tmp[1]
+        end
+        doc_location = doc_location.gsub("%3A",":")
+        doc_location = doc_location.gsub("%2F%2F","//")
         current_public_doc_key = ""
         verification_output = false
         currentDID["log"].each do |el|
@@ -172,8 +265,9 @@ class Oydid
                 currentDID["doc_log_id"] = i
                 doc_did = el["doc"]
                 did_hash = doc_did.delete_prefix("did:oyd:")
-                did_hash = did_hash.split(LOCATION_PREFIX).first
+                did_hash = did_hash.split(LOCATION_PREFIX).first.split(CGI.escape LOCATION_PREFIX).first
                 did10 = did_hash[0,10]
+
                 doc = retrieve_document_raw(doc_did, did10 + ".doc", doc_location, {})
                 if doc.first.nil?
                     currentDID["error"] = 2
@@ -225,7 +319,7 @@ class Oydid
 
                 doc_did = currentDID["did"]
                 did_hash = doc_did.delete_prefix("did:oyd:")
-                did_hash = did_hash.split(LOCATION_PREFIX).first
+                did_hash = did_hash.split(LOCATION_PREFIX).first.split(CGI.escape LOCATION_PREFIX).first
                 did10 = did_hash[0,10]
                 doc = retrieve_document_raw(doc_did, did10 + ".doc", doc_location, {})
                 # since it retrieves a DID that previously existed, this test is not necessary
@@ -236,16 +330,16 @@ class Oydid
                 # end
                 doc = doc.first["doc"]
                 term = doc["log"]
-                log_location = term.split(LOCATION_PREFIX)[1] rescue ""
-                if log_location.to_s == ""
+                log_location = term.split(LOCATION_PREFIX).last.split(CGI.escape LOCATION_PREFIX).last rescue ""
+                if log_location.to_s == "" || log_location == term
                     log_location = DEFAULT_LOCATION
                 end
-                term = term.split(LOCATION_PREFIX).first
+                term = term.split(LOCATION_PREFIX).first.split(CGI.escape LOCATION_PREFIX).first
                 log_options = options.dup
                 el_hash = el["doc"].split(LOCATION_PREFIX).first.split(CGI.escape LOCATION_PREFIX).first
-                log_options[:digest] = Oydid.get_digest(el_hash).first
-                log_options[:encode] = Oydid.get_encoding(el_hash).first
-                if multi_hash(canonical(el), log_options).first != term
+                log_options[:digest] = get_digest(el_hash).first
+                log_options[:encode] = get_encoding(el_hash).first
+                if multi_hash(canonical(el.slice("ts","op","doc","sig","previous")), log_options).first != term
                     currentDID["error"] = 1
                     currentDID["message"] = "Log reference and record don't match"
                     if verification_output
@@ -266,7 +360,7 @@ class Oydid
                 # check if there is a revocation entry
                 revocation_record = {}
                 revoc_term = el["doc"]
-                revoc_term = revoc_term.split(LOCATION_PREFIX).first
+                revoc_term = revoc_term.split(LOCATION_PREFIX).first.split(CGI.escape LOCATION_PREFIX).first
                 revoc_term_found = false
                 log_array, msg = retrieve_log(did_hash, did10 + ".log", log_location, options)
                 log_array.each do |log_el|
@@ -274,7 +368,7 @@ class Oydid
                     if log_el["op"].to_i == 1 # TERMINATE
                         log_el_structure.delete("previous")
                     end
-                    if multi_hash(canonical(log_el_structure), log_options).first == revoc_term
+                    if multi_hash(canonical(log_el_structure.slice("ts","op","doc","sig","previous")), log_options).first == revoc_term
                         revoc_term_found = true
                         revocation_record = log_el.dup
                         if verification_output
@@ -291,7 +385,7 @@ class Oydid
                 # if !options.transform_keys(&:to_s)["log_location"].nil?
                 #     log_array, msg = retrieve_log(revoc_term, did10 + ".log", options.transform_keys(&:to_s)["log_location"], options)
                 #     log_array.each do |log_el|
-                #         if log_el["op"] == 1 # TERMINATE
+                #         if log_el["op"] == 1 # REVOKE
                 #             log_el_structure = log_el.delete("previous")
                 #         else
                 #             log_el_structure = log_el
@@ -317,15 +411,26 @@ class Oydid
                             if log_el["previous"].include?(multi_hash(canonical(revocation_record), LOG_HASH_OPTIONS).first)
                                 update_term_found = true
                                 message = log_el["doc"].to_s
-
                                 signature = log_el["sig"]
-                                public_key = current_public_doc_key.to_s
-                                signature_verification = verify(message, signature, public_key).first
+                                # public_key = current_public_doc_key.to_s
+                                extend_currentDID = currentDID.dup
+                                extend_currentDID["log"] = extend_currentDID["full_log"]
+                                # !!!TODO: check for delegates only at certain point in time
+                                pubKeys, msg = Oydid.getDelegatedPubKeysFromFullDidDocument(extend_currentDID, "doc")
+                                signature_verification = false
+                                used_pubkey = ""
+                                pubKeys.each do |key|
+                                    if Oydid.verify(message, signature, key).first
+                                        signature_verification = true
+                                        used_pubkey = key
+                                        break
+                                    end
+                                end
                                 if signature_verification
                                     if verification_output
                                         currentDID["verification"] += "found UPDATE log record:" + "\n"
                                         currentDID["verification"] += JSON.pretty_generate(log_el) + "\n"
-                                        currentDID["verification"] += "✅ public key from last DID Document: " + current_public_doc_key.to_s + "\n"
+                                        currentDID["verification"] += "✅ public key: " + used_pubkey.to_s + "\n"
                                         currentDID["verification"] += "verifies 'doc' reference of new DID Document: " + log_el["doc"].to_s + "\n"
                                         currentDID["verification"] += log_el["sig"].to_s + "\n"
                                         currentDID["verification"] += "of next DID Document (Details: https://ownyourdata.github.io/oydid/#verify_signature)" + "\n"
@@ -333,7 +438,7 @@ class Oydid
                                         next_doc_did = log_el["doc"].to_s
                                         next_doc_location = doc_location
                                         next_did_hash = next_doc_did.delete_prefix("did:oyd:")
-                                        next_did_hash = next_did_hash.split(LOCATION_PREFIX).first
+                                        next_did_hash = next_did_hash.split(LOCATION_PREFIX).first.split(CGI.escape LOCATION_PREFIX).first
                                         next_did10 = next_did_hash[0,10]
                                         next_doc = retrieve_document_raw(next_doc_did, next_did10 + ".doc", next_doc_location, {})
                                         if next_doc.first.nil?
@@ -342,7 +447,7 @@ class Oydid
                                             return currentDID
                                         end
                                         next_doc = next_doc.first["doc"]
-                                        if public_key == next_doc["key"].split(":").first
+                                        if pubKeys.include?(next_doc["key"].split(":").first)
                                             currentDID["verification"] += "⚠️  no key rotation in updated DID Document" + "\n"
                                         end
                                         currentDID["verification"] += "\n"
@@ -354,12 +459,12 @@ class Oydid
                                         new_doc_did = log_el["doc"].to_s
                                         new_doc_location = doc_location
                                         new_did_hash = new_doc_did.delete_prefix("did:oyd:")
-                                        new_did_hash = new_did_hash.split(LOCATION_PREFIX).first
+                                        new_did_hash = new_did_hash.split(LOCATION_PREFIX).first.split(CGI.escape LOCATION_PREFIX).first
                                         new_did10 = new_did_hash[0,10]
                                         new_doc = retrieve_document(new_doc_did, new_did10 + ".doc", new_doc_location, {}).first
                                         currentDID["verification"] += "found UPDATE log record:" + "\n"
                                         currentDID["verification"] += JSON.pretty_generate(log_el) + "\n"
-                                        currentDID["verification"] += "⛔ public key from last DID Document: " + current_public_doc_key.to_s + "\n"
+                                        currentDID["verification"] += "⛔ none of available public keys (" + pubKeys.join(", ") + ")\n"
                                         currentDID["verification"] += "does not verify 'doc' reference of new DID Document: " + log_el["doc"].to_s + "\n"
                                         currentDID["verification"] += log_el["sig"].to_s + "\n"
                                         currentDID["verification"] += "next DID Document (Details: https://ownyourdata.github.io/oydid/#verify_signature)" + "\n"
@@ -386,6 +491,8 @@ class Oydid
                 end
             when 1 # revocation log entry
                 # do nothing
+            when 5 # DELEGATE
+                # do nothing
             else
                 currentDID["error"] = 2
                 currentDID["message"] = "FATAL ERROR: op code '" + el["op"].to_s + "' not implemented"
@@ -394,8 +501,6 @@ class Oydid
             end
             i += 1
         end unless currentDID["log"].nil?
-
         return currentDID
     end
-
 end

data/lib/oydid/vc.rb

@@ -52,7 +52,6 @@ class Oydid
             return [nil, msg]
             exit
         end
-
         retVal = HTTParty.get(vc_url,
             headers: {'Authorization' => 'Bearer ' + access_token})
         if retVal.code != 200
@@ -111,7 +110,7 @@ class Oydid
             proof["type"] = "Ed25519Signature2020"
             proof["verificationMethod"] = options[:issuer].to_s
             proof["proofPurpose"] = "assertionMethod"
-            proof["proofValue"] = sign(vercred["credentialSubject"].to_json_c14n, options[:issuer_privateKey], []).first
+            proof["proofValue"] = sign(vercred["credentialSubject"].transform_keys(&:to_s).to_json_c14n, options[:issuer_privateKey], []).first
             vercred["proof"] = proof
         else
             vercred["proof"] = content["proof"]
@@ -126,6 +125,9 @@ class Oydid
     end
 
     def self.create_vc_proof(content, options)
+        if content["id"].nil?
+            content["id"] = options[:holder]
+        end
         proof = {}
         proof["type"] = "Ed25519Signature2020"
         proof["verificationMethod"] = options[:issuer].to_s