oydid 0.5.4 → 0.5.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 171ab373123506d42a8dd20b80df654ebd3cf35ac1d53e65f36580b4a3d92374
-  data.tar.gz: 2bab378e7f1d284f7e730f32acb52964f7c84456ae5a41a786429d0f6ff11134
+  metadata.gz: e6e4098a11373a9b648447adbc7f6ec7b89d0efced1bb920080797dfdc5d17de
+  data.tar.gz: bf33e0ddd9abd26a04d92fa945db9183f87000e246f154aa509c55e9b5f4aefd
 SHA512:
-  metadata.gz: e3d84952f40b4b7680f1c49cb351516b25b901f696f4db73222a3a5f82a645ee23da62881f24237e29cac195da2857f4392ab289ba78d29f83a14332d970ea91
-  data.tar.gz: 555e144d9581d897b91eadd480267c9e76bfed1145077cf524537d13cc571be3efca39512aefdb7ce798390de22fc87ea922ac6e53db3e67dfba8dfa65cedd08
+  metadata.gz: 6175bb5b1d28443b26573754dd92f97094a7c139d032252c541a73dbd5019028466847b9602b380cd1ca814eeb3e7843576f7a86a77808a5268af62fe89dfba7
+  data.tar.gz: a719e0d4c5530340be4ad4a284ffadd46924db95a81c0212fb61e38243cac6a133bf8568ed6407a54d026502048bb06394f5e737f12e0ad588b65c43411bb046

data/VERSION

@@ -1 +1 @@
-0.5.4
+0.5.6

data/lib/oydid/basic.rb

@@ -1,10 +1,16 @@
 # -*- encoding: utf-8 -*-
 # frozen_string_literal: true
 
+class Hash
+    def except(*keys)
+        self.reject { |key, _| keys.include?(key) }
+    end
+end
+
 class Oydid
 
     # basic functions ---------------------------
-    # %w[multibases multihashes rbnacl json].each { |f| require f }
+    # %w[multibases multihashes rbnacl json multicodecs].each { |f| require f }
     def self.multi_encode(message, options)
         method = options[:encode] || DEFAULT_ENCODING rescue DEFAULT_ENCODING
         case method
@@ -54,7 +60,11 @@ class Oydid
     end
 
     def self.get_digest(message)
-        retVal = Multihashes.decode Oydid.multi_decode(message).first
+        decoded_message, error = Oydid.multi_decode(message)
+        if decoded_message.nil?
+            return [nil, error]
+        end
+        retVal = Multihashes.decode decoded_message
         if retVal[:hash_function].to_s != ""
             return [retVal[:hash_function].to_s, ""]
         end
@@ -94,7 +104,7 @@ class Oydid
     end
 
     # key management ----------------------------
-    def self.generate_private_key(input, method = "ed25519-priv", options)
+    def self.generate_private_key(input, method = "ed25519-priv", options = {})
         begin
             omc = Multicodecs[method].code
         rescue
@@ -104,15 +114,18 @@ class Oydid
         case Multicodecs[method].name 
         when 'ed25519-priv'
             if input != ""
-                raw_key = Ed25519::SigningKey.new(RbNaCl::Hash.sha256(input)).to_bytes
+                raw_key = Ed25519::SigningKey.new(RbNaCl::Hash.sha256(input))
             else
-                raw_key = Ed25519::SigningKey.generate.to_bytes
+                raw_key = Ed25519::SigningKey.generate
             end
+            raw_key = raw_key.to_bytes
+            length = raw_key.bytesize
         else
             return [nil, "unsupported key codec"]
         end
-        length = raw_key.bytesize
+        
         encoded = multi_encode([omc, length, raw_key].pack("SCa#{length}"), options)
+        # encoded = multi_encode(raw_key.to_bytes, options)
         if encoded.first.nil?
             return [nil, encoded.last]
         else
@@ -120,7 +133,7 @@ class Oydid
         end
     end
 
-    def self.public_key(private_key, options, method = "ed25519-pub")
+    def self.public_key(private_key, options = {}, method = "ed25519-pub")
         code, length, digest = multi_decode(private_key).first.unpack('SCa*')
         case Multicodecs[code].name
         when 'ed25519-priv'
@@ -132,6 +145,7 @@ class Oydid
             else
                 return [nil, "unsupported key codec"]
             end
+            # encoded = multi_encode(public_key.to_bytes, options)
             length = public_key.to_bytes.bytesize
             encoded = multi_encode([Multicodecs[method].code, length, public_key].pack("CCa#{length}"), options)
             if encoded.first.nil?
@@ -144,6 +158,29 @@ class Oydid
         end
     end
 
+    def self.getPrivateKey(enc, pwd, dsk, dfl, options)
+        if enc.to_s == "" # usually read from options[:doc_enc]
+            if pwd.to_s == "" # usually read from options[:doc_pwd]
+                if dsk.to_s == "" # usually read from options[:doc_key]
+                    if dfl.to_s == "" # default file name for key
+                        return [nil, "no reference"]
+                    else
+                        privateKey, msg = read_private_key(dfl.to_s, options)
+                    end
+                else
+                    privateKey, msg = read_private_key(dsk.to_s, options)
+                end
+            else
+                privateKey, msg = generate_private_key(pwd, 'ed25519-priv', options)
+            end
+        else
+            privateKey, msg = decode_private_key(enc.to_s, options)
+        end
+        return [privateKey, msg]
+    end
+
+    # if the identifier is already the public key there is no validation if it is a valid key
+    # (this is a privacy-preserving feature)
     def self.getPubKeyFromDID(did)
         identifier = did.split(LOCATION_PREFIX).first.split(CGI.escape LOCATION_PREFIX).first rescue did
         identifier = identifier.delete_prefix("did:oyd:")
@@ -166,6 +203,52 @@ class Oydid
         end
     end
 
+    # available key_types
+    # * doc - document key
+    # * rev - revocation key
+    def self.getDelegatedPubKeysFromDID(did, key_type = "doc")
+        # retrieve DID
+        did_document, msg = read(did, {})
+        keys, msg = getDelegatedPubKeysFromFullDidDocument(did_document, key_type)
+        if keys.nil?
+            return [nil, msg]
+        else
+            return [keys, ""]
+        end
+    end
+
+    def self.getDelegatedPubKeysFromFullDidDocument(did_document, key_type = "doc")
+        # get current public key
+        case key_type
+        when "doc"
+            keys = [did_document["doc"]["key"].split(":").first] rescue nil
+        when "rev"
+            keys = [did_document["doc"]["key"].split(":").last] rescue nil
+        else
+            return [nil, "invalid key type: " + key_type]
+        end
+        if keys.nil?
+            return [nil, "cannot retrieve current key"]
+        end
+
+        # travers through log and get active delegation public keys
+        log = did_document["log"]
+        log.each do |item|
+            if item["op"] == 5 # DELEGATE
+                # !!!OPEN: check if log entry is confirmed / referenced in a termination entry
+                item_keys = item["doc"]
+                if key_type == "doc" && item_keys[0..3] == "doc:"
+                    keys << item_keys[4-item_keys.length..]
+                elsif key_type == "rev" && item_keys[0..3] == "rev:"
+                    keys << item_keys[4-item_keys.length..]
+                end
+            end
+        end unless log.nil?
+
+        # return array
+        return [keys.uniq, ""]
+    end
+
     def self.sign(message, private_key, options)
         code, length, digest = multi_decode(private_key).first.unpack('SCa*')
         case Multicodecs[code].name
@@ -203,7 +286,7 @@ class Oydid
         end
     end
 
-    def self.encrypt(message, public_key, options)
+    def self.encrypt(message, public_key, options = {})
         begin
             code, length, digest = multi_decode(public_key).first.unpack('CCa*')
             case Multicodecs[code].name
@@ -229,7 +312,7 @@ class Oydid
         end
     end
 
-    def self.decrypt(message, private_key, options)
+    def self.decrypt(message, private_key, options = {})
         begin
             cipher = [JSON.parse(message)["value"]].pack('H*')
             nonce = [JSON.parse(message)["nonce"]].pack('H*')
@@ -250,10 +333,160 @@ class Oydid
         end
     end
 
+    # key="812b578d2e357270cbbd26a9dd44f93e5c8a3b44462e271348ce8f742dfe08144d06fd1f64d5a15c5b21564695d0dca9d65af322e8f96ef394400fe255d288cf"
+    def jweh(key)
+        pub_key=key[-64..-1]
+        prv_key=key[0..-65]
+        
+        hex_pub=pub_key
+        bin_pub=[hex_pub].pack('H*')
+        int_pub=RbNaCl::PublicKey.new(bin_pub)
+        len_pub=int_pub.to_bytes.bytesize
+        enc_pub=Oydid.multi_encode([Multicodecs["x25519-pub"].code,len_pub,int_pub].pack("CCa#{len_pub}"),{}).first
+
+        hex_prv=prv_key
+        bin_prv=[hex_prv].pack('H*')
+        int_prv=RbNaCl::PrivateKey.new(bin_prv)
+        len_prv=int_prv.to_bytes.bytesize
+        enc_prv=Oydid.multi_encode([Multicodecs["ed25519-priv"].code,len_prv,int_prv].pack("SCa#{len_prv}"),{}).first
+        return [enc_pub, enc_prv]
+    end
+
+    # public_key=jweh(key).first
+    # require 'oydid'
+    # message="hallo"
+    # public_key="z6Mv4uEoFYJ369NoE9xUzxG5sm8KpPnvHX6YH6GsYFGSQ32J"
+    # jwe=Oydid.encryptJWE(message, public_key).first
+    def self.encryptJWE(message, public_key, options = {})
+
+        jwe_header = {"enc":"XC20P"}
+        recipient_alg = 'ECDH-ES+XC20PKW'
+
+        # Content Encryption ---
+        # random nonce for XChaCha20-Poly1305: uses a 192-bit nonce (24 bytes)
+        cnt_nnc = RbNaCl::Random.random_bytes(RbNaCl::AEAD::XChaCha20Poly1305IETF.nonce_bytes)
+        # random key for XChaCha20-Poly1305: uses a 256-bit key (32 bytes)
+        cnt_key = RbNaCl::Random.random_bytes(RbNaCl::AEAD::XChaCha20Poly1305IETF.key_bytes)
+        # addtional data
+        cnt_aad = jwe_header.to_json
+        # setup XChaCha20-Poly1305 for Authenticated Encryption with Associated Data (AEAD)
+        cnt_aead = RbNaCl::AEAD::XChaCha20Poly1305IETF.new(cnt_key)
+        # encrypt
+        msg_enc = cnt_aead.encrypt(cnt_nnc, message, cnt_aad)
+        cnt_enc = msg_enc[0...-cnt_aead.tag_bytes]
+        cnt_tag = msg_enc[-cnt_aead.tag_bytes .. -1]
+
+        # Key Encryption ---
+        snd_prv = RbNaCl::PrivateKey.generate
+        code, length, digest = Oydid.multi_decode(public_key).first.unpack('CCa*')
+        buffer = RbNaCl::Util.zeros(RbNaCl::Boxes::Curve25519XSalsa20Poly1305::PublicKey::BYTES)
+        RbNaCl::Signatures::Ed25519::VerifyKey.crypto_sign_ed25519_pk_to_curve25519(buffer, digest)
+        shared_secret = RbNaCl::GroupElement.new(buffer).mult(snd_prv.to_bytes)
+        jwe_const = [0, 0, 0, 1] + 
+            shared_secret.to_bytes.unpack('C*') + 
+            [0,0,0,15] + 
+            recipient_alg.bytes + 
+            [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0]
+        kek = RbNaCl::Hash.sha256(jwe_const.pack('C*'))
+        snd_nnc = RbNaCl::Random.random_bytes(RbNaCl::AEAD::XChaCha20Poly1305IETF.nonce_bytes)
+        snd_aead = RbNaCl::AEAD::XChaCha20Poly1305IETF.new(kek)
+        snd_enc = snd_aead.encrypt(snd_nnc, cnt_key, nil)
+        snd_key = snd_enc[0...-snd_aead.tag_bytes]
+        snd_aut = snd_enc[-snd_aead.tag_bytes .. -1]
+
+        # create JWE ---
+        jwe_protected = Base64.urlsafe_encode64(jwe_header.to_json).delete("=")
+        jwe_encrypted_key = Base64.urlsafe_encode64(snd_key).delete("=")
+        jwe_init_vector = Base64.urlsafe_encode64(cnt_nnc).delete("=")
+        jwe_cipher_text = Base64.urlsafe_encode64(cnt_enc).delete("=")
+        jwe_auth_tag = Base64.urlsafe_encode64(cnt_tag).delete("=")
+        rcp_nnc_enc = Base64.urlsafe_encode64(snd_nnc).delete("=")
+        rcp_tag_enc = Base64.urlsafe_encode64(snd_aut).delete("=")
+
+        jwe_full = {
+            protected: jwe_protected,
+            iv: jwe_init_vector,
+            ciphertext: jwe_cipher_text,
+            tag: jwe_auth_tag,
+            recipients: [
+                {
+                    encrypted_key: jwe_encrypted_key,
+                    header: {
+                        alg: recipient_alg,
+                        iv: rcp_nnc_enc,
+                        tag: rcp_tag_enc,
+                        epk: {
+                            kty: "OKP",
+                            crv: "X25519",
+                            x: Base64.urlsafe_encode64(snd_prv.public_key.to_bytes).delete("=")
+                        }
+                    }
+                }
+            ]
+        }
+
+        jwe = jwe_protected
+        jwe += "." + jwe_encrypted_key
+        jwe += "." + jwe_init_vector
+        jwe += "." + jwe_cipher_text
+        jwe += "." + jwe_auth_tag
+
+        return [jwe_full, ""]
+    end
+
+    # require 'oydid'
+    # message = '{"protected":"eyJlbmMiOiJYQzIwUCJ9","iv":"G24pK06HSbL0vTlRZMIEBLfa074tJ1tq","ciphertext":"N5bgUr8","tag":"CJeq8cuaercgoBZmrYoGUA","recipients":[{"encrypted_key":"chR8HQh1CRYRU4TdlfBbvon4fcb5PKfWPSo0SgkMC_8","header":{"alg":"ECDH-ES+XC20PKW","iv":"K7lUo8shyJhxC7Nl45VlXes4tbDeZyBL","tag":"2sLCGRv70ESqEAqos3ZhSg","epk":{"kty":"OKP","crv":"X25519","x":"ZpnKcI7Kac6HPwVAGwM0PBweTFKM6wHHVljTHMRWpD4"}}}]}'
+    # message = jwe.to_json
+    # private_key = "z1S5USmDosHvi2giCLHCCgcq3Cd31mrhMcUy2fcfszxxLkD7"
+    # Oydid.decryptJWE(jwe.to_json, private_key)
+    def self.decryptJWE(message, private_key, options = {})
+
+        # JWE parsing
+        jwe_full = JSON.parse(message)
+        snd_pub_enc = jwe_full["recipients"].first["header"]["epk"]["x"]
+        snd_key_enc = jwe_full["recipients"].first["encrypted_key"]
+        snd_nnc_enc = jwe_full["recipients"].first["header"]["iv"]
+        snd_tag_enc = jwe_full["recipients"].first["header"]["tag"]
+        cnt_cip_enc = jwe_full["ciphertext"]
+        cnt_tag_enc = jwe_full["tag"]
+        cnt_nnc_enc = jwe_full["iv"]
+        cnt_aad_enc = jwe_full["protected"]
+        recipient_alg = jwe_full["recipients"].first["header"]["alg"]
+
+        snd_pub = Base64.urlsafe_decode64(snd_pub_enc)
+        snd_nnc = Base64.urlsafe_decode64(snd_nnc_enc)
+        snd_key = Base64.urlsafe_decode64(snd_key_enc)
+        snd_tag = Base64.urlsafe_decode64(snd_tag_enc)
+        cnt_nnc = Base64.urlsafe_decode64(cnt_nnc_enc)
+        cnt_cip = Base64.urlsafe_decode64(cnt_cip_enc)
+        cnt_tag = Base64.urlsafe_decode64(cnt_tag_enc)
+        cnt_aad = Base64.urlsafe_decode64(cnt_aad_enc)
+
+        # Key Decryption
+        code, length, digest = Oydid.multi_decode(private_key).first.unpack('SCa*')
+        buffer = RbNaCl::Util.zeros(RbNaCl::Boxes::Curve25519XSalsa20Poly1305::PublicKey::BYTES)
+        RbNaCl::Signatures::Ed25519::SigningKey.crypto_sign_ed25519_sk_to_curve25519(buffer, digest)
+        shared_secret = RbNaCl::GroupElement.new(snd_pub).mult(buffer)
+        jwe_const = [0, 0, 0, 1] + 
+            shared_secret.to_bytes.unpack('C*') + 
+            [0,0,0,15] + 
+            recipient_alg.bytes + 
+            [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0]
+        kek = RbNaCl::Hash.sha256(jwe_const.pack('C*'))
+        snd_aead = RbNaCl::AEAD::XChaCha20Poly1305IETF.new(kek)
+        cnt_key = snd_aead.decrypt(snd_nnc, snd_key+snd_tag, nil)
+
+        # Content Decryption
+        cnt_aead = RbNaCl::AEAD::XChaCha20Poly1305IETF.new(cnt_key)
+        cnt_dec = cnt_aead.decrypt(cnt_nnc, cnt_cip+cnt_tag, cnt_aad)
+
+        return [cnt_dec, ""]
+    end
+
     def self.read_private_key(filename, options)
         begin
             f = File.open(filename)
-            key_encoded = f.read
+            key_encoded = f.read.strip
             f.close
         rescue
             return [nil, "cannot read file"]
@@ -284,6 +517,9 @@ class Oydid
             when 'ed25519-pub'
                 verify_key = Ed25519::VerifyKey.new(digest)
                 return [verify_key, ""]
+            when 'x25519-pub'
+                pub_key = RbNaCl::PublicKey.new(digest)
+                return [pub_key, ""]
             else
                 return [nil, "unsupported key codec"]
             end
@@ -331,9 +567,16 @@ class Oydid
         case doc_location
         when /^http/
             doc_location = doc_location.sub("%3A%2F%2F","://").sub("%3A", ":")
-            retVal = HTTParty.get(doc_location + "/doc/" + doc_identifier)
+            option_str = ""
+            if options[:followAlsoKnownAs]
+                option_str = "?followAlsoKnownAs=true"
+            end
+            retVal = HTTParty.get(doc_location + "/doc/" + doc_identifier + option_str)
             if retVal.code != 200
-                msg = retVal.parsed_response("error").to_s rescue "invalid response from " + doc_location.to_s + "/doc/" + doc_identifier.to_s
+                msg = retVal.parsed_response["error"].to_s rescue ""
+                if msg.to_s == ""
+                    msg = "invalid response from " + doc_location.to_s + "/doc/" + doc_identifier.to_s
+                end
                 return [nil, msg]
             end
             if options.transform_keys(&:to_s)["trace"]

data/lib/oydid/didcomm.rb

@@ -102,12 +102,12 @@ class Oydid
     # DID Auth for data container with challenge ---
     def self.token_from_challenge(host, pwd, options = {})
         sid = SecureRandom.hex(20).to_s
+        public_key = public_key(generate_private_key(pwd, options).first, options).first
         retVal = HTTParty.post(host + "/oydid/init",
                     headers: { 'Content-Type' => 'application/json' },
-                    body: { "session_id": sid }.to_json )
+                    body: { "session_id": sid, "public_key": public_key }.to_json )
         challenge = retVal.parsed_response["challenge"]
         signed_challenge = sign(challenge, Oydid.generate_private_key(pwd, options).first, options).first
-        public_key = public_key(generate_private_key(pwd, options).first, options).first
         retVal = HTTParty.post(host + "/oydid/token",
                     headers: { 'Content-Type' => 'application/json' },
                     body: {