@0xpolygonid/js-sdk 1.10.3 → 1.11.0

package/dist/node/esm/iden3comm/packers/plain.js

@@ -8,6 +8,18 @@ import { byteDecoder, byteEncoder } from '../../utils';
  * @implements implements IPacker interface
  */
 export class PlainPacker {
+    /**
+     * Packs a basic message using the specified parameters.
+     *
+     * @param msg - The basic message to pack.
+     * @param param - The packer parameters.
+     * @returns A promise that resolves to a Uint8Array representing the packed message.
+     * @throws An error if the method is not implemented.
+     */
+    packMessage(msg) {
+        msg.typ = MediaType.PlainMessage;
+        return Promise.resolve(byteEncoder.encode(JSON.stringify(msg)));
+    }
     /**
      * Pack returns packed message to transport envelope
      *
@@ -15,9 +27,7 @@ export class PlainPacker {
      * @param {PlainPackerParams} _params - not used here
      * @returns `Promise<Uint8Array>`
      */
-    //
-    // eslint-disable-next-line @typescript-eslint/no-unused-vars
-    async pack(payload, _params) {
+    async pack(payload) {
         const msg = JSON.parse(byteDecoder.decode(payload));
         msg.typ = MediaType.PlainMessage;
         return Promise.resolve(byteEncoder.encode(JSON.stringify(msg)));

package/dist/node/esm/iden3comm/packers/zkp.js

@@ -74,6 +74,15 @@ export class ZKPPacker {
         this.provingParamsMap = provingParamsMap;
         this.verificationParamsMap = verificationParamsMap;
     }
+    /**
+     * Packs a basic message using the specified parameters.
+     * @param msg - The basic message to pack.
+     * @param param - The parameters for the ZKPPacker.
+     * @returns A promise that resolves to a Uint8Array representing the packed message.
+     */
+    packMessage(msg, param) {
+        return this.pack(byteEncoder.encode(JSON.stringify(msg)), param);
+    }
     /**
      * creates JSON Web Zeroknowledge token
      *

package/dist/node/esm/iden3comm/utils/did.js

@@ -1,5 +1,5 @@
 import { SUPPORTED_PUBLIC_KEY_TYPES } from '../constants';
-import elliptic from 'elliptic';
+import { secp256k1 as sec } from '@noble/curves/secp256k1';
 import { KmsKeyType } from '../../kms';
 import { base58ToBytes, base64UrlToBytes, bytesToHex, hexToBytes } from '../../utils';
 const DIDAuthenticationSection = 'authentication';
@@ -23,7 +23,6 @@ export const resolveVerificationMethods = (didDocument) => {
     }
     return sortedVerificationMethods;
 };
-const secp256k1 = new elliptic.ec('secp256k1');
 export const extractPublicKeyBytes = (vm) => {
     const isSupportedVmType = Object.keys(SUPPORTED_PUBLIC_KEY_TYPES).some((key) => SUPPORTED_PUBLIC_KEY_TYPES[key].includes(vm.type));
     if (vm.publicKeyBase58 && isSupportedVmType) {
@@ -42,13 +41,17 @@ export const extractPublicKeyBytes = (vm) => {
         vm.publicKeyJwk.crv === 'secp256k1' &&
         vm.publicKeyJwk.x &&
         vm.publicKeyJwk.y) {
+        const [xHex, yHex] = [
+            base64UrlToBytes(vm.publicKeyJwk.x),
+            base64UrlToBytes(vm.publicKeyJwk.y)
+        ].map(bytesToHex);
+        const x = xHex.includes('0x') ? BigInt(xHex) : BigInt(`0x${xHex}`);
+        const y = yHex.includes('0x') ? BigInt(yHex) : BigInt(`0x${yHex}`);
         return {
-            publicKeyBytes: hexToBytes(secp256k1
-                .keyFromPublic({
-                x: bytesToHex(base64UrlToBytes(vm.publicKeyJwk.x)),
-                y: bytesToHex(base64UrlToBytes(vm.publicKeyJwk.y))
-            })
-                .getPublic('hex')),
+            publicKeyBytes: sec.ProjectivePoint.fromAffine({
+                x,
+                y
+            }).toRawBytes(false),
             kmsKeyType: KmsKeyType.Secp256k1
         };
     }

package/dist/node/esm/identity/identity-wallet.js

@@ -1,6 +1,6 @@
 import { KmsKeyType } from '../kms';
 import { Blockchain, buildDIDType, BytesHelper, Claim, ClaimOptions, DID, DidMethod, getUnixTimestamp, Id, NetworkId, SchemaHash } from '@iden3/js-iden3-core';
-import { poseidon, PublicKey, sha256, Signature, Hex, getRandomBytes } from '@iden3/js-crypto';
+import { poseidon, PublicKey, sha256, Signature, Hex, getRandomBytes, Poseidon } from '@iden3/js-crypto';
 import { hashElems, ZERO_HASH } from '@iden3/js-merkletree';
 import { generateProfileDID, subjectPositionIndex } from './common';
 import * as uuid from 'uuid';
@@ -8,8 +8,11 @@ import { JsonSchemaValidator, cacheLoader } from '../schema-processor';
 import { MerkleTreeType } from '../storage';
 import { VerifiableConstants, BJJSignatureProof2021, MerklizedRootPosition, SubjectPosition, W3CCredential, Iden3SparseMerkleTreeProof, ProofType, CredentialStatusType } from '../verifiable';
 import { getKMSIdByAuthCredential, getNodesRepresentation, pushHashesToRHS } from '../credentials';
-import { byteEncoder } from '../utils';
+import { CircuitId, StateTransitionInputs } from '../circuits';
+import { buildDIDFromEthPubKey, byteEncoder, isEthereumIdentity } from '../utils';
 import { CredentialStatusPublisherRegistry, Iden3SmtRhsCredentialStatusPublisher } from '../credentials/status/credential-status-publisher';
+import { InputGenerator } from '../proof';
+import { TransactionService } from '../blockchain';
 /**
  * @public
  * Wallet instance to manage the digital identity based on iden3 protocol
@@ -36,6 +39,8 @@ export class IdentityWallet {
         this._credentialWallet = _credentialWallet;
         this._opts = _opts;
         this._credentialStatusPublisherRegistry = this.getCredentialStatusPublisherRegistry(_opts);
+        this._inputsGenerator = new InputGenerator(this, _credentialWallet, _storage.states);
+        this._transactionService = new TransactionService(_storage.states.getRpcProvider());
     }
     getCredentialStatusPublisherRegistry(_opts) {
         if (!_opts?.credentialStatusPublisherRegistry) {
@@ -50,35 +55,16 @@ export class IdentityWallet {
             return this._opts?.credentialStatusPublisherRegistry;
         }
     }
-    /**
-     * {@inheritDoc IIdentityWallet.createIdentity}
-     */
-    async createIdentity(opts) {
-        const tmpIdentifier = opts.seed ? uuid.v5(Hex.encode(sha256(opts.seed)), uuid.NIL) : uuid.v4();
-        opts.method = opts.method ?? DidMethod.Iden3;
-        opts.blockchain = opts.blockchain ?? Blockchain.Polygon;
-        opts.networkId = opts.networkId ?? NetworkId.Amoy;
-        await this._storage.mt.createIdentityMerkleTrees(tmpIdentifier);
-        opts.seed = opts.seed ?? getRandomBytes(32);
-        const keyId = await this._kms.createKeyFromSeed(KmsKeyType.BabyJubJub, opts.seed);
+    async createAuthCoreClaim(revNonce, seed) {
+        const keyId = await this._kms.createKeyFromSeed(KmsKeyType.BabyJubJub, seed);
         const pubKeyHex = await this._kms.publicKey(keyId);
         const pubKey = PublicKey.newFromHex(pubKeyHex);
         const schemaHash = SchemaHash.authSchemaHash;
         const authClaim = Claim.newClaim(schemaHash, ClaimOptions.withIndexDataInts(pubKey.p[0], pubKey.p[1]), ClaimOptions.withRevocationNonce(BigInt(0)));
-        const revNonce = opts.revocationOpts.nonce ?? 0;
         authClaim.setRevocationNonce(BigInt(revNonce));
-        await this._storage.mt.addToMerkleTree(tmpIdentifier, MerkleTreeType.Claims, authClaim.hiHv().hi, authClaim.hiHv().hv);
-        const claimsTree = await this._storage.mt.getMerkleTreeByIdentifierAndType(tmpIdentifier, MerkleTreeType.Claims);
-        const currentState = hashElems([
-            (await claimsTree.root()).bigInt(),
-            ZERO_HASH.bigInt(),
-            ZERO_HASH.bigInt()
-        ]);
-        const didType = buildDIDType(opts.method, opts.blockchain, opts.networkId);
-        const identifier = Id.idGenesisFromIdenState(didType, currentState.bigInt());
-        const did = DID.parseFromId(identifier);
-        await this._storage.mt.bindMerkleTreeToNewIdentifier(tmpIdentifier, did.string());
-        const schema = JSON.parse(VerifiableConstants.AUTH.AUTH_BJJ_CREDENTIAL_SCHEMA_JSON);
+        return { authClaim, pubKey };
+    }
+    async createAuthBJJCredential(did, pubKey, authClaim, currentState, revocationOpts) {
         const authData = authClaim.getExpirationDate();
         const expiration = authData ? getUnixTimestamp(authData) : 0;
         const request = {
@@ -92,29 +78,91 @@ export class IdentityWallet {
             version: 0,
             expiration,
             revocationOpts: {
-                nonce: revNonce,
-                id: opts.revocationOpts.id.replace(/\/$/, ''),
-                type: opts.revocationOpts.type,
+                nonce: Number(authClaim.getRevocationNonce()),
+                id: revocationOpts.id.replace(/\/$/, ''),
+                type: revocationOpts.type,
                 issuerState: currentState.hex()
             }
         };
+        // Check if has already an auth credential
+        const authCredentials = await this._credentialWallet.getAllAuthBJJCredentials(did);
         let credential = new W3CCredential();
-        try {
-            credential = this._credentialWallet.createCredential(did, request, schema);
+        if (authCredentials.length === 0) {
+            const schema = JSON.parse(VerifiableConstants.AUTH.AUTH_BJJ_CREDENTIAL_SCHEMA_JSON);
+            try {
+                credential = this._credentialWallet.createCredential(did, request, schema);
+            }
+            catch (e) {
+                throw new Error(`Error create w3c credential ${e.message}`);
+            }
         }
-        catch (e) {
-            throw new Error(`Error create w3c credential ${e.message}`);
+        else {
+            // credential with sigProof signed with previous auth bjj credential
+            credential = await this.issueCredential(did, request);
         }
-        const index = authClaim.hIndex();
+        return credential;
+    }
+    /**
+     * {@inheritDoc IIdentityWallet.createIdentity}
+     */
+    async createIdentity(opts) {
+        const tmpIdentifier = opts.seed ? uuid.v5(Hex.encode(sha256(opts.seed)), uuid.NIL) : uuid.v4();
+        opts.seed = opts.seed ?? getRandomBytes(32);
+        await this._storage.mt.createIdentityMerkleTrees(tmpIdentifier);
+        const revNonce = opts.revocationOpts.nonce ?? 0;
+        const { authClaim, pubKey } = await this.createAuthCoreClaim(revNonce, opts.seed);
+        const { hi, hv } = authClaim.hiHv();
+        await this._storage.mt.addToMerkleTree(tmpIdentifier, MerkleTreeType.Claims, hi, hv);
+        const claimsTree = await this._storage.mt.getMerkleTreeByIdentifierAndType(tmpIdentifier, MerkleTreeType.Claims);
         const ctr = await claimsTree.root();
+        const currentState = hashElems([ctr.bigInt(), ZERO_HASH.bigInt(), ZERO_HASH.bigInt()]);
+        const didType = buildDIDType(opts.method || DidMethod.Iden3, opts.blockchain || Blockchain.Polygon, opts.networkId || NetworkId.Amoy);
+        const identifier = Id.idGenesisFromIdenState(didType, currentState.bigInt());
+        const did = DID.parseFromId(identifier);
+        await this._storage.mt.bindMerkleTreeToNewIdentifier(tmpIdentifier, did.string());
+        const oldTreeState = {
+            revocationRoot: ZERO_HASH,
+            claimsRoot: ctr,
+            state: currentState,
+            rootOfRoots: ZERO_HASH
+        };
+        const identity = await this._storage.identity.getIdentity(did.string());
+        if (!identity) {
+            await this._storage.identity.saveIdentity({
+                did: did.string(),
+                state: currentState,
+                isStatePublished: false,
+                isStateGenesis: true
+            });
+        }
+        // check whether we have auth credential, if not - create a new one
+        const credentials = await this._credentialWallet.findByQuery({
+            credentialSubject: {
+                x: {
+                    $eq: pubKey.p[0].toString()
+                },
+                y: {
+                    $eq: pubKey.p[1].toString()
+                }
+            },
+            allowedIssuers: [did.string()]
+        });
+        if (credentials.length) {
+            return {
+                did,
+                credential: credentials[0]
+            };
+        }
+        const credential = await this.createAuthBJJCredential(did, pubKey, authClaim, currentState, opts.revocationOpts);
+        const index = authClaim.hIndex();
         const { proof } = await claimsTree.generateProof(index, ctr);
         const mtpProof = new Iden3SparseMerkleTreeProof({
             mtp: proof,
             issuerData: {
                 id: did,
                 state: {
-                    rootOfRoots: ZERO_HASH,
-                    revocationTreeRoot: ZERO_HASH,
+                    rootOfRoots: oldTreeState.rootOfRoots,
+                    revocationTreeRoot: oldTreeState.revocationRoot,
                     claimsTreeRoot: ctr,
                     value: currentState
                 }
@@ -126,13 +174,45 @@ export class IdentityWallet {
             rhsUrl: opts.revocationOpts.id,
             onChain: opts.revocationOpts.onChain
         });
+        await this._credentialWallet.save(credential);
+        return {
+            did,
+            credential
+        };
+    }
+    /**
+     * {@inheritDoc IIdentityWallet.createEthereumBasedIdentity}
+     */
+    async createEthereumBasedIdentity(opts) {
+        opts.seed = opts.seed ?? getRandomBytes(32);
+        opts.createBjjCredential = opts.createBjjCredential ?? true;
+        let credential;
+        const ethSigner = opts.ethSigner;
+        if (!ethSigner) {
+            throw new Error('Ethereum signer is required to create Ethereum identities in order to transit state');
+        }
+        const currentState = ZERO_HASH; // In Ethereum identities we don't have an initial state with the auth credential
+        const didType = buildDIDType(opts.method || DidMethod.Iden3, opts.blockchain || Blockchain.Polygon, opts.networkId || NetworkId.Amoy);
+        const keyIdEth = await this._kms.createKeyFromSeed(KmsKeyType.Secp256k1, opts.seed);
+        const pubKeyHexEth = (await this._kms.publicKey(keyIdEth)).slice(2); // 04 + x + y (uncompressed key)
+        const did = buildDIDFromEthPubKey(didType, pubKeyHexEth);
+        await this._storage.mt.createIdentityMerkleTrees(did.string());
         await this._storage.identity.saveIdentity({
             did: did.string(),
             state: currentState,
             isStatePublished: false,
             isStateGenesis: true
         });
-        await this._credentialWallet.save(credential);
+        if (opts.createBjjCredential) {
+            // Old tree state genesis state
+            const oldTreeState = {
+                revocationRoot: ZERO_HASH,
+                claimsRoot: ZERO_HASH,
+                state: currentState,
+                rootOfRoots: ZERO_HASH
+            };
+            credential = await this.addBJJAuthCredential(did, oldTreeState, true, ethSigner, opts);
+        }
         return {
             did,
             credential
@@ -206,7 +286,10 @@ export class IdentityWallet {
     /** {@inheritDoc IIdentityWallet.generateClaimMtp} */
     async generateCredentialMtp(did, credential, treeState) {
         const coreClaim = await this.getCoreClaimFromCredential(credential);
-        // todo: Parser.parseClaim
+        return this.generateCoreClaimMtp(did, coreClaim, treeState);
+    }
+    /** {@inheritDoc IIdentityWallet.generateClaimMtp} */
+    async generateCoreClaimMtp(did, coreClaim, treeState) {
         const treesModel = await this.getDIDTreeModel(did);
         const claimsTree = await this._storage.mt.getMerkleTreeByIdentifierAndType(did.string(), MerkleTreeType.Claims);
         const claimsRoot = await treesModel.claimsTree.root();
@@ -340,14 +423,14 @@ export class IdentityWallet {
                 };
             }
         }
-        throw new Error('no auth credentials found');
+        throw new Error(VerifiableConstants.ERRORS.NO_AUTH_CRED_FOUND);
     }
     /** {@inheritDoc IIdentityWallet.revokeCredential} */
     async revokeCredential(issuerDID, credential) {
         const issuerTree = await this.getDIDTreeModel(issuerDID);
-        const coreClaim = credential.getCoreClaimFromProof(ProofType.BJJSignature);
+        const coreClaim = await this.getCoreClaimFromCredential(credential);
         if (!coreClaim) {
-            throw new Error('credential must have coreClaim representation in the signature proof');
+            throw new Error('credential must have coreClaim representation in proofs');
         }
         const nonce = coreClaim.getRevocationNonce();
         await issuerTree.revocationTree.add(nonce, BigInt(0));
@@ -394,16 +477,17 @@ export class IdentityWallet {
     }
     /** {@inheritDoc IIdentityWallet.generateIden3SparseMerkleTreeProof} */
     // treeState -  optional, if it is not passed proof of claim inclusion will be generated on the latest state in the tree.
-    async generateIden3SparseMerkleTreeProof(issuerDID, credentials, txId, blockNumber, blockTimestamp, treeState) {
+    async generateIden3SparseMerkleTreeProof(issuerDID, credentials, txId, blockNumber, blockTimestamp, treeState, opts) {
         for (let index = 0; index < credentials.length; index++) {
             const credential = credentials[index];
-            const mtpWithProof = await this.generateCredentialMtp(issuerDID, credential, treeState);
             // TODO: return coreClaim from generateCredentialMtp and use it below
             // credential must have a bjj signature proof
-            const coreClaim = credential.getCoreClaimFromProof(ProofType.BJJSignature);
+            const coreClaim = credential.getCoreClaimFromProof(ProofType.BJJSignature) ||
+                (await credential.toCoreClaim(opts));
             if (!coreClaim) {
                 throw new Error('credential must have coreClaim representation in the signature proof');
             }
+            const mtpWithProof = await this.generateCoreClaimMtp(issuerDID, coreClaim, treeState);
             const mtpProof = new Iden3SparseMerkleTreeProof({
                 mtp: mtpWithProof.proof,
                 issuerData: {
@@ -424,7 +508,9 @@ export class IdentityWallet {
                 credentials[index].proof.push(mtpProof);
             }
             else {
-                credentials[index].proof = [credentials[index].proof, mtpProof];
+                credentials[index].proof = credentials[index].proof
+                    ? [credentials[index].proof, mtpProof]
+                    : [mtpProof];
             }
         }
         return credentials;
@@ -513,4 +599,103 @@ export class IdentityWallet {
             isStateGenesis: false
         });
     }
+    /** {@inheritdoc IIdentityWallet.transitState} */
+    async transitState(did, oldTreeState, isOldStateGenesis, ethSigner, prover) {
+        const newTreeModel = await this.getDIDTreeModel(did);
+        const claimsRoot = await newTreeModel.claimsTree.root();
+        const rootOfRoots = await newTreeModel.rootsTree.root();
+        const revocationRoot = await newTreeModel.revocationTree.root();
+        const newTreeState = {
+            revocationRoot,
+            claimsRoot,
+            state: newTreeModel.state,
+            rootOfRoots
+        };
+        const userId = DID.idFromDID(did);
+        let proof;
+        const isEthIdentity = isEthereumIdentity(did); // don't generate proof for ethereum identities
+        let txId;
+        if (!isEthIdentity) {
+            if (!prover) {
+                throw new Error('prover is required to generate proofs for non ethereum identities');
+            }
+            // generate the proof
+            const authInfo = await this._inputsGenerator.prepareAuthBJJCredential(did, oldTreeState);
+            const challenge = Poseidon.hash([oldTreeState.state.bigInt(), newTreeState.state.bigInt()]);
+            const signature = await this.signChallenge(challenge, authInfo.credential);
+            const circuitInputs = new StateTransitionInputs();
+            circuitInputs.id = userId;
+            circuitInputs.signature = signature;
+            circuitInputs.isOldStateGenesis = isOldStateGenesis;
+            const authClaimIncProofNewState = await this.generateCredentialMtp(did, authInfo.credential, newTreeState);
+            circuitInputs.newTreeState = authClaimIncProofNewState.treeState;
+            circuitInputs.authClaimNewStateIncProof = authClaimIncProofNewState.proof;
+            circuitInputs.oldTreeState = oldTreeState;
+            circuitInputs.authClaim = {
+                claim: authInfo.coreClaim,
+                incProof: authInfo.incProof,
+                nonRevProof: authInfo.nonRevProof
+            };
+            const inputs = circuitInputs.inputsMarshal();
+            proof = await prover.generate(inputs, CircuitId.StateTransition);
+            txId = await this._storage.states.publishState(proof, ethSigner);
+        }
+        else {
+            const oldUserState = oldTreeState.state;
+            const newUserState = newTreeState.state;
+            const userStateTransitionInfo = {
+                userId,
+                oldUserState,
+                newUserState,
+                isOldStateGenesis,
+                methodId: BigInt(1),
+                methodParams: '0x'
+            };
+            txId = await this._storage.states.publishStateGeneric(ethSigner, userStateTransitionInfo);
+        }
+        await this.updateIdentityState(did, true, newTreeState);
+        return txId;
+    }
+    /** {@inheritdoc IIdentityWallet.addBJJAuthCredential} */
+    async addBJJAuthCredential(did, oldTreeState, isOldStateGenesis, ethSigner, opts, prover // it will be needed in case of non ethereum identities
+    ) {
+        opts.seed = opts.seed ?? getRandomBytes(32);
+        opts.revocationOpts.nonce =
+            opts.revocationOpts.nonce ??
+                (isOldStateGenesis
+                    ? 0
+                    : opts.revocationOpts.nonce ?? new DataView(getRandomBytes(12).buffer).getUint32(0));
+        const { authClaim, pubKey } = await this.createAuthCoreClaim(opts.revocationOpts.nonce ?? 0, opts.seed);
+        const { hi, hv } = authClaim.hiHv();
+        await this._storage.mt.addToMerkleTree(did.string(), MerkleTreeType.Claims, hi, hv);
+        // Calculate current state after adding credential to merkle tree
+        const claimsTree = await this._storage.mt.getMerkleTreeByIdentifierAndType(did.string(), MerkleTreeType.Claims);
+        const currentState = hashElems([
+            (await claimsTree.root()).bigInt(),
+            oldTreeState.revocationRoot.bigInt(),
+            oldTreeState.rootOfRoots.bigInt()
+        ]);
+        let credential = await this.createAuthBJJCredential(did, pubKey, authClaim, currentState, opts.revocationOpts);
+        const txId = await this.transitState(did, oldTreeState, isOldStateGenesis, ethSigner, prover);
+        const { receipt, block } = await this._transactionService.getTransactionReceiptAndBlock(txId);
+        const credsWithIden3MTPProof = await this.generateIden3SparseMerkleTreeProof(did, [credential], txId, receipt?.blockNumber, block?.timestamp, undefined, {
+            revNonce: Number(authClaim.getRevocationNonce()),
+            subjectPosition: SubjectPosition.None,
+            merklizedRootPosition: MerklizedRootPosition.None,
+            updatable: false,
+            version: 0,
+            merklizeOpts: { documentLoader: cacheLoader() }
+        });
+        await this._credentialWallet.saveAll(credsWithIden3MTPProof);
+        const credRefreshed = await this._credentialWallet.findById(credential.id);
+        if (!credRefreshed) {
+            throw new Error('Credential not found in credential wallet');
+        }
+        credential = credRefreshed;
+        await this.publishRevocationInfoByCredentialStatusType(did, opts.revocationOpts.type, {
+            rhsUrl: opts.revocationOpts.id,
+            onChain: opts.revocationOpts.onChain
+        });
+        return credential;
+    }
 }

package/dist/node/esm/index.js

@@ -9,6 +9,7 @@ export * from './iden3comm';
 export * from './circuits';
 export * from './iden3comm';
 export * from './utils';
+export * from './blockchain';
 import * as core from '@iden3/js-iden3-core';
 import * as jsonLDMerklizer from '@iden3/js-jsonld-merklization';
 export { core };

package/dist/node/esm/kms/key-providers/bjj-provider.js

@@ -1,6 +1,8 @@
-import { Hex, PrivateKey } from '@iden3/js-crypto';
+import { Hex, PrivateKey, PublicKey, Signature } from '@iden3/js-crypto';
 import { BytesHelper, checkBigIntInField } from '@iden3/js-iden3-core';
+import { KmsKeyType } from '../store';
 import * as providerHelpers from '../provider-helpers';
+import { hexToBytes } from '../../utils';
 /**
  * Provider for Baby Jub Jub keys
  * @public
@@ -14,6 +16,9 @@ export class BjjProvider {
      * @param {AbstractPrivateKeyStore} keyStore - key store for kms
      */
     constructor(keyType, keyStore) {
+        if (keyType !== KmsKeyType.BabyJubJub) {
+            throw new Error('Key type must be BabyJubJub');
+        }
         this.keyType = keyType;
         this.keyStore = keyStore;
     }
@@ -68,4 +73,8 @@ export class BjjProvider {
         const privateKeyHex = await this.keyStore.get({ alias: keyId.id });
         return new PrivateKey(Hex.decodeString(privateKeyHex));
     }
+    async verify(message, signatureHex, keyId) {
+        const publicKey = await this.publicKey(keyId);
+        return PublicKey.newFromCompressed(hexToBytes(publicKey)).verifyPoseidon(BytesHelper.bytesToInt(message), Signature.newFromCompressed(hexToBytes(signatureHex)));
+    }
 }

package/dist/node/esm/kms/key-providers/ed25519-provider.js

@@ -1,6 +1,7 @@
 import * as providerHelpers from '../provider-helpers';
 import { ed25519 } from '@noble/curves/ed25519';
 import { bytesToHex } from '../../utils';
+import { sha256 } from '@iden3/js-crypto';
 /**
  * Provider for Ed25519 keys
  * @public
@@ -56,7 +57,18 @@ export class Ed25519Provider {
      */
     async sign(keyId, data) {
         const privateKeyHex = await this.privateKey(keyId);
-        return ed25519.sign(data, privateKeyHex);
+        return ed25519.sign(sha256(data), privateKeyHex);
+    }
+    /**
+     * Verifies a signature for the given message and key identifier.
+     * @param message - The message to verify the signature against.
+     * @param signatureHex - The signature to verify, as a hexadecimal string.
+     * @param keyId - The key identifier to use for verification.
+     * @returns A Promise that resolves to a boolean indicating whether the signature is valid.
+     */
+    async verify(message, signatureHex, keyId) {
+        const publicKeyHex = await this.publicKey(keyId);
+        return ed25519.verify(signatureHex, sha256(message), publicKeyHex);
     }
     /**
      * Retrieves the private key for a given keyId from the key store.

package/dist/node/esm/kms/key-providers/index.js

@@ -1,3 +1,3 @@
 export * from './bjj-provider';
 export * from './ed25519-provider';
-export * from './sec256k1-provider';
+export * from './secp256k1-provider';

package/dist/node/esm/kms/key-providers/secp256k1-provider.js

@@ -0,0 +1,85 @@
+import { KmsKeyType } from '../store';
+import * as providerHelpers from '../provider-helpers';
+import { base64UrlToBytes, bytesToHex } from '../../utils';
+import { secp256k1 } from '@noble/curves/secp256k1';
+import { sha256 } from '@iden3/js-crypto';
+import { ES256KSigner, hexToBytes } from 'did-jwt';
+/**
+ * Provider for Secp256k1
+ * @public
+ * @class Secp256k1Provider
+ * @implements implements IKeyProvider interface
+ */
+export class Sec256k1Provider {
+    /**
+     * Creates an instance of BjjProvider.
+     * @param {KmsKeyType} keyType - kms key type
+     * @param {AbstractPrivateKeyStore} keyStore - key store for kms
+     */
+    constructor(keyType, keyStore) {
+        if (keyType !== KmsKeyType.Secp256k1) {
+            throw new Error('Key type must be Secp256k1');
+        }
+        this.keyType = keyType;
+        this._keyStore = keyStore;
+    }
+    /**
+     * generates a baby jub jub key from a seed phrase
+     * @param {Uint8Array} seed - byte array seed
+     * @returns kms key identifier
+     */
+    async newPrivateKeyFromSeed(seed) {
+        if (seed.length !== 32) {
+            throw new Error('Seed should be 32 bytes');
+        }
+        const publicKey = secp256k1.getPublicKey(seed);
+        const kmsId = {
+            type: this.keyType,
+            id: providerHelpers.keyPath(this.keyType, bytesToHex(publicKey))
+        };
+        await this._keyStore.importKey({
+            alias: kmsId.id,
+            key: bytesToHex(seed).padStart(64, '0')
+        });
+        return kmsId;
+    }
+    /**
+     * Gets public key by kmsKeyId
+     *
+     * @param {KmsKeyId} keyId - key identifier
+     */
+    async publicKey(keyId) {
+        const privateKeyHex = await this.privateKey(keyId);
+        const publicKey = secp256k1.getPublicKey(privateKeyHex, false); // 04 + x + y (uncompressed key)
+        return bytesToHex(publicKey);
+    }
+    /**
+     * Signs the given data using the private key associated with the specified key identifier.
+     * @param keyId - The key identifier to use for signing.
+     * @param data - The data to sign.
+     * @param opts - Signing options, such as the algorithm to use.
+     * @returns A Promise that resolves to the signature as a Uint8Array.
+     */
+    async sign(keyId, data, opts = { alg: 'ES256K' }) {
+        const privateKeyHex = await this.privateKey(keyId);
+        const signatureBase64 = await ES256KSigner(hexToBytes(privateKeyHex), opts.alg === 'ES256K-R')(data);
+        if (typeof signatureBase64 !== 'string') {
+            throw new Error('signatureBase64 must be a string');
+        }
+        return base64UrlToBytes(signatureBase64);
+    }
+    /**
+     * Verifies a signature for the given message and key identifier.
+     * @param message - The message to verify the signature against.
+     * @param signatureHex - The signature to verify, as a hexadecimal string.
+     * @param keyId - The key identifier to use for verification.
+     * @returns A Promise that resolves to a boolean indicating whether the signature is valid.
+     */
+    async verify(message, signatureHex, keyId) {
+        const publicKeyHex = await this.publicKey(keyId);
+        return secp256k1.verify(signatureHex, sha256(message), publicKeyHex);
+    }
+    async privateKey(keyId) {
+        return this._keyStore.get({ alias: keyId.id });
+    }
+}

package/dist/node/esm/kms/kms.js

@@ -62,4 +62,19 @@ export class KMS {
         }
         return keyProvider.sign(keyId, data, opts);
     }
+    /**
+     * Verifies a signature against the provided data and key ID.
+     *
+     * @param data - The data to verify the signature against.
+     * @param signatureHex - The signature to verify, in hexadecimal format.
+     * @param keyId - The key ID to use for verification.
+     * @returns A promise that resolves to a boolean indicating whether the signature is valid.
+     */
+    verify(data, signatureHex, keyId) {
+        const keyProvider = this._registry.get(keyId.type);
+        if (!keyProvider) {
+            throw new Error(`keyProvider not found for: ${keyId.type}`);
+        }
+        return keyProvider.verify(data, signatureHex, keyId);
+    }
 }