@bsv/sdk 1.3.10 → 1.3.12

package/docs/auth.md

@@ -212,21 +212,21 @@ export default class Certificate {
     subject: PubKeyHex;
     certifier: PubKeyHex;
     revocationOutpoint: OutpointString;
-    fields: Record<CertificateFieldNameUnder50Bytes, string>;
+    fields: Record<CertificateFieldNameUnder50Bytes, Base64String>;
     signature?: HexString;
     constructor(type: Base64String, serialNumber: Base64String, subject: PubKeyHex, certifier: PubKeyHex, revocationOutpoint: OutpointString, fields: Record<CertificateFieldNameUnder50Bytes, string>, signature?: HexString) 
     toBinary(includeSignature: boolean = true): number[] 
     static fromBinary(bin: number[]): Certificate 
     async verify(): Promise<boolean> 
-    async sign(certifierWallet: WalletInterface): Promise<void> 
-    static getCertificateFieldEncryptionDetails(serialNumber: string, fieldName: string): {
+    async sign(certifierWallet: ProtoWallet): Promise<void> 
+    static getCertificateFieldEncryptionDetails(fieldName: string, serialNumber?: string): {
         protocolID: WalletProtocol;
         keyID: string;
     } 
 }
 ```
 
-See also: [Base64String](#type-base64string), [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes), [HexString](#type-hexstring), [OutpointString](#type-outpointstring), [PubKeyHex](#type-pubkeyhex), [WalletInterface](#interface-walletinterface), [WalletProtocol](#type-walletprotocol), [sign](#variable-sign), [verify](#variable-verify)
+See also: [Base64String](#type-base64string), [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes), [HexString](#type-hexstring), [OutpointString](#type-outpointstring), [ProtoWallet](#class-protowallet), [PubKeyHex](#type-pubkeyhex), [WalletProtocol](#type-walletprotocol), [sign](#variable-sign), [verify](#variable-verify)
 
 <details>
 
@@ -269,12 +269,12 @@ See also: [PubKeyHex](#type-pubkeyhex)
 
 #### Property fields
 
-All the fields present in the certificate, with field names as keys and field values as strings.
+All the fields present in the certificate, with field names as keys and encrypted field values as Base64 strings.
 
 ```ts
-fields: Record<CertificateFieldNameUnder50Bytes, string>
+fields: Record<CertificateFieldNameUnder50Bytes, Base64String>
 ```
-See also: [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes)
+See also: [Base64String](#type-base64string), [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes)
 
 #### Property revocationOutpoint
 
@@ -344,7 +344,7 @@ Argument Details
 Helper function which retrieves the protocol ID and key ID for certificate field encryption.
 
 ```ts
-static getCertificateFieldEncryptionDetails(serialNumber: string, fieldName: string): {
+static getCertificateFieldEncryptionDetails(fieldName: string, serialNumber?: string): {
     protocolID: WalletProtocol;
     keyID: string;
 } 
@@ -369,9 +369,9 @@ Argument Details
 Signs the certificate using the provided certifier wallet.
 
 ```ts
-async sign(certifierWallet: WalletInterface): Promise<void> 
+async sign(certifierWallet: ProtoWallet): Promise<void> 
 ```
-See also: [WalletInterface](#interface-walletinterface)
+See also: [ProtoWallet](#class-protowallet)
 
 Argument Details
 
@@ -466,18 +466,51 @@ export class MasterCertificate extends Certificate {
     declare signature?: HexString;
     masterKeyring: Record<CertificateFieldNameUnder50Bytes, Base64String>;
     constructor(type: Base64String, serialNumber: Base64String, subject: PubKeyHex, certifier: PubKeyHex, revocationOutpoint: OutpointString, fields: Record<CertificateFieldNameUnder50Bytes, Base64String>, masterKeyring: Record<CertificateFieldNameUnder50Bytes, Base64String>, signature?: HexString) 
-    async decryptFields(subjectWallet: WalletInterface): Promise<Record<CertificateFieldNameUnder50Bytes, string>> 
-    async createKeyringForVerifier(subjectWallet: WalletInterface, verifier: WalletCounterparty, fieldsToReveal: string[], originator?: string): Promise<Record<CertificateFieldNameUnder50Bytes, string>> 
-    static async issueCertificateForSubject(certifierWallet: WalletInterface, subject: WalletCounterparty, fields: Record<CertificateFieldNameUnder50Bytes, string>, certificateType: string, getRevocationOutpoint = async (serialNumber: string): Promise<string> => { return "Certificate revocation not tracked."; }): Promise<MasterCertificate> 
+    static async createCertificateFields(creatorWallet: ProtoWallet, certifierOrSubject: WalletCounterparty, fields: Record<CertificateFieldNameUnder50Bytes, string>, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<CreateCertificateFieldsResult> 
+    static async createKeyringForVerifier(subjectWallet: ProtoWallet, certifier: WalletCounterparty, verifier: WalletCounterparty, fields: Record<CertificateFieldNameUnder50Bytes, Base64String>, fieldsToReveal: string[], masterKeyring: Record<CertificateFieldNameUnder50Bytes, Base64String>, serialNumber: Base64String, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<Record<CertificateFieldNameUnder50Bytes, string>> 
+    static async issueCertificateForSubject(certifierWallet: ProtoWallet, subject: WalletCounterparty, fields: Record<CertificateFieldNameUnder50Bytes, string>, certificateType: string, getRevocationOutpoint = async (serialNumber: string): Promise<string> => { return "Certificate revocation not tracked."; }, serialNumber?: string): Promise<MasterCertificate> 
+    static async decryptFields(subjectOrCertifierWallet: ProtoWallet, masterKeyring: Record<CertificateFieldNameUnder50Bytes, Base64String>, fields: Record<CertificateFieldNameUnder50Bytes, Base64String>, counterparty: WalletCounterparty): Promise<Record<CertificateFieldNameUnder50Bytes, string>> 
+    static async decryptField(subjectOrCertifierWallet: ProtoWallet, masterKeyring: Record<CertificateFieldNameUnder50Bytes, Base64String>, fieldName: Base64String, fieldValue: Base64String, counterparty: WalletCounterparty, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<{
+        fieldRevelationKey: number[];
+        decryptedFieldValue: string;
+    }> 
 }
 ```
 
-See also: [Base64String](#type-base64string), [Certificate](#class-certificate), [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes), [HexString](#type-hexstring), [OutpointString](#type-outpointstring), [PubKeyHex](#type-pubkeyhex), [WalletCounterparty](#type-walletcounterparty), [WalletInterface](#interface-walletinterface)
+See also: [Base64String](#type-base64string), [Certificate](#class-certificate), [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes), [HexString](#type-hexstring), [OriginatorDomainNameStringUnder250Bytes](#type-originatordomainnamestringunder250bytes), [OutpointString](#type-outpointstring), [ProtoWallet](#class-protowallet), [PubKeyHex](#type-pubkeyhex), [WalletCounterparty](#type-walletcounterparty)
 
 <details>
 
 <summary>Class MasterCertificate Details</summary>
 
+#### Method createCertificateFields
+
+Encrypts certificate fields for a subject and generates a master keyring.
+This method returns a master keyring tied to a specific certifier or subject who will validate
+and sign off on the fields, along with the encrypted certificate fields.
+
+```ts
+static async createCertificateFields(creatorWallet: ProtoWallet, certifierOrSubject: WalletCounterparty, fields: Record<CertificateFieldNameUnder50Bytes, string>, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<CreateCertificateFieldsResult> 
+```
+See also: [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes), [OriginatorDomainNameStringUnder250Bytes](#type-originatordomainnamestringunder250bytes), [ProtoWallet](#class-protowallet), [WalletCounterparty](#type-walletcounterparty)
+
+Returns
+
+A promise resolving to an object containing:
+- `certificateFields` {Record<CertificateFieldNameUnder50Bytes, Base64String>}:
+The encrypted certificate fields.
+- `masterKeyring` {Record<CertificateFieldNameUnder50Bytes, Base64String>}:
+The master keyring containing encrypted revelation keys for each field.
+
+Argument Details
+
++ **creatorWallet**
+  + The wallet of the creator responsible for encrypting the fields.
++ **certifierOrSubject**
+  + The certifier or subject who will validate the certificate fields.
++ **fields**
+  + A record of certificate field names (under 50 bytes) mapped to their values.
+
 #### Method createKeyringForVerifier
 
 Creates a keyring for a verifier, enabling them to decrypt specific certificate fields.
@@ -486,9 +519,9 @@ for the verifier's identity key. The result is a keyring containing the keys nec
 for the verifier to access the designated fields.
 
 ```ts
-async createKeyringForVerifier(subjectWallet: WalletInterface, verifier: WalletCounterparty, fieldsToReveal: string[], originator?: string): Promise<Record<CertificateFieldNameUnder50Bytes, string>> 
+static async createKeyringForVerifier(subjectWallet: ProtoWallet, certifier: WalletCounterparty, verifier: WalletCounterparty, fields: Record<CertificateFieldNameUnder50Bytes, Base64String>, fieldsToReveal: string[], masterKeyring: Record<CertificateFieldNameUnder50Bytes, Base64String>, serialNumber: Base64String, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<Record<CertificateFieldNameUnder50Bytes, string>> 
 ```
-See also: [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes), [WalletCounterparty](#type-walletcounterparty), [WalletInterface](#interface-walletinterface)
+See also: [Base64String](#type-base64string), [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes), [OriginatorDomainNameStringUnder250Bytes](#type-originatordomainnamestringunder250bytes), [ProtoWallet](#class-protowallet), [WalletCounterparty](#type-walletcounterparty)
 
 Returns
 
@@ -514,24 +547,33 @@ Throws an error if:
 
 #### Method decryptFields
 
-Decrypts all fields in the MasterCertificate using the subject's wallet.
+Decrypts all fields in the MasterCertificate using the subject's or certifier's wallet.
 
-This method uses the `masterKeyring` to decrypt each field's encryption key and then
-decrypts the field values. The result is a record of plaintext field names and values.
+This method allows the subject or certifier to decrypt the `masterKeyring` and retrieve
+the encryption keys for each field, which are then used to decrypt the corresponding field values.
+The counterparty used for decryption depends on how the certificate fields were created:
+- If the certificate is self-signed, the counterparty should be set to 'self'.
+- Otherwise, the counterparty should always be the other party involved in the certificate issuance process (the subject or certifier).
 
 ```ts
-async decryptFields(subjectWallet: WalletInterface): Promise<Record<CertificateFieldNameUnder50Bytes, string>> 
+static async decryptFields(subjectOrCertifierWallet: ProtoWallet, masterKeyring: Record<CertificateFieldNameUnder50Bytes, Base64String>, fields: Record<CertificateFieldNameUnder50Bytes, Base64String>, counterparty: WalletCounterparty): Promise<Record<CertificateFieldNameUnder50Bytes, string>> 
 ```
-See also: [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes), [WalletInterface](#interface-walletinterface)
+See also: [Base64String](#type-base64string), [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes), [ProtoWallet](#class-protowallet), [WalletCounterparty](#type-walletcounterparty)
 
 Returns
 
-- A record of field names and their decrypted values in plaintext.
+A promise resolving to a record of field names and their decrypted values in plaintext.
 
 Argument Details
 
-+ **subjectWallet**
-  + The wallet of the subject, used to decrypt the master keyring and field values.
++ **subjectOrCertifierWallet**
+  + The wallet of the subject or certifier, used to decrypt the master keyring and field values.
++ **masterKeyring**
+  + A record containing encrypted keys for each field.
++ **fields**
+  + A record of encrypted field names and their values.
++ **counterparty**
+  + The counterparty responsible for creating or signing the certificate. For self-signed certificates, use 'self'.
 
 Throws
 
@@ -547,9 +589,9 @@ generated symmetric key, which is then encrypted for the subject. The certificat
 can also includes a revocation outpoint to manage potential revocation.
 
 ```ts
-static async issueCertificateForSubject(certifierWallet: WalletInterface, subject: WalletCounterparty, fields: Record<CertificateFieldNameUnder50Bytes, string>, certificateType: string, getRevocationOutpoint = async (serialNumber: string): Promise<string> => { return "Certificate revocation not tracked."; }): Promise<MasterCertificate> 
+static async issueCertificateForSubject(certifierWallet: ProtoWallet, subject: WalletCounterparty, fields: Record<CertificateFieldNameUnder50Bytes, string>, certificateType: string, getRevocationOutpoint = async (serialNumber: string): Promise<string> => { return "Certificate revocation not tracked."; }, serialNumber?: string): Promise<MasterCertificate> 
 ```
-See also: [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes), [MasterCertificate](#class-mastercertificate), [WalletCounterparty](#type-walletcounterparty), [WalletInterface](#interface-walletinterface)
+See also: [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes), [MasterCertificate](#class-mastercertificate), [ProtoWallet](#class-protowallet), [WalletCounterparty](#type-walletcounterparty)
 
 Returns
 
@@ -1078,12 +1120,12 @@ export class VerifiableCertificate extends Certificate {
     declare signature?: HexString;
     keyring: Record<CertificateFieldNameUnder50Bytes, string>;
     decryptedFields?: Record<CertificateFieldNameUnder50Bytes, Base64String>;
-    constructor(type: Base64String, serialNumber: Base64String, subject: PubKeyHex, certifier: PubKeyHex, revocationOutpoint: OutpointString, fields: Record<CertificateFieldNameUnder50Bytes, string>, signature?: HexString, keyring?: Record<CertificateFieldNameUnder50Bytes, string>, decryptedFields?: Record<CertificateFieldNameUnder50Bytes, Base64String>) 
-    async decryptFields(verifierWallet: WalletInterface): Promise<Record<CertificateFieldNameUnder50Bytes, string>> 
+    constructor(type: Base64String, serialNumber: Base64String, subject: PubKeyHex, certifier: PubKeyHex, revocationOutpoint: OutpointString, fields: Record<CertificateFieldNameUnder50Bytes, string>, keyring: Record<CertificateFieldNameUnder50Bytes, string>, signature?: HexString, decryptedFields?: Record<CertificateFieldNameUnder50Bytes, Base64String>) 
+    async decryptFields(verifierWallet: ProtoWallet): Promise<Record<CertificateFieldNameUnder50Bytes, string>> 
 }
 ```
 
-See also: [Base64String](#type-base64string), [Certificate](#class-certificate), [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes), [HexString](#type-hexstring), [OutpointString](#type-outpointstring), [PubKeyHex](#type-pubkeyhex), [WalletInterface](#interface-walletinterface)
+See also: [Base64String](#type-base64string), [Certificate](#class-certificate), [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes), [HexString](#type-hexstring), [OutpointString](#type-outpointstring), [ProtoWallet](#class-protowallet), [PubKeyHex](#type-pubkeyhex)
 
 <details>
 
@@ -1094,9 +1136,9 @@ See also: [Base64String](#type-base64string), [Certificate](#class-certificate),
 Decrypts selectively revealed certificate fields using the provided keyring and verifier wallet
 
 ```ts
-async decryptFields(verifierWallet: WalletInterface): Promise<Record<CertificateFieldNameUnder50Bytes, string>> 
+async decryptFields(verifierWallet: ProtoWallet): Promise<Record<CertificateFieldNameUnder50Bytes, string>> 
 ```
-See also: [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes), [WalletInterface](#interface-walletinterface)
+See also: [CertificateFieldNameUnder50Bytes](#type-certificatefieldnameunder50bytes), [ProtoWallet](#class-protowallet)
 
 Returns
 
@@ -1214,7 +1256,7 @@ getVerifiableCertificates = async (wallet: WalletInterface, requestedCertificate
             fieldsToReveal: requestedCertificates.types[certificate.type],
             verifier: verifierIdentityKey
         });
-        return new VerifiableCertificate(certificate.type, certificate.serialNumber, certificate.subject, certificate.certifier, certificate.revocationOutpoint, certificate.fields, certificate.signature, keyringForVerifier);
+        return new VerifiableCertificate(certificate.type, certificate.serialNumber, certificate.subject, certificate.certifier, certificate.revocationOutpoint, certificate.fields, keyringForVerifier, certificate.signature);
     }));
 }
 ```
@@ -1232,7 +1274,7 @@ validateCertificates = async (verifierWallet: WalletInterface, message: AuthMess
         if (incomingCert.subject !== message.identityKey) {
             throw new Error(`The subject of one of your certificates ("${incomingCert.subject}") is not the same as the request sender ("${message.identityKey}").`);
         }
-        const certToVerify = new VerifiableCertificate(incomingCert.type, incomingCert.serialNumber, incomingCert.subject, incomingCert.certifier, incomingCert.revocationOutpoint, incomingCert.fields, incomingCert.signature, incomingCert.keyring);
+        const certToVerify = new VerifiableCertificate(incomingCert.type, incomingCert.serialNumber, incomingCert.subject, incomingCert.certifier, incomingCert.revocationOutpoint, incomingCert.fields, incomingCert.keyring, incomingCert.signature);
         const isValidCert = await certToVerify.verify();
         if (!isValidCert) {
             throw new Error(`The signature for the certificate with serial number ${certToVerify.serialNumber} is invalid!`);

package/docs/wallet.md

@@ -2115,23 +2115,23 @@ enable the management of identity certificates, or store any data. It is also no
 
 ```ts
 export class ProtoWallet {
-    keyDeriver: KeyDeriverApi;
-    constructor(rootKeyOrKeyDeriver: PrivateKey | "anyone" | KeyDeriverApi) 
-    async getPublicKey(args: GetPublicKeyArgs): Promise<{
+    keyDeriver?: KeyDeriverApi;
+    constructor(rootKeyOrKeyDeriver?: PrivateKey | "anyone" | KeyDeriverApi) 
+    async getPublicKey(args: GetPublicKeyArgs, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<{
         publicKey: PubKeyHex;
     }> 
-    async revealCounterpartyKeyLinkage(args: RevealCounterpartyKeyLinkageArgs): Promise<RevealCounterpartyKeyLinkageResult> 
-    async revealSpecificKeyLinkage(args: RevealSpecificKeyLinkageArgs): Promise<RevealSpecificKeyLinkageResult> 
-    async encrypt(args: WalletEncryptArgs): Promise<WalletEncryptResult> 
-    async decrypt(args: WalletDecryptArgs): Promise<WalletDecryptResult> 
-    async createHmac(args: CreateHmacArgs): Promise<CreateHmacResult> 
-    async verifyHmac(args: VerifyHmacArgs): Promise<VerifyHmacResult> 
-    async createSignature(args: CreateSignatureArgs): Promise<CreateSignatureResult> 
-    async verifySignature(args: VerifySignatureArgs): Promise<VerifySignatureResult> 
+    async revealCounterpartyKeyLinkage(args: RevealCounterpartyKeyLinkageArgs, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<RevealCounterpartyKeyLinkageResult> 
+    async revealSpecificKeyLinkage(args: RevealSpecificKeyLinkageArgs, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<RevealSpecificKeyLinkageResult> 
+    async encrypt(args: WalletEncryptArgs, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<WalletEncryptResult> 
+    async decrypt(args: WalletDecryptArgs, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<WalletDecryptResult> 
+    async createHmac(args: CreateHmacArgs, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<CreateHmacResult> 
+    async verifyHmac(args: VerifyHmacArgs, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<VerifyHmacResult> 
+    async createSignature(args: CreateSignatureArgs, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<CreateSignatureResult> 
+    async verifySignature(args: VerifySignatureArgs, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<VerifySignatureResult> 
 }
 ```
 
-See also: [CreateHmacArgs](#interface-createhmacargs), [CreateHmacResult](#interface-createhmacresult), [CreateSignatureArgs](#interface-createsignatureargs), [CreateSignatureResult](#interface-createsignatureresult), [GetPublicKeyArgs](#interface-getpublickeyargs), [KeyDeriverApi](#interface-keyderiverapi), [PrivateKey](#class-privatekey), [PubKeyHex](#type-pubkeyhex), [RevealCounterpartyKeyLinkageArgs](#interface-revealcounterpartykeylinkageargs), [RevealCounterpartyKeyLinkageResult](#interface-revealcounterpartykeylinkageresult), [RevealSpecificKeyLinkageArgs](#interface-revealspecifickeylinkageargs), [RevealSpecificKeyLinkageResult](#interface-revealspecifickeylinkageresult), [VerifyHmacArgs](#interface-verifyhmacargs), [VerifyHmacResult](#interface-verifyhmacresult), [VerifySignatureArgs](#interface-verifysignatureargs), [VerifySignatureResult](#interface-verifysignatureresult), [WalletDecryptArgs](#interface-walletdecryptargs), [WalletDecryptResult](#interface-walletdecryptresult), [WalletEncryptArgs](#interface-walletencryptargs), [WalletEncryptResult](#interface-walletencryptresult), [decrypt](#variable-decrypt), [encrypt](#variable-encrypt)
+See also: [CreateHmacArgs](#interface-createhmacargs), [CreateHmacResult](#interface-createhmacresult), [CreateSignatureArgs](#interface-createsignatureargs), [CreateSignatureResult](#interface-createsignatureresult), [GetPublicKeyArgs](#interface-getpublickeyargs), [KeyDeriverApi](#interface-keyderiverapi), [OriginatorDomainNameStringUnder250Bytes](#type-originatordomainnamestringunder250bytes), [PrivateKey](#class-privatekey), [PubKeyHex](#type-pubkeyhex), [RevealCounterpartyKeyLinkageArgs](#interface-revealcounterpartykeylinkageargs), [RevealCounterpartyKeyLinkageResult](#interface-revealcounterpartykeylinkageresult), [RevealSpecificKeyLinkageArgs](#interface-revealspecifickeylinkageargs), [RevealSpecificKeyLinkageResult](#interface-revealspecifickeylinkageresult), [VerifyHmacArgs](#interface-verifyhmacargs), [VerifyHmacResult](#interface-verifyhmacresult), [VerifySignatureArgs](#interface-verifysignatureargs), [VerifySignatureResult](#interface-verifysignatureresult), [WalletDecryptArgs](#interface-walletdecryptargs), [WalletDecryptResult](#interface-walletdecryptresult), [WalletEncryptArgs](#interface-walletencryptargs), [WalletEncryptResult](#interface-walletencryptresult), [decrypt](#variable-decrypt), [encrypt](#variable-encrypt)
 
 Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Enums](#enums), [Variables](#variables)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bsv/sdk",
-  "version": "1.3.10",
+  "version": "1.3.12",
   "type": "module",
   "description": "BSV Blockchain Software Development Kit",
   "main": "dist/cjs/mod.js",

package/src/auth/__tests/Peer.test.ts

@@ -7,44 +7,8 @@ import { Utils, PrivateKey, SymmetricKey } from '../../../dist/cjs/src/primitive
 import { VerifiableCertificate, } from "../../../dist/cjs/src/auth/certificates/VerifiableCertificate.js"
 import { MasterCertificate } from '../../../dist/cjs/src/auth/certificates/MasterCertificate.js'
 import { getVerifiableCertificates } from '../../../dist/cjs/src/auth/utils/getVerifiableCertificates.js'
-import { Certificate } from "../../../dist/cjs/src/auth/certificates/index.js"
 jest.mock('../../../dist/cjs/src/auth/utils/getVerifiableCertificates.js')
 
-/**
- * A helper function to decrypt a VerifiableCertificate's fields using the provided wallets.
- */
-async function decryptCertificateFields(
-  cert: VerifiableCertificate,
-  localWallet: Wallet,
-  counterpartyWallet: Wallet
-): Promise<Record<string, string>> {
-  const entries = await Promise.all(
-    Object.entries(cert.keyring).map(async ([fieldName, encryptedKey]) => {
-      // Decrypt the per-field symmetric key
-      const { plaintext: masterFieldKey } = await localWallet.decrypt({
-        ciphertext: Utils.toArray(encryptedKey, 'base64'),
-        ...Certificate.getCertificateFieldEncryptionDetails(cert.serialNumber, fieldName),
-        counterparty: (await counterpartyWallet.getPublicKey({ identityKey: true })).publicKey,
-      })
-
-      // Decrypt the actual field contents using the decrypted symmetric key
-      try {
-        const decryptedData = new SymmetricKey(masterFieldKey).decrypt(
-          Utils.toArray(cert.fields[fieldName], 'base64')
-        )
-        return { key: fieldName, value: Utils.toUTF8(decryptedData as number[]) }
-      } catch (_) {
-        throw new Error(`Decryption of the "${fieldName}" field with its revelation key failed.`)
-      }
-    })
-  )
-
-  return entries.reduce((acc, { key, value }) => {
-    acc[key] = value
-    return acc
-  }, {} as Record<string, string>)
-}
-
 class LocalTransport implements Transport {
   private peerTransport?: LocalTransport
   private onDataCallback?: (message: AuthMessage) => void
@@ -117,7 +81,15 @@ describe('Peer class mutual authentication and certificate exchange', () => {
   ): Promise<VerifiableCertificate> {
     const certifierWallet = new ProtoWallet(certifierPrivateKey)
 
-    const keyringForVerifier = await masterCertificate.createKeyringForVerifier(wallet, verifierIdentityKey, fieldsToReveal)
+    const keyringForVerifier = await MasterCertificate.createKeyringForVerifier(
+      wallet,
+      certifierWallet.keyDeriver.identityKey,
+      verifierIdentityKey,
+      masterCertificate.fields,
+      fieldsToReveal,
+      masterCertificate.masterKeyring,
+      masterCertificate.serialNumber
+    )
     return new VerifiableCertificate(
       masterCertificate.type,
       masterCertificate.serialNumber,
@@ -125,8 +97,8 @@ describe('Peer class mutual authentication and certificate exchange', () => {
       masterCertificate.certifier,
       masterCertificate.revocationOutpoint,
       masterCertificate.fields,
-      masterCertificate.signature,
-      keyringForVerifier
+      keyringForVerifier,
+      masterCertificate.signature
     )
   }
 
@@ -234,7 +206,7 @@ describe('Peer class mutual authentication and certificate exchange', () => {
         if (certificatesReceivedByBob?.length !== 0) {
           certificatesReceivedByBob?.forEach(async cert => {
             // Decrypt to ensure it has the correct fields
-            const decryptedFields = await decryptCertificateFields(cert, walletB, walletA)
+            const decryptedFields = await cert.decryptFields(walletB)
             if (cert.certifier !== 'bob') {
               console.log('Bob accepted the message:', Utils.toUTF8(payload))
               console.log('Decrypted fields:', decryptedFields)
@@ -279,7 +251,7 @@ describe('Peer class mutual authentication and certificate exchange', () => {
     alice.listenForCertificatesReceived(async (senderPublicKey, certificates) => {
       for (const cert of certificates) {
         // Decrypt Bob's certificate fields
-        const decryptedFields = await decryptCertificateFields(cert, walletA, walletB)
+        const decryptedFields = await cert.decryptFields(walletA)
 
         // Check and use the decrypted fields
         if (Object.keys(decryptedFields).length !== 0 && decryptedFields.libraryCardNumber) {
@@ -342,7 +314,7 @@ describe('Peer class mutual authentication and certificate exchange', () => {
         if (certificates.length > 0) {
           // Decrypt to confirm
           for (const cert of certificates) {
-            const decrypted = await decryptCertificateFields(cert, walletB, walletA)
+            const decrypted = await cert.decryptFields(walletB)
             console.log('Bob received additional certificates from Alice:', cert)
             console.log('Decrypted fields:', decrypted)
           }
@@ -384,7 +356,7 @@ describe('Peer class mutual authentication and certificate exchange', () => {
       bob.listenForCertificatesReceived(async (senderPublicKey, certificates) => {
         for (const cert of certificates) {
           // Decrypt Alice's certificate fields
-          const decryptedFields = await decryptCertificateFields(cert, walletB, walletA)
+          const decryptedFields = await cert.decryptFields(walletB)
           if (decryptedFields.membershipStatus) {
             console.log(`Bob received Alice's membership status: ${decryptedFields.membershipStatus}`)
             bobAcceptedMembershipStatus()
@@ -451,7 +423,7 @@ describe('Peer class mutual authentication and certificate exchange', () => {
     const waitForAliceToAcceptBobDL = new Promise<void>((resolve) => {
       alice.listenForCertificatesReceived(async (senderPublicKey, certificates) => {
         for (const cert of certificates) {
-          const decryptedFields = await decryptCertificateFields(cert, walletA, walletB)
+          const decryptedFields = await cert.decryptFields(walletA)
           if (decryptedFields.driversLicenseNumber) {
             console.log(`Alice received Bob's driver's license number: ${decryptedFields.driversLicenseNumber}`)
             aliceAcceptedBobDL()
@@ -464,7 +436,7 @@ describe('Peer class mutual authentication and certificate exchange', () => {
     const waitForBobToAcceptAliceDL = new Promise<void>((resolve) => {
       bob.listenForCertificatesReceived(async (senderPublicKey, certificates) => {
         for (const cert of certificates) {
-          const decryptedFields = await decryptCertificateFields(cert, walletB, walletA)
+          const decryptedFields = await cert.decryptFields(walletB)
           if (decryptedFields.driversLicenseNumber) {
             console.log(`Bob received Alice's driver's license number: ${decryptedFields.driversLicenseNumber}`)
             bobAcceptedAliceDL()
@@ -544,7 +516,7 @@ describe('Peer class mutual authentication and certificate exchange', () => {
     const waitForAlicePartialCert = new Promise<void>((resolve) => {
       alice.listenForCertificatesReceived(async (senderPublicKey, certificates) => {
         for (const cert of certificates) {
-          const decryptedFields = await decryptCertificateFields(cert, walletA, walletB)
+          const decryptedFields = await cert.decryptFields(walletA)
           if (decryptedFields.email || decryptedFields.name) {
             console.log(`Alice received Bob's certificate with fields: ${Object.keys(decryptedFields).join(', ')}`)
             aliceAcceptedPartialCert()
@@ -557,7 +529,7 @@ describe('Peer class mutual authentication and certificate exchange', () => {
     const waitForBobPartialCert = new Promise<void>((resolve) => {
       bob.listenForCertificatesReceived(async (senderPublicKey, certificates) => {
         for (const cert of certificates) {
-          const decryptedFields = await decryptCertificateFields(cert, walletB, walletA)
+          const decryptedFields = await cert.decryptFields(walletB)
           if (decryptedFields.email || decryptedFields.name) {
             console.log(`Bob received Alice's certificate with fields: ${Object.keys(decryptedFields).join(', ')}`)
             bobAcceptedPartialCert()

package/src/auth/certificates/Certificate.ts

@@ -5,7 +5,6 @@ import {
   HexString,
   OutpointString,
   CertificateFieldNameUnder50Bytes,
-  WalletInterface,
   Signature,
   WalletProtocol,
   ProtoWallet
@@ -43,9 +42,9 @@ export default class Certificate {
   revocationOutpoint: OutpointString
 
   /**
-   * All the fields present in the certificate, with field names as keys and field values as strings.
+   * All the fields present in the certificate, with field names as keys and encrypted field values as Base64 strings.
    */
-  fields: Record<CertificateFieldNameUnder50Bytes, string>
+  fields: Record<CertificateFieldNameUnder50Bytes, Base64String>
 
   /**
    * Certificate signature by the certifier's private key, DER encoded hex string.
@@ -232,7 +231,7 @@ export default class Certificate {
    * @param {Wallet} certifierWallet - The wallet representing the certifier.
    * @returns {Promise<void>}
    */
-  async sign(certifierWallet: WalletInterface): Promise<void> {
+  async sign(certifierWallet: ProtoWallet): Promise<void> {
     if (this.signature) {
       throw new Error(`Certificate has already been signed! Signature present: ${this.signature}`)
     }
@@ -258,7 +257,7 @@ export default class Certificate {
    *   - `protocolID` (WalletProtocol): The protocol ID for certificate field encryption.
    *   - `keyID` (string): A unique key identifier derived from the serial number and field name.
    */
-  static getCertificateFieldEncryptionDetails(serialNumber: string, fieldName: string): { protocolID: WalletProtocol, keyID: string } {
+  static getCertificateFieldEncryptionDetails(fieldName: string, serialNumber?: string): { protocolID: WalletProtocol, keyID: string } {
     return { protocolID: [2, 'certificate field encryption'], keyID: `${serialNumber} ${fieldName}` }
   }
 }