@coordination-network/credential 0.0.2 → 0.1.0

package/README.md

@@ -11,6 +11,7 @@ yarn add @coordination-network/credential
 ## Supported credential flow
 
 - `issueZkCredential` validates the holder bindings and signs the credential commitments.
+- `issuanceRequestCommitment` hashes the issuer and the approval scope into the value the wallet's device signature covers; `issueZkCredential` recomputes it from its own id and the scope it signs.
 - `buildZkPresentationInputs` constructs private circuit inputs on the holder device.
 - `ZkCredentialProofSystem` creates and verifies the zero-knowledge presentation.
 - `ApprovedIssuerSet` and the revocation helpers provide the membership witnesses used by the circuit.

package/dist/credential-message.d.ts

@@ -1,9 +1,13 @@
-import { Jwk, SerializedZkCredential, ZkCredential, ZkCredentialBody } from "./types";
+import { ApprovalScope, Hex32, Jwk, SerializedZkCredential, ZkCredential, ZkCredentialBody } from "./types";
 export declare const CREDENTIAL_DOMAIN = 363566488821926773809509531830640889725124777157045803797738936823559174026n;
+export declare const ISSUANCE_REQUEST_DOMAIN = "urn:cn:issuance-request:v1";
+export declare const DEVICE_ATTESTATION_CHALLENGE = "urn:cn:device-attestation:v1";
 export declare const DEVICE_KEY_DOMAIN = 320507632879070882430325612169297945123468706597652794395401074724051126576n;
 export declare function stringToField(value: string): bigint;
 export declare function programmeHash(programme: string): bigint;
 export declare function countryCode(country: string): number;
+/** What the device signature commits to besides the holder key: the issuer and the scope shown at consent. */
+export declare function issuanceRequestCommitment(issuerNetworkId: Hex32, approvalScope: ApprovalScope): Uint8Array;
 export declare function deriveDeviceKeyCommitment(publicKey: Jwk): bigint;
 export declare function zkCredentialCommitment(body: ZkCredentialBody): bigint;
 export declare function serializeZkCredential(credential: ZkCredential): SerializedZkCredential;

package/dist/credential-message.js

@@ -1,9 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEVICE_KEY_DOMAIN = exports.CREDENTIAL_DOMAIN = void 0;
+exports.DEVICE_KEY_DOMAIN = exports.DEVICE_ATTESTATION_CHALLENGE = exports.ISSUANCE_REQUEST_DOMAIN = exports.CREDENTIAL_DOMAIN = void 0;
 exports.stringToField = stringToField;
 exports.programmeHash = programmeHash;
 exports.countryCode = countryCode;
+exports.issuanceRequestCommitment = issuanceRequestCommitment;
 exports.deriveDeviceKeyCommitment = deriveDeviceKeyCommitment;
 exports.zkCredentialCommitment = zkCredentialCommitment;
 exports.serializeZkCredential = serializeZkCredential;
@@ -18,6 +19,10 @@ const utils_1 = require("@noble/hashes/utils");
 const crypto_1 = require("./crypto");
 // keccak256(utf8("urn:cn:credential:v1")) >> 8
 exports.CREDENTIAL_DOMAIN = 363566488821926773809509531830640889725124777157045803797738936823559174026n;
+exports.ISSUANCE_REQUEST_DOMAIN = "urn:cn:issuance-request:v1";
+// Android Key Attestation challenge for the device signing key, as UTF-8 bytes. Fixed because the key is
+// attested once, at generation; the device signature over the issuer nonce supplies freshness.
+exports.DEVICE_ATTESTATION_CHALLENGE = "urn:cn:device-attestation:v1";
 exports.DEVICE_KEY_DOMAIN = 320507632879070882430325612169297945123468706597652794395401074724051126576n;
 const FIELD_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
 function stringToField(value) {
@@ -33,6 +38,17 @@ function countryCode(country) {
         throw new Error("country must be an ISO 3166-1 alpha-3 code");
     return [...country].reduce((value, character) => (value << 8) | character.charCodeAt(0), 0);
 }
+/** What the device signature commits to besides the holder key: the issuer and the scope shown at consent. */
+function issuanceRequestCommitment(issuerNetworkId, approvalScope) {
+    if (!/^0x[0-9a-fA-F]{64}$/.test(issuerNetworkId))
+        throw new Error("issuerNetworkId must be 32 bytes");
+    return (0, viem_1.hexToBytes)((0, viem_1.keccak256)((0, viem_1.concatHex)([
+        (0, viem_1.stringToHex)(exports.ISSUANCE_REQUEST_DOMAIN),
+        issuerNetworkId,
+        (0, viem_1.toHex)(programmeHash(approvalScope.programme), { size: 32 }),
+        (0, viem_1.toHex)(countryCode(approvalScope.country), { size: 32 })
+    ])));
+}
 const bytesToBigint = (value) => BigInt(`0x${(0, utils_1.bytesToHex)(value)}`);
 function deriveDeviceKeyCommitment(publicKey) {
     const encoded = (0, crypto_1.jwkToPublicKeyBytes)(publicKey);

package/dist/errors.d.ts

@@ -1,4 +1,4 @@
-export type IssuanceErrorCode = "INVALID_PARAMS" | "ISSUER_NOT_APPROVED" | "SUBJECT_MISMATCH" | "BINDING_INVALID" | "COMMITMENT_OWNERSHIP_INVALID";
+export type IssuanceErrorCode = "INVALID_PARAMS" | "ISSUER_NOT_APPROVED" | "SUBJECT_MISMATCH" | "BINDING_INVALID" | "HOLDER_KEY_OWNERSHIP_INVALID" | "COMMITMENT_OWNERSHIP_INVALID";
 export declare class IssuanceError extends Error {
     readonly code: IssuanceErrorCode;
     constructor(code: IssuanceErrorCode, message: string);

package/dist/holder-ownership.d.ts

@@ -0,0 +1,12 @@
+import type { EddsaPublicKey, EddsaSignature } from "./types";
+/** Proves possession of the holder identity key bound into a credential request. */
+export declare function signHolderKeyOwnership(identitySeed: Uint8Array, nonce: Uint8Array): {
+    publicKey: EddsaPublicKey;
+    signature: EddsaSignature;
+};
+/** Verifies that the requestor controls the supplied Baby Jubjub holder public key. */
+export declare function verifyHolderKeyOwnership(params: {
+    publicKey: EddsaPublicKey;
+    signature: EddsaSignature;
+    nonce: Uint8Array;
+}): boolean;

package/dist/holder-ownership.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signHolderKeyOwnership = signHolderKeyOwnership;
+exports.verifyHolderKeyOwnership = verifyHolderKeyOwnership;
+const identity_1 = require("@semaphore-protocol/identity");
+const revocation_1 = require("./revocation");
+/** Proves possession of the holder identity key bound into a credential request. */
+function signHolderKeyOwnership(identitySeed, nonce) {
+    if (identitySeed.length !== 32)
+        throw new Error("identity seed must be 32 bytes");
+    const identity = new identity_1.Identity(identitySeed);
+    const signature = identity.signMessage((0, revocation_1.nonceToBigint)(nonce));
+    return {
+        publicKey: [identity.publicKey[0], identity.publicKey[1]],
+        signature: { R8: [signature.R8[0], signature.R8[1]], S: signature.S }
+    };
+}
+/** Verifies that the requestor controls the supplied Baby Jubjub holder public key. */
+function verifyHolderKeyOwnership(params) {
+    try {
+        return identity_1.Identity.verifySignature((0, revocation_1.nonceToBigint)(params.nonce), params.signature, params.publicKey);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/index.d.ts

@@ -12,3 +12,4 @@ export * from "./resolver";
 export * from "./registry-client";
 export * from "./crypto";
 export * from "./revocation";
+export * from "./holder-ownership";

package/dist/index.js

@@ -28,3 +28,4 @@ __exportStar(require("./resolver"), exports);
 __exportStar(require("./registry-client"), exports);
 __exportStar(require("./crypto"), exports);
 __exportStar(require("./revocation"), exports);
+__exportStar(require("./holder-ownership"), exports);

package/dist/issue-credential.js

@@ -11,6 +11,7 @@ const credential_message_1 = require("./credential-message");
 const crypto_1 = require("./crypto");
 const errors_1 = require("./errors");
 const revocation_1 = require("./revocation");
+const holder_ownership_1 = require("./holder-ownership");
 /** Validates an issuance request without signing it. */
 async function validateZkCredentialIssue(params, approval) {
     if (!(await approval.isApprovedNetworkMember(params.issuerNetworkId))) {
@@ -31,6 +32,7 @@ async function validateZkCredentialIssue(params, approval) {
             accountPublicKey: params.accountPublicKey,
             confirmationKey: (0, crypto_1.jwkToPublicKeyBytes)(params.confirmationKey),
             holderKeyCommitment: holderKeyCommitmentBytes,
+            requestCommitment: (0, credential_message_1.issuanceRequestCommitment)(params.issuerNetworkId, params.approvalScope),
             accountSignature: params.accountPopSignature,
             deviceSignature: params.devicePopSignature
         });
@@ -47,6 +49,13 @@ async function validateZkCredentialIssue(params, approval) {
     if (!binding.valid) {
         throw new errors_1.IssuanceError("BINDING_INVALID", "credential binding failed");
     }
+    if (!(0, holder_ownership_1.verifyHolderKeyOwnership)({
+        publicKey: params.identityPublicKey,
+        signature: params.identityOwnershipSignature,
+        nonce: params.nonce
+    })) {
+        throw new errors_1.IssuanceError("HOLDER_KEY_OWNERSHIP_INVALID", "holder key ownership proof failed");
+    }
     const ownershipOk = (0, revocation_1.verifyCommitmentOwnership)({
         commitment: params.revocation.commitment,
         publicKey: params.revocation.publicKey,

package/dist/revocation.d.ts

@@ -1,4 +1,5 @@
 import { EddsaPublicKey, EddsaSignature } from "./types";
+export declare function nonceToBigint(nonce: Uint8Array): bigint;
 /** Generates a fresh 32-byte revocation secret r. Device-side only. */
 export declare function generateRevocationSecret(): Uint8Array;
 /** commitment = new Identity(r).commitment (Semaphore V4). */

package/dist/revocation.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.nonceToBigint = nonceToBigint;
 exports.generateRevocationSecret = generateRevocationSecret;
 exports.deriveRevocationCommitment = deriveRevocationCommitment;
 exports.signCommitmentOwnership = signCommitmentOwnership;

package/dist/types.d.ts

@@ -40,6 +40,8 @@ export interface IssuanceRequest {
 }
 export interface ZkCredentialIssueParams extends IssuanceRequest {
     identityPublicKey: EddsaPublicKey;
+    /** Signature over the issuer challenge proving control of `identityPublicKey`. */
+    identityOwnershipSignature: EddsaSignature;
 }
 export interface ZkCredentialBody {
     programmeHash: bigint;

package/dist/zk-proof.js

@@ -77,9 +77,16 @@ class ZkCredentialProofSystem {
         return new ZkCredentialProofSystem(new Noir(circuit), new UltraHonkBackend(circuit.bytecode, api), api, options.proof);
     }
     async generateProof(inputs) {
-        const { witness } = await this.noir.execute(inputs);
-        const proof = await this.backend.generateProof(witness, this.proofOptions);
-        return { proof: proof.proof, publicInputs: [...proof.publicInputs] };
+        try {
+            const { witness } = await this.noir.execute(inputs);
+            const proof = await this.backend.generateProof(witness, this.proofOptions);
+            return { proof: proof.proof, publicInputs: [...proof.publicInputs] };
+        }
+        catch {
+            // The circuit's assertion text distinguishes "not yet valid" from "expired".
+            // Both outcomes must be indistinguishable to the verifier that chose currentTime.
+            throw new Error("presentation proof failed");
+        }
     }
     async verifyProof(proof, expected) {
         const mismatch = publicInputMismatch(proof, expected);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coordination-network/credential",
-  "version": "0.0.2",
+  "version": "0.1.0",
   "description": "Verifiable credential SDK for the coordination network: issuance, verification, holder binding and revocation helpers.",
   "license": "MIT",
   "repository": {
@@ -30,7 +30,7 @@
     "test": "jest"
   },
   "devDependencies": {
-    "@coordination-network/zk-artifacts": "^0.0.2",
+    "@coordination-network/zk-artifacts": "^0.1.0",
     "@types/jest": "^30.0.0",
     "@types/node": "^24.0.0",
     "@zk-kit/baby-jubjub": "1.0.3",
@@ -40,12 +40,12 @@
   },
   "dependencies": {
     "@aztec/bb.js": "5.0.0",
-    "@coordination-network/identity": "^0.0.2",
-    "@coordination-network/issuer-set": "^0.0.2",
+    "@coordination-network/identity": "^0.1.0",
+    "@coordination-network/issuer-set": "^0.1.0",
     "@noble/curves": "^1.9.7",
     "@noble/hashes": "^1.8.0",
     "@noir-lang/noir_js": "1.0.0-beta.22",
-    "@semaphore-protocol/identity": "^4.14.3",
+    "@semaphore-protocol/identity": "^4.14.4",
     "poseidon-lite": "0.3.0",
     "viem": "^2.55.11"
   }

package/src/credential-message.ts

@@ -2,13 +2,17 @@ import { Identity } from "@semaphore-protocol/identity"
 import { poseidon3 } from "poseidon-lite/poseidon3"
 import { poseidon4 } from "poseidon-lite/poseidon4"
 import { poseidon5 } from "poseidon-lite/poseidon5"
-import { keccak256, stringToHex } from "viem"
+import { concatHex, hexToBytes, keccak256, stringToHex, toHex } from "viem"
 import { bytesToHex } from "@noble/hashes/utils"
 import { jwkToPublicKeyBytes } from "./crypto"
-import { Jwk, SerializedZkCredential, ZkCredential, ZkCredentialBody } from "./types"
+import { ApprovalScope, Hex32, Jwk, SerializedZkCredential, ZkCredential, ZkCredentialBody } from "./types"
 
 // keccak256(utf8("urn:cn:credential:v1")) >> 8
 export const CREDENTIAL_DOMAIN = 363566488821926773809509531830640889725124777157045803797738936823559174026n
+export const ISSUANCE_REQUEST_DOMAIN = "urn:cn:issuance-request:v1"
+// Android Key Attestation challenge for the device signing key, as UTF-8 bytes. Fixed because the key is
+// attested once, at generation; the device signature over the issuer nonce supplies freshness.
+export const DEVICE_ATTESTATION_CHALLENGE = "urn:cn:device-attestation:v1"
 export const DEVICE_KEY_DOMAIN = 320507632879070882430325612169297945123468706597652794395401074724051126576n
 const FIELD_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617n
 export function stringToField(value: string): bigint {
@@ -25,6 +29,22 @@ export function countryCode(country: string): number {
     return [...country].reduce((value, character) => (value << 8) | character.charCodeAt(0), 0)
 }
 
+/** What the device signature commits to besides the holder key: the issuer and the scope shown at consent. */
+export function issuanceRequestCommitment(issuerNetworkId: Hex32, approvalScope: ApprovalScope): Uint8Array {
+    if (!/^0x[0-9a-fA-F]{64}$/.test(issuerNetworkId)) throw new Error("issuerNetworkId must be 32 bytes")
+
+    return hexToBytes(
+        keccak256(
+            concatHex([
+                stringToHex(ISSUANCE_REQUEST_DOMAIN),
+                issuerNetworkId,
+                toHex(programmeHash(approvalScope.programme), { size: 32 }),
+                toHex(countryCode(approvalScope.country), { size: 32 })
+            ])
+        )
+    )
+}
+
 const bytesToBigint = (value: Uint8Array): bigint => BigInt(`0x${bytesToHex(value)}`)
 
 export function deriveDeviceKeyCommitment(publicKey: Jwk): bigint {

package/src/errors.ts

@@ -1,5 +1,10 @@
 export type IssuanceErrorCode =
-    "INVALID_PARAMS" | "ISSUER_NOT_APPROVED" | "SUBJECT_MISMATCH" | "BINDING_INVALID" | "COMMITMENT_OWNERSHIP_INVALID"
+    | "INVALID_PARAMS"
+    | "ISSUER_NOT_APPROVED"
+    | "SUBJECT_MISMATCH"
+    | "BINDING_INVALID"
+    | "HOLDER_KEY_OWNERSHIP_INVALID"
+    | "COMMITMENT_OWNERSHIP_INVALID"
 
 export class IssuanceError extends Error {
     readonly code: IssuanceErrorCode

package/src/holder-ownership.ts

@@ -0,0 +1,30 @@
+import { Identity } from "@semaphore-protocol/identity"
+import { nonceToBigint } from "./revocation"
+import type { EddsaPublicKey, EddsaSignature } from "./types"
+
+/** Proves possession of the holder identity key bound into a credential request. */
+export function signHolderKeyOwnership(
+    identitySeed: Uint8Array,
+    nonce: Uint8Array
+): { publicKey: EddsaPublicKey; signature: EddsaSignature } {
+    if (identitySeed.length !== 32) throw new Error("identity seed must be 32 bytes")
+    const identity = new Identity(identitySeed)
+    const signature = identity.signMessage(nonceToBigint(nonce))
+    return {
+        publicKey: [identity.publicKey[0], identity.publicKey[1]],
+        signature: { R8: [signature.R8[0], signature.R8[1]], S: signature.S }
+    }
+}
+
+/** Verifies that the requestor controls the supplied Baby Jubjub holder public key. */
+export function verifyHolderKeyOwnership(params: {
+    publicKey: EddsaPublicKey
+    signature: EddsaSignature
+    nonce: Uint8Array
+}): boolean {
+    try {
+        return Identity.verifySignature(nonceToBigint(params.nonce), params.signature, params.publicKey)
+    } catch {
+        return false
+    }
+}

package/src/index.ts

@@ -12,3 +12,4 @@ export * from "./resolver"
 export * from "./registry-client"
 export * from "./crypto"
 export * from "./revocation"
+export * from "./holder-ownership"

package/src/issue-credential.ts

@@ -3,11 +3,18 @@ import { inPrimeOrderSubgroup } from "@coordination-network/issuer-set"
 import { hexToBytes } from "@noble/hashes/utils"
 import { Identity } from "@semaphore-protocol/identity"
 import { CredentialSigner } from "./credential-signer"
-import { countryCode, deriveDeviceKeyCommitment, programmeHash, zkCredentialCommitment } from "./credential-message"
+import {
+    countryCode,
+    deriveDeviceKeyCommitment,
+    issuanceRequestCommitment,
+    programmeHash,
+    zkCredentialCommitment
+} from "./credential-message"
 import { jwkToPublicKeyBytes } from "./crypto"
 import { IssuanceError } from "./errors"
 import { ApprovalResolver } from "./resolver"
 import { verifyCommitmentOwnership } from "./revocation"
+import { verifyHolderKeyOwnership } from "./holder-ownership"
 import { ZkCredential, ZkCredentialBody, ZkCredentialIssueParams } from "./types"
 
 /** Validates an issuance request without signing it. */
@@ -38,6 +45,7 @@ export async function validateZkCredentialIssue(
             accountPublicKey: params.accountPublicKey,
             confirmationKey: jwkToPublicKeyBytes(params.confirmationKey),
             holderKeyCommitment: holderKeyCommitmentBytes,
+            requestCommitment: issuanceRequestCommitment(params.issuerNetworkId, params.approvalScope),
             accountSignature: params.accountPopSignature,
             deviceSignature: params.devicePopSignature
         })
@@ -55,6 +63,16 @@ export async function validateZkCredentialIssue(
         throw new IssuanceError("BINDING_INVALID", "credential binding failed")
     }
 
+    if (
+        !verifyHolderKeyOwnership({
+            publicKey: params.identityPublicKey,
+            signature: params.identityOwnershipSignature,
+            nonce: params.nonce
+        })
+    ) {
+        throw new IssuanceError("HOLDER_KEY_OWNERSHIP_INVALID", "holder key ownership proof failed")
+    }
+
     const ownershipOk = verifyCommitmentOwnership({
         commitment: params.revocation.commitment,
         publicKey: params.revocation.publicKey,

package/src/revocation.ts

@@ -16,7 +16,7 @@ function assertSecret(r: Uint8Array): void {
     }
 }
 
-function nonceToBigint(nonce: Uint8Array): bigint {
+export function nonceToBigint(nonce: Uint8Array): bigint {
     if (nonce.length === 0) {
         throw new Error("nonce must not be empty")
     }

package/src/types.ts

@@ -47,6 +47,8 @@ export interface IssuanceRequest {
 
 export interface ZkCredentialIssueParams extends IssuanceRequest {
     identityPublicKey: EddsaPublicKey
+    /** Signature over the issuer challenge proving control of `identityPublicKey`. */
+    identityOwnershipSignature: EddsaSignature
 }
 
 export interface ZkCredentialBody {

package/src/zk-proof.ts

@@ -140,9 +140,15 @@ export class ZkCredentialProofSystem {
     }
 
     async generateProof(inputs: ZkPresentationInputs): Promise<ZkPresentationProof> {
-        const { witness } = await this.noir.execute(inputs as unknown as InputMap)
-        const proof = await this.backend.generateProof(witness, this.proofOptions)
-        return { proof: proof.proof, publicInputs: [...proof.publicInputs] }
+        try {
+            const { witness } = await this.noir.execute(inputs as unknown as InputMap)
+            const proof = await this.backend.generateProof(witness, this.proofOptions)
+            return { proof: proof.proof, publicInputs: [...proof.publicInputs] }
+        } catch {
+            // The circuit's assertion text distinguishes "not yet valid" from "expired".
+            // Both outcomes must be indistinguishable to the verifier that chose currentTime.
+            throw new Error("presentation proof failed")
+        }
     }
 
     async verifyProof(