@myazahq/kyc-sdk-react-native 2.2.0 → 2.3.0

package/src/emrtd/ec.ts

@@ -0,0 +1,196 @@
+import type { EcCurve } from './ec-curves';
+
+// ---------------------------------------------------------------------------
+// Elliptic-curve point arithmetic over a prime field, in BigInt.
+//
+// WHY THIS IS IN TYPESCRIPT while the block ciphers are native. The native side
+// exposes 3DES/AES/SHA/CMAC because those are audited, constant-time, hardware
+// -accelerated platform primitives. It exposes no EC point arithmetic, and
+// adding it would mean writing and shipping matching Swift and Kotlin — two
+// more implementations of the same maths, on the path that authenticates a
+// passport. One implementation, checked against the curve's own published
+// generator and order (ec.test.ts), is the smaller risk.
+//
+// The scalar multiply is a fixed-sequence Montgomery ladder: every bit of the
+// scalar performs the same add-then-double regardless of its value, so the
+// operation sequence does not depend on the secret. That is as far as constant
+// time goes here — BigInt itself is variable-time, so this is not hardened
+// against a local timing attacker. It does not need to be: the private scalar
+// is ephemeral, used for exactly one handshake with a chip held against the
+// phone, and discarded.
+// ---------------------------------------------------------------------------
+
+/** An affine point, or the point at infinity (`inf`). */
+export interface EcPoint {
+  readonly x: bigint;
+  readonly y: bigint;
+  readonly inf: boolean;
+}
+
+export const INFINITY: EcPoint = { x: 0n, y: 0n, inf: true };
+
+export function point(x: bigint, y: bigint): EcPoint {
+  return { x, y, inf: false };
+}
+
+/** Least non-negative residue — `%` alone keeps the sign of the dividend. */
+function mod(a: bigint, p: bigint): bigint {
+  const r = a % p;
+  return r < 0n ? r + p : r;
+}
+
+/**
+ * Modular inverse by the extended Euclidean algorithm.
+ *
+ * Throws when the value is not invertible, which for a prime field means it was
+ * congruent to zero. Callers reach this only through point arithmetic that has
+ * already excluded the cases where that happens.
+ */
+export function modInverse(value: bigint, p: bigint): bigint {
+  let [old_r, r] = [mod(value, p), p];
+  let [old_s, s] = [1n, 0n];
+  while (r !== 0n) {
+    const q = old_r / r;
+    [old_r, r] = [r, old_r - q * r];
+    [old_s, s] = [s, old_s - q * s];
+  }
+  if (old_r !== 1n) throw new Error('value is not invertible');
+  return mod(old_s, p);
+}
+
+/** Whether the point satisfies y² = x³ + ax + b over the curve's field. */
+export function isOnCurve(c: EcCurve, pt: EcPoint): boolean {
+  if (pt.inf) return false;
+  if (pt.x < 0n || pt.x >= c.p || pt.y < 0n || pt.y >= c.p) return false;
+  const lhs = mod(pt.y * pt.y, c.p);
+  const rhs = mod(pt.x * pt.x * pt.x + c.a * pt.x + c.b, c.p);
+  return lhs === rhs;
+}
+
+export function pointDouble(c: EcCurve, pt: EcPoint): EcPoint {
+  if (pt.inf) return INFINITY;
+  // A point with y = 0 is its own inverse, so doubling it lands on infinity.
+  if (pt.y === 0n) return INFINITY;
+  const lambda = mod(
+    (3n * pt.x * pt.x + c.a) * modInverse(2n * pt.y, c.p),
+    c.p,
+  );
+  const x = mod(lambda * lambda - 2n * pt.x, c.p);
+  return point(x, mod(lambda * (pt.x - x) - pt.y, c.p));
+}
+
+export function pointAdd(c: EcCurve, a: EcPoint, b: EcPoint): EcPoint {
+  if (a.inf) return b;
+  if (b.inf) return a;
+  if (a.x === b.x) {
+    // Same x: either the same point (double) or inverses (sum is infinity).
+    return mod(a.y + b.y, c.p) === 0n ? INFINITY : pointDouble(c, a);
+  }
+  const lambda = mod((b.y - a.y) * modInverse(b.x - a.x, c.p), c.p);
+  const x = mod(lambda * lambda - a.x - b.x, c.p);
+  return point(x, mod(lambda * (a.x - x) - a.y, c.p));
+}
+
+/**
+ * Scalar multiplication by a Montgomery ladder.
+ *
+ * Both branches of every bit do the same work, so the sequence of field
+ * operations is independent of the scalar's bits (see the header note on how
+ * far that guarantee goes). The ladder starts at the scalar's own bit width
+ * rather than the curve's, which is safe here because the scalar is uniformly
+ * random in [1, n-1] and never a low-entropy value whose bit length would leak
+ * something meaningful.
+ */
+export function pointMultiply(c: EcCurve, k: bigint, pt: EcPoint): EcPoint {
+  if (k <= 0n || pt.inf) return INFINITY;
+  let r0: EcPoint = INFINITY;
+  let r1: EcPoint = pt;
+  for (let i = BigInt(k.toString(2).length) - 1n; i >= 0n; i--) {
+    if (((k >> i) & 1n) === 0n) {
+      r1 = pointAdd(c, r0, r1);
+      r0 = pointDouble(c, r0);
+    } else {
+      r0 = pointAdd(c, r0, r1);
+      r1 = pointDouble(c, r1);
+    }
+  }
+  return r0;
+}
+
+/** The curve's generator as a point. */
+export function generator(c: EcCurve): EcPoint {
+  return point(c.gx, c.gy);
+}
+
+// ── Encoding ────────────────────────────────────────────────────────────────
+
+/** Big-endian bytes → integer. */
+export function bytesToBigInt(bytes: Uint8Array): bigint {
+  let n = 0n;
+  for (const b of bytes) n = (n << 8n) | BigInt(b);
+  return n;
+}
+
+/**
+ * Integer → fixed-width big-endian bytes.
+ *
+ * The width is fixed on purpose: a shared secret whose x coordinate happens to
+ * start with a zero byte must still derive the same-length key material, and a
+ * variable-length encoding there silently produces the wrong session keys on
+ * roughly one handshake in 256.
+ */
+export function bigIntToBytes(value: bigint, width: number): Uint8Array {
+  const out = new Uint8Array(width);
+  let v = value;
+  for (let i = width - 1; i >= 0 && v > 0n; i--) {
+    out[i] = Number(v & 0xffn);
+    v >>= 8n;
+  }
+  return out;
+}
+
+/** Uncompressed point encoding: 0x04 || X || Y, each coordinate field-width. */
+export function encodePoint(c: EcCurve, pt: EcPoint): Uint8Array {
+  if (pt.inf) throw new Error('cannot encode the point at infinity');
+  const out = new Uint8Array(1 + c.byteLen * 2);
+  out[0] = 0x04;
+  out.set(bigIntToBytes(pt.x, c.byteLen), 1);
+  out.set(bigIntToBytes(pt.y, c.byteLen), 1 + c.byteLen);
+  return out;
+}
+
+/**
+ * Decode an uncompressed point, returning null when the bytes are not a valid
+ * point on the curve.
+ *
+ * Validation is the security-critical part, not a formality: a chip that picks
+ * a point off the curve (or a small-order point on a related curve) can learn
+ * our private scalar from how we respond, so anything that does not verify is
+ * refused rather than used. Compressed encodings are rejected too, since PACE
+ * mandates the uncompressed form and accepting more would only widen what an
+ * attacker can hand us.
+ */
+export function decodePoint(c: EcCurve, bytes: Uint8Array): EcPoint | null {
+  if (bytes.length !== 1 + c.byteLen * 2 || bytes[0] !== 0x04) return null;
+  const pt = point(
+    bytesToBigInt(bytes.subarray(1, 1 + c.byteLen)),
+    bytesToBigInt(bytes.subarray(1 + c.byteLen)),
+  );
+  return isOnCurve(c, pt) ? pt : null;
+}
+
+/**
+ * A uniformly random private scalar in [1, n-1].
+ *
+ * Rejection sampling rather than a modulo: reducing a random integer mod n
+ * biases the result toward small values, and biased nonces are how ECDSA keys
+ * have historically been recovered. The loop is bounded because each draw
+ * succeeds with probability very close to 1 for every curve here.
+ */
+export function randomScalar(c: EcCurve, randomBytes: (n: number) => Uint8Array): bigint {
+  for (let attempt = 0; attempt < 64; attempt++) {
+    const candidate = bytesToBigInt(randomBytes(c.byteLen));
+    if (candidate > 0n && candidate < c.n) return candidate;
+  }
+  throw new Error('could not draw a private scalar');
+}

package/src/emrtd/index.ts

@@ -26,5 +26,6 @@ export {
   nfcStageLabel,
   nfcStageProgress,
 } from './stages';
+export { parseDg1 } from './dg1';
 export { decodeChipImage, isNfcAvailable, nfcUnavailableReason } from './native';
 export { cancelChipRead, readPassportChip, type ChipReadOptions } from './read';

package/src/emrtd/mrzKey.ts

@@ -48,7 +48,27 @@ export function mrzKeySeedInput(fields: MrzKeyFields): string {
   );
 }
 
-/** Kseed: the first 16 bytes of SHA-1 over the MRZ information. */
+/** Kseed for BAC: the first 16 bytes of SHA-1 over the MRZ information. */
 export function keySeed(p: EmrtdPrimitives, fields: MrzKeyFields): Uint8Array {
   return p.sha1(fromAscii(mrzKeySeedInput(fields))).subarray(0, 16);
 }
+
+/**
+ * The seed PACE derives its password key from: the FULL SHA-1 digest, NOT
+ * truncated to 16 bytes.
+ *
+ * This is the one place the two protocols disagree about the same hash, and it
+ * is silent when wrong: a truncated seed yields a valid-looking K_π, the
+ * handshake runs to its last step, and the chip answers 0x6300 — which reads
+ * exactly like a mistyped MRZ rather than a derivation bug. It cost this SDK a
+ * real passport read to find (the same document opened over BAC moments later,
+ * proving the MRZ was right).
+ *
+ * ICAO 9303 Part 11 keeps the two apart: §9.7.3 truncates for BAC's Kseed,
+ * while §9.7.2 feeds the whole digest to KDF_π. JMRTD encodes the same split as
+ * `computeKeySeedForBAC(… truncate: true)` vs `computeKeySeedForPACE(…
+ * truncate: false)`.
+ */
+export function paceKeySeed(p: EmrtdPrimitives, fields: MrzKeyFields): Uint8Array {
+  return p.sha1(fromAscii(mrzKeySeedInput(fields)));
+}

package/src/emrtd/open.ts

@@ -0,0 +1,169 @@
+import { fromBase64, toBase64 } from './bytes';
+import type { EmrtdPrimitives, MrzKeyFields } from './crypto';
+import { paceKeySeed } from './crypto';
+import { curveForParameterId } from './ec-curves';
+import { runPaceEcdhGm, PaceError, type PaceTransceive } from './pace';
+import {
+  describeProtocol,
+  paceGapFor,
+  parseCardAccess,
+  selectPaceOffer,
+} from './pace-params';
+import type { SecureMessagingSession } from './secureMessaging';
+import type { EmrtdTransport } from './session';
+
+// ---------------------------------------------------------------------------
+// Choosing how to get into the chip.
+//
+// A chip may accept BAC, PACE, or both, and this decides which is tried first.
+//
+// The standard prefers PACE, and so should we eventually: BAC derives its keys
+// from the MRZ alone, so anyone who photographs the passport page can decrypt a
+// recorded session afterwards, while PACE agrees fresh keys every time.
+//
+// But this SDK's BAC has been reading real passports for a long time and its
+// PACE has not read any, so the default here is deliberately the other way
+// round: BAC first, PACE only when BAC is refused. In that order PACE can only
+// ever ADD documents we can read — chips that have retired BAC — and can never
+// take away one that already worked.
+//
+// PACE has since been confirmed against a real document — a Nigerian e-passport
+// on 2026-08-11, over PACE-ECDH-GM with AES-256 on brainpoolP256r1, on both an
+// iPhone 16 Pro Max and a Galaxy S24, with passive authentication passing and
+// the DG2 portrait read. So the code is no longer unproven.
+//
+// The ordering STAYS BAC-first anyway, which is the part worth explaining:
+// "confirmed on one document" is not "confirmed on the population". BAC has
+// read every passport this SDK has ever seen; PACE has read one model of one
+// issuer's. Going PACE-first would put the less-travelled path in front of
+// every document in the world to buy a property (forward secrecy against a
+// recorded session) that matters far less than reading the passport at all.
+//
+// PACE still runs — as the fallback, where it can only ever ADD documents we
+// can read, namely chips that have retired BAC. Revisit when PACE has spanned
+// several issuers, not before.
+//
+// Mirrors the Flutter SDK's emrtd_open.dart, including this reasoning.
+// ---------------------------------------------------------------------------
+
+/**
+ * Which access protocol is tried first.
+ *
+ * `false` (the shipping default) means BAC first, PACE only if BAC is refused.
+ * `true` reverses it, which is how PACE gets exercised against a real chip: a
+ * passport that accepts BAC would otherwise never reach the PACE code at all.
+ * Set it to `true` temporarily to test PACE against a document; do not ship it.
+ *
+ * Safe either way — whichever goes first, the other still runs as the fallback,
+ * so this cannot turn a readable document into an unreadable one.
+ */
+export const PREFER_PACE = false;
+
+/**
+ * Why a session ended up on the protocol it did.
+ *
+ * The protocol name alone cannot answer the question that matters while PACE is
+ * new: a chip reading over BAC may never have OFFERED PACE, or may have offered
+ * it and had our implementation fail. Those call for opposite responses — one
+ * is nothing to do, the other is a bug — so the reason is recorded rather than
+ * inferred.
+ */
+export type PaceOutcome =
+  /** PACE opened the session. */
+  | 'used'
+  /** The chip published no EF.CardAccess: it does not speak PACE at all. */
+  | 'notOffered'
+  /** EF.CardAccess offers only variants this build cannot run. */
+  | 'unsupportedVariant'
+  /** PACE was attempted and did not complete. THIS is the one worth chasing. */
+  | 'failed'
+  /** Not tried — BAC succeeded first. */
+  | 'notAttempted';
+
+export interface AccessResult {
+  sm: SecureMessagingSession;
+  /** Which protocol secured the session. */
+  chipAuth: 'bac' | 'pace';
+  outcome: PaceOutcome;
+  /** The negotiated protocol when PACE was used, or why it was not. */
+  detail?: string;
+}
+
+/** EF.CardAccess: at the Master File, readable with no session at all. */
+const EF_CARD_ACCESS = 0x011c;
+
+/**
+ * Read EF.CardAccess, or null when the chip does not offer it — which simply
+ * means BAC. Absent, unreadable, and unparseable all mean the same thing to
+ * the caller, so none of them throw.
+ */
+export async function readCardAccess(transport: EmrtdTransport): Promise<Uint8Array | null> {
+  try {
+    // SELECT the Master File, then EF.CardAccess by identifier.
+    const mf = await transport.transceive(
+      toBase64(new Uint8Array([0x00, 0xa4, 0x00, 0x0c, 0x02, 0x3f, 0x00])),
+    );
+    if (mf.statusWord !== 0x9000) return null;
+    const select = await transport.transceive(
+      toBase64(
+        new Uint8Array([0x00, 0xa4, 0x02, 0x0c, 0x02, (EF_CARD_ACCESS >> 8) & 0xff, EF_CARD_ACCESS & 0xff]),
+      ),
+    );
+    if (select.statusWord !== 0x9000) return null;
+    const read = await transport.transceive(
+      toBase64(new Uint8Array([0x00, 0xb0, 0x00, 0x00, 0x00])),
+    );
+    if (read.statusWord !== 0x9000) return null;
+    const data = fromBase64(read.data);
+    return data.length > 0 ? data : null;
+  } catch {
+    return null; // absent or unreadable — the caller falls back to BAC
+  }
+}
+
+/**
+ * Try PACE. Resolves with the session when it worked, or reports why it did
+ * not — a `null` result always means "fall back to BAC", never a failed read.
+ */
+export async function tryPace(
+  p: EmrtdPrimitives,
+  transport: EmrtdTransport,
+  mrz: MrzKeyFields,
+): Promise<{ sm: SecureMessagingSession; detail: string } | { outcome: PaceOutcome; detail?: string }> {
+  const file = await readCardAccess(transport);
+  if (!file) return { outcome: 'notOffered' };
+
+  const offers = parseCardAccess(file);
+  const selected = selectPaceOffer(offers);
+  if (!selected) {
+    return { outcome: 'unsupportedVariant', detail: paceGapFor(offers) ?? undefined };
+  }
+
+  const { offer, curve } = selected;
+  // The MRZ unlocks the chip's nonce rather than the session itself: counter 3
+  // is the password key, where BAC uses 1 and 2 for its session keys. The seed
+  // is the UNTRUNCATED SHA-1 — see paceKeySeed for why that distinction matters
+  // and how it fails when it is wrong.
+  const passwordKey = offer.protocol.suite.deriveKey(p, paceKeySeed(p, mrz), 3);
+
+  const transceive: PaceTransceive = async (command) => {
+    const res = await transport.transceive(toBase64(command));
+    return { data: fromBase64(res.data), statusWord: res.statusWord };
+  };
+
+  const sm = await runPaceEcdhGm({
+    p,
+    transceive,
+    protocol: offer.protocol,
+    curve,
+    passwordKey,
+  });
+  return { sm, detail: `${describeProtocol(offer.protocol)} params=${offer.parameterId}` };
+}
+
+/** Whether a parameter id resolves to a curve this build runs. Test seam. */
+export function supportsParameterId(id: number): boolean {
+  return curveForParameterId(id) !== null;
+}
+
+export { PaceError };

package/src/emrtd/pace-params.ts

@@ -0,0 +1,169 @@
+import { readTlv, readTlvSequence } from './der';
+import { curveForParameterId, type EcCurve } from './ec-curves';
+import { DES_EDE2_SUITE, aesSuite, type CipherSuite } from './suites';
+
+// ---------------------------------------------------------------------------
+// PACE protocols, domain parameters, and EF.CardAccess (ICAO 9303 Part 11 §9.2).
+//
+// A chip advertises which PACE variants it supports as object identifiers in
+// EF.CardAccess — a small file at the Master File level, readable with NO
+// session at all, which is how a terminal discovers whether the chip speaks
+// PACE and with which parameters.
+//
+// Only Generic Mapping over elliptic curves is implemented. Integrated Mapping
+// and Chip Authentication Mapping are distinct protocols rather than
+// variations, and PACE over finite-field Diffie-Hellman needs the RFC 5114
+// modular groups embedded as constants, where a subtly wrong 2048-bit prime
+// fails in a way that looks like a bad document. Virtually every issued
+// passport offers the elliptic-curve variants, and anything reaching those gaps
+// still reads over BAC.
+// ---------------------------------------------------------------------------
+
+/** How the chip's nonce is mapped onto a fresh generator. */
+export type PaceMapping = 'generic' | 'integrated' | 'chipAuthentication';
+
+/** Which key-agreement primitive the mapping runs over. */
+export type PaceKeyAgreement = 'dh' | 'ecdh';
+
+/** A PACE variant the chip advertised. */
+export interface PaceProtocol {
+  /**
+   * The raw OID bytes. Re-sent to the chip and folded into the authentication
+   * tokens, so they must be preserved exactly as received.
+   */
+  readonly oid: Uint8Array;
+  readonly mapping: PaceMapping;
+  readonly keyAgreement: PaceKeyAgreement;
+  readonly suite: CipherSuite;
+}
+
+/** Whether this build can actually run the variant. */
+export function isSupportedProtocol(protocol: PaceProtocol): boolean {
+  return protocol.mapping === 'generic' && protocol.keyAgreement === 'ecdh';
+}
+
+export function describeProtocol(protocol: PaceProtocol): string {
+  return `PACE-${protocol.keyAgreement.toUpperCase()}-${protocol.mapping} ${protocol.suite.name}`;
+}
+
+/** `0.4.0.127.0.7.2.2.4` — the arc every PACE protocol identifier sits under. */
+const PACE_ARC = [0x04, 0x00, 0x7f, 0x00, 0x07, 0x02, 0x02, 0x04];
+
+/** The last-but-one arc component selects mapping + key agreement. */
+const BRANCHES: Record<number, [PaceMapping, PaceKeyAgreement]> = {
+  1: ['generic', 'dh'],
+  2: ['generic', 'ecdh'],
+  3: ['integrated', 'dh'],
+  4: ['integrated', 'ecdh'],
+  6: ['chipAuthentication', 'ecdh'],
+};
+
+/** The final component selects the cipher suite. */
+const CIPHERS: Record<number, CipherSuite> = {
+  1: DES_EDE2_SUITE,
+  2: aesSuite(16),
+  3: aesSuite(24),
+  4: aesSuite(32),
+};
+
+/**
+ * Decode a PACE protocol OID, or null when it is not one.
+ *
+ * An unknown OID in EF.CardAccess is NORMAL, not an error: the file also
+ * carries security information for chip authentication and terminal
+ * authentication, which this SDK does not run.
+ */
+export function paceProtocolFromOid(oid: Uint8Array): PaceProtocol | null {
+  if (oid.length !== PACE_ARC.length + 2) return null;
+  for (let i = 0; i < PACE_ARC.length; i++) {
+    if (oid[i] !== PACE_ARC[i]) return null;
+  }
+  const branch = BRANCHES[oid[PACE_ARC.length]!];
+  const suite = CIPHERS[oid[PACE_ARC.length + 1]!];
+  if (!branch || !suite) return null;
+  return { oid: new Uint8Array(oid), mapping: branch[0], keyAgreement: branch[1], suite };
+}
+
+/** One PACE offering from the chip. */
+export interface PaceOffer {
+  readonly protocol: PaceProtocol;
+  /** The standardised domain-parameter id, naming a curve or DH group. */
+  readonly parameterId: number | null;
+}
+
+/**
+ * The PACE offerings advertised in EF.CardAccess, in file order.
+ *
+ * Returns empty for a chip that advertises no PACE, for a file that cannot be
+ * parsed, and for one that is simply absent — all of which mean the same thing
+ * to the caller: use BAC.
+ */
+export function parseCardAccess(file: Uint8Array): PaceOffer[] {
+  const offers: PaceOffer[] = [];
+  // The file is a SET (0x31) of SEQUENCEs. Some chips wrap it differently, so
+  // accept the SET's contents or a bare run of SEQUENCEs.
+  const outer = readTlv(file);
+  const body = outer && outer.tag === 0x31 ? outer.value : file;
+
+  for (const info of readTlvSequence(body)) {
+    if (info.tag !== 0x30) continue; // not a SecurityInfo
+    const fields = readTlvSequence(info.value);
+    const first = fields[0];
+    if (!first || first.tag !== 0x06) continue;
+
+    const protocol = paceProtocolFromOid(first.value);
+    if (!protocol) continue; // some other protocol's security info
+
+    // PACEInfo ::= SEQUENCE { protocol OID, version INTEGER,
+    //                         parameterId INTEGER OPTIONAL }
+    const ints = fields.slice(1).filter((f) => f.tag === 0x02);
+    const parameterId = ints.length > 1 ? intFromBytes(ints[1]!.value) : null;
+    offers.push({ protocol, parameterId });
+  }
+  return offers;
+}
+
+/** A small DER INTEGER as a number. */
+function intFromBytes(bytes: Uint8Array): number {
+  let n = 0;
+  for (const b of bytes) n = n * 256 + b;
+  return n;
+}
+
+/** A usable offering plus its resolved curve. */
+export interface SelectedPaceOffer {
+  readonly offer: PaceOffer;
+  readonly curve: EcCurve;
+}
+
+/**
+ * The offering to actually attempt, or null when none is usable.
+ *
+ * Prefers the strongest cipher the chip offers among the variants this build
+ * supports, so a chip advertising both AES-256 and 3DES is run at AES-256.
+ */
+export function selectPaceOffer(offers: PaceOffer[]): SelectedPaceOffer | null {
+  let best: SelectedPaceOffer | null = null;
+  for (const offer of offers) {
+    if (!isSupportedProtocol(offer.protocol)) continue;
+    if (offer.parameterId === null) continue;
+    const curve = curveForParameterId(offer.parameterId);
+    if (!curve) continue;
+    if (!best || offer.protocol.suite.keyLength > best.offer.protocol.suite.keyLength) {
+      best = { offer, curve };
+    }
+  }
+  return best;
+}
+
+/** Why no offering was usable. Diagnostics only — the read falls back to BAC. */
+export type PaceGap = 'mapping' | 'keyAgreement' | 'domainParameters';
+
+export function paceGapFor(offers: PaceOffer[]): PaceGap | null {
+  if (offers.length === 0) return null;
+  for (const offer of offers) {
+    if (offer.protocol.keyAgreement !== 'ecdh') return 'keyAgreement';
+    if (offer.protocol.mapping !== 'generic') return 'mapping';
+  }
+  return 'domainParameters';
+}