iso-signatures 0.0.1

package/src/signers/ecdsa.js

@@ -0,0 +1,147 @@
+/* eslint-disable unicorn/numeric-separators-style */
+import { webcrypto } from 'iso-base/crypto'
+import { u8 } from 'iso-base/utils'
+import { DIDKey, keyTypeToAlg } from 'iso-did/key'
+import { createEcdsaParams } from '../utils.js'
+
+/**
+ * @typedef {import('../types.js').ISigner<CryptoKeyPair>} ISigner
+ * @typedef {Extract<import('iso-did/types').SignatureAlgorithm, 'ES256' | 'ES384' | 'ES512'>} ECDSAAlg
+ */
+
+/**
+ * @param {string} alg
+ */
+function asECDSAAlg(alg) {
+  if (alg.startsWith('ES')) {
+    return /** @type {ECDSAAlg} */ (alg)
+  }
+  throw new TypeError(`Unsupported algorithm ${alg}`)
+}
+
+/**
+ * ECDSA signer
+ *
+ * @implements {ISigner}
+ */
+export class ECDSASigner {
+  /**
+   * @param {ECDSAAlg} alg
+   * @param {Uint8Array} publicKey
+   * @param {CryptoKeyPair} keypair
+   */
+  constructor(alg, publicKey, keypair) {
+    this.params = createEcdsaParams(alg)
+    this.keypair = keypair
+    this.publicKey = publicKey
+    this.alg = alg
+    this.type = this.params.namedCurve
+    this.did = DIDKey.fromPublicKey(this.type, this.publicKey)
+  }
+
+  /**
+   * Generate a new signer
+   *
+   * @param {ECDSAAlg} alg
+   */
+  static async generate(alg) {
+    const params = createEcdsaParams(alg)
+    const cryptoKeyPair = await webcrypto.subtle.generateKey(params, false, [
+      'sign',
+      'verify',
+    ])
+
+    const publicKey = await webcrypto.subtle.exportKey(
+      'raw',
+      cryptoKeyPair.publicKey
+    )
+
+    return new ECDSASigner(alg, u8(publicKey), cryptoKeyPair)
+  }
+
+  /**
+   * Import a signer from a JWK
+   *
+   * @param {import('../types.js').PrivateKeyJwk} jwk
+   */
+  static async importJwk(jwk) {
+    const alg = asECDSAAlg(keyTypeToAlg(jwk.crv))
+    const params = createEcdsaParams(alg)
+    const privateKey = await webcrypto.subtle.importKey(
+      'jwk',
+      jwk,
+      params,
+      false,
+      ['sign']
+    )
+    const publicKeyJWK = await webcrypto.subtle.importKey(
+      'jwk',
+      { ...jwk, d: undefined },
+      params,
+      true,
+      ['verify']
+    )
+
+    const publicKey = await webcrypto.subtle.exportKey('raw', publicKeyJWK)
+
+    return new ECDSASigner(alg, u8(publicKey), {
+      privateKey,
+      publicKey: publicKeyJWK,
+    })
+  }
+
+  /**
+   * Import a signer from a CryptoKeyPair
+   *
+   * @param {CryptoKeyPair} key
+   */
+  static async import(key) {
+    const publicKey = await webcrypto.subtle.exportKey('raw', key.publicKey)
+
+    /** @type { ECDSAAlg } */
+    let alg
+    switch (publicKey.byteLength) {
+      case 65: {
+        alg = 'ES256'
+        break
+      }
+      case 97: {
+        alg = 'ES384'
+        break
+      }
+      case 133: {
+        alg = 'ES512'
+        break
+      }
+
+      default: {
+        throw new Error('Unsupported key type')
+      }
+    }
+    return new ECDSASigner(alg, u8(publicKey), key)
+  }
+
+  /**
+   * Sign a message
+   *
+   * @param {Uint8Array} message
+   */
+  async sign(message) {
+    const buf = await webcrypto.subtle.sign(
+      this.params,
+      this.keypair.privateKey,
+      message
+    )
+
+    return u8(buf)
+  }
+
+  /**
+   * Export the signer as a CryptoKeyPair
+   *
+   * @returns {CryptoKeyPair}
+   */
+  export() {
+    return this.keypair
+  }
+}

package/src/signers/eddsa.js

@@ -0,0 +1,80 @@
+/* eslint-disable unicorn/numeric-separators-style */
+import { getPublicKeyAsync, signAsync, utils } from '@noble/ed25519'
+import { webcrypto } from 'iso-base/crypto'
+import { base64pad } from 'iso-base/rfc4648'
+import { tag, untag } from 'iso-base/varint'
+import { DIDKey } from 'iso-did/key'
+
+// @ts-ignore
+if (!globalThis.crypto) globalThis.crypto = webcrypto
+
+/**
+ * @typedef {import('../types.js').ISigner<string>} ISigner
+ */
+
+/**
+ * EdDSA signer
+ *
+ * @implements {ISigner}
+ */
+export class EdDSASigner {
+  /** @type {Extract<import('iso-did/types').SignatureAlgorithm, "EdDSA">} */
+  static alg = 'EdDSA'
+
+  /** @type {Extract<import('iso-did/types').KeyType, "Ed25519">} */
+  static type = 'Ed25519'
+
+  static code = 0x1300
+
+  /**
+   * @param {Uint8Array} publicKey
+   * @param {Uint8Array} privateKey
+   */
+  constructor(publicKey, privateKey) {
+    this.privateKey = privateKey
+    this.publicKey = publicKey
+    this.alg = EdDSASigner.alg
+    this.type = EdDSASigner.type
+    this.code = EdDSASigner.code
+    this.did = DIDKey.fromPublicKey(EdDSASigner.type, this.publicKey)
+  }
+
+  /**
+   * Generate a new signer
+   *
+   * @param {Uint8Array} [bytes]
+   */
+  static async generate(bytes) {
+    const privateKey = bytes || utils.randomPrivateKey()
+    const publicKey = await getPublicKeyAsync(privateKey)
+    return new EdDSASigner(publicKey, privateKey)
+  }
+
+  /**
+   * Import a signer from a encoded string
+   *
+   * @param {string} encoded
+   */
+  static async import(encoded) {
+    const privateKey = untag(EdDSASigner.code, base64pad.decode(encoded))
+    const publicKey = await getPublicKeyAsync(privateKey)
+
+    return new EdDSASigner(publicKey, privateKey)
+  }
+
+  /**
+   * Sign a message
+   *
+   * @param {Uint8Array} message
+   */
+  async sign(message) {
+    return signAsync(message, this.privateKey)
+  }
+
+  /**
+   * Export the signer as a encoded string
+   */
+  export() {
+    return base64pad.encode(tag(EdDSASigner.code, this.privateKey))
+  }
+}

package/src/signers/rsa-old.js

@@ -0,0 +1,128 @@
+/* eslint-disable unicorn/numeric-separators-style */
+import { webcrypto } from 'iso-base/crypto'
+import { u8 } from 'iso-base/utils'
+import { DIDKey } from 'iso-did/key'
+
+/**
+ * @typedef {import('../types.js').ISigner<CryptoKeyPair>} ISigner
+ */
+
+/**
+ * RSA Old fission format signer
+ *
+ * @implements {ISigner}
+ */
+export class RSAOldSigner {
+  /** @type {Extract<import('iso-did/types').SignatureAlgorithm, "RS256_OLD">} */
+  static alg = 'RS256_OLD'
+
+  /** @type {Extract<import('iso-did/types').KeyType, "RSA_OLD">} */
+  static type = 'RSA_OLD'
+
+  /**
+   * @param {Uint8Array} publicKey
+   * @param {CryptoKeyPair} keypair
+   */
+  constructor(publicKey, keypair) {
+    this.keypair = keypair
+    this.publicKey = publicKey
+    this.alg = RSAOldSigner.alg
+    this.type = RSAOldSigner.type
+    this.did = DIDKey.fromPublicKey(RSAOldSigner.type, this.publicKey)
+  }
+
+  /**
+   * Generate a new signer
+   */
+  static async generate() {
+    const cryptoKeyPair = await webcrypto.subtle.generateKey(
+      {
+        name: 'RSASSA-PKCS1-v1_5',
+        modulusLength: 2048,
+        publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+        hash: { name: 'SHA-256' },
+      },
+
+      false,
+      ['sign', 'verify']
+    )
+
+    const publicKey = await webcrypto.subtle.exportKey(
+      'spki',
+      cryptoKeyPair.publicKey
+    )
+
+    return new RSAOldSigner(u8(publicKey), cryptoKeyPair)
+  }
+
+  /**
+   * Import a signer from a JWK
+   *
+   * @param {import('../types.js').PrivateKeyRSAJwk} jwk
+   */
+  static async importJwk(jwk) {
+    const privateKey = await webcrypto.subtle.importKey(
+      'jwk',
+      jwk,
+      {
+        name: 'RSASSA-PKCS1-v1_5',
+        hash: 'SHA-256',
+      },
+      false,
+      ['sign']
+    )
+    const publicKeyJWK = await webcrypto.subtle.importKey(
+      'jwk',
+      { ...jwk, d: undefined },
+      {
+        name: 'RSASSA-PKCS1-v1_5',
+        hash: 'SHA-256',
+      },
+      true,
+      ['verify']
+    )
+
+    const publicKey = await webcrypto.subtle.exportKey('spki', publicKeyJWK)
+
+    return new RSAOldSigner(u8(publicKey), {
+      privateKey,
+      publicKey: publicKeyJWK,
+    })
+  }
+
+  /**
+   * Import a signer from a keypair
+   *
+   * @param {CryptoKeyPair} keypair
+   */
+  static async import(keypair) {
+    const publicKey = await webcrypto.subtle.exportKey(
+      'spki',
+      keypair.publicKey
+    )
+
+    return new RSAOldSigner(u8(publicKey), keypair)
+  }
+
+  /**
+   * Sign a message
+   *
+   * @param {Uint8Array} message
+   */
+  async sign(message) {
+    const buf = await webcrypto.subtle.sign(
+      { name: 'RSASSA-PKCS1-v1_5', saltLength: 128 },
+      this.keypair.privateKey,
+      message
+    )
+
+    return u8(buf)
+  }
+
+  /**
+   * Export the signer as a crypto key pair
+   */
+  export() {
+    return this.keypair
+  }
+}

package/src/signers/rsa.js

@@ -0,0 +1,133 @@
+/* eslint-disable unicorn/numeric-separators-style */
+import { webcrypto } from 'iso-base/crypto'
+import { u8 } from 'iso-base/utils'
+import { DIDKey } from 'iso-did/key'
+import { spki } from '../spki.js'
+
+/**
+ * @typedef {import('../types.js').ISigner<CryptoKeyPair>} ISigner
+ */
+
+/**
+ * RSA signer
+ *
+ * @implements {ISigner}
+ */
+export class RSASigner {
+  /** @type {Extract<import('iso-did/types').SignatureAlgorithm, "RS256">} */
+  static alg = 'RS256'
+
+  /** @type {Extract<import('iso-did/types').KeyType, "RSA">} */
+  static type = 'RSA'
+
+  // multicodec code for RSA private key
+  static code = 0x1305
+
+  /**
+   * @param {Uint8Array} publicKey
+   * @param {CryptoKeyPair} keypair
+   */
+  constructor(publicKey, keypair) {
+    this.keypair = keypair
+    this.publicKey = publicKey
+    this.alg = RSASigner.alg
+    this.type = RSASigner.type
+    this.code = RSASigner.code
+    this.did = DIDKey.fromPublicKey(RSASigner.type, this.publicKey)
+  }
+
+  /**
+   * Generate a new signer
+   */
+  static async generate() {
+    const cryptoKeyPair = await webcrypto.subtle.generateKey(
+      {
+        name: 'RSASSA-PKCS1-v1_5',
+        modulusLength: 2048,
+        publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+        hash: { name: 'SHA-256' },
+      },
+
+      false,
+      ['sign', 'verify']
+    )
+
+    const publicKey = await webcrypto.subtle.exportKey(
+      'spki',
+      cryptoKeyPair.publicKey
+    )
+
+    return new RSASigner(spki.decode(u8(publicKey)), cryptoKeyPair)
+  }
+
+  /**
+   * Import a signer from a JWK
+   *
+   * @param {import('../types.js').PrivateKeyRSAJwk} jwk
+   */
+  static async importJwk(jwk) {
+    const privateKey = await webcrypto.subtle.importKey(
+      'jwk',
+      jwk,
+      {
+        name: 'RSASSA-PKCS1-v1_5',
+        hash: 'SHA-256',
+      },
+      false,
+      ['sign']
+    )
+    const publicKeyJWK = await webcrypto.subtle.importKey(
+      'jwk',
+      { ...jwk, d: undefined },
+      {
+        name: 'RSASSA-PKCS1-v1_5',
+        hash: 'SHA-256',
+      },
+      true,
+      ['verify']
+    )
+
+    const publicKey = await webcrypto.subtle.exportKey('spki', publicKeyJWK)
+
+    return new RSASigner(spki.decode(u8(publicKey)), {
+      privateKey,
+      publicKey: publicKeyJWK,
+    })
+  }
+
+  /**
+   * Import a signer from a keypair
+   *
+   * @param {CryptoKeyPair} keypair
+   */
+  static async import(keypair) {
+    const publicKey = await webcrypto.subtle.exportKey(
+      'spki',
+      keypair.publicKey
+    )
+
+    return new RSASigner(spki.decode(u8(publicKey)), keypair)
+  }
+
+  /**
+   * Sign a message
+   *
+   * @param {Uint8Array} message
+   */
+  async sign(message) {
+    const buf = await webcrypto.subtle.sign(
+      { name: 'RSASSA-PKCS1-v1_5', saltLength: 128 },
+      this.keypair.privateKey,
+      message
+    )
+
+    return u8(buf)
+  }
+
+  /**
+   * Export the signer as a crypto key pair
+   */
+  export() {
+    return this.keypair
+  }
+}

package/src/spki.js

@@ -0,0 +1,39 @@
+import {
+  encodeBitString,
+  encodeSequence,
+  enterSequence,
+  readBitString,
+  skipSequence,
+} from './asn1.js'
+
+/**
+ * SPKI
+ */
+
+const SPKI_PARAMS_ENCODED = new Uint8Array([
+  48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0,
+])
+
+/**
+ * @param {Uint8Array} key
+ */
+function encode(key) {
+  return encodeSequence([SPKI_PARAMS_ENCODED, encodeBitString(key)])
+}
+
+/**
+ * @param {Uint8Array} info
+ */
+function decode(info) {
+  // go into the top-level SEQUENCE
+  const offset = enterSequence(info, 0)
+  // skip the header we expect (SKPI_PARAMS_ENCODED)
+  const keyOffset = skipSequence(info, offset)
+
+  // we expect the bitstring next
+  return readBitString(info, keyOffset)
+}
+export const spki = {
+  encode,
+  decode,
+}

package/src/types.ts

@@ -0,0 +1,75 @@
+import type { DIDKey } from 'iso-did/key'
+import type { SignatureAlgorithm, KeyType } from 'iso-did/types'
+
+export interface ISigner<Export extends CryptoKeyPair | string> {
+  /**
+   * JWT signing algorithm
+   */
+  alg: SignatureAlgorithm
+  /**
+   * Keypair type
+   */
+  type: KeyType
+  /**
+   * Multicodec identifier for the private key
+   */
+  code?: number
+
+  did: DIDKey
+  /**
+   * Sign a message
+   */
+  sign: (message: Uint8Array) => Promise<Uint8Array>
+
+  export: () => Export
+}
+
+export interface VerifyInput {
+  signature: Uint8Array
+  message: Uint8Array
+  publicKey: Uint8Array
+}
+export type Verify = (input: VerifyInput) => Promise<boolean>
+
+export type Verifier<T extends SignatureAlgorithm> = Record<T, Verify>
+
+export type VerifierRegistry<T extends SignatureAlgorithm> = Partial<
+  Verifier<T>
+>
+
+export interface ResolverVerifyInput extends VerifyInput {
+  alg: SignatureAlgorithm
+}
+export type Cache = (parsed: VerifyInput, verify: Verify) => Promise<boolean>
+
+export interface IResolver {
+  verify: (input: ResolverVerifyInput) => Promise<boolean>
+}
+
+export interface ResolverOptions {
+  cache?: Cache | boolean | undefined
+}
+
+export interface PublicKeyJwk {
+  kty: string
+  crv: string
+  x: string
+  y: string
+}
+
+export interface PublicKeyRSAJwk {
+  kty: string
+  n: string
+  e: string
+}
+
+export interface PrivateKeyRSAJwk extends PublicKeyRSAJwk {
+  d: string
+  p: string
+  q: string
+  dp: string
+  dq: string
+  qi: string
+}
+
+export type PrivateKeyJwk = PublicKeyJwk & { d: string }

package/src/utils.js

@@ -0,0 +1,35 @@
+/**
+ * Create web crypto params for ECDSA.
+ *
+ * @param {import("iso-did/types").SignatureAlgorithm} alg
+ * @returns {{name: 'ECDSA', namedCurve: 'P-256' | 'P-384' | 'P-521', hash: 'SHA-256' | 'SHA-384' | 'SHA-512'}}
+ */
+export function createEcdsaParams(alg) {
+  switch (alg) {
+    case 'ES256': {
+      return {
+        name: 'ECDSA',
+        namedCurve: 'P-256',
+        hash: 'SHA-256',
+      }
+    }
+    case 'ES384': {
+      return {
+        name: 'ECDSA',
+        namedCurve: 'P-384',
+        hash: 'SHA-384',
+      }
+    }
+    case 'ES512': {
+      return {
+        name: 'ECDSA',
+        namedCurve: 'P-521',
+        hash: 'SHA-512',
+      }
+    }
+
+    default: {
+      throw new TypeError(`Unsupported algorithm ${alg}`)
+    }
+  }
+}

package/src/verifiers/ecdsa.js

@@ -0,0 +1,56 @@
+/* eslint-disable unicorn/numeric-separators-style */
+import { webcrypto } from 'iso-base/crypto'
+import { decompress, isCompressed } from 'iso-base/ec-compression'
+import { createEcdsaParams } from '../utils.js'
+
+/**
+ *
+ * @param {import('iso-did/types').SignatureAlgorithm} type
+ */
+function createVerifier(type) {
+  const params = createEcdsaParams(type)
+
+  /** @type {import('../types.js').Verify} */
+  async function fn({ signature, message, publicKey }) {
+    if (isCompressed(publicKey)) {
+      publicKey = decompress(publicKey, params.namedCurve)
+    }
+
+    const key = await webcrypto.subtle.importKey(
+      'raw',
+      publicKey,
+      { name: params.name, namedCurve: params.namedCurve },
+      true,
+      ['verify']
+    )
+
+    return await webcrypto.subtle.verify(
+      {
+        name: params.name,
+        hash: { name: params.hash },
+      },
+      key,
+      signature,
+      message
+    )
+  }
+
+  return fn
+}
+
+/** @type {import('../types.js').Verifier<'ES256' | 'ES384' | 'ES512'>} */
+export const verifier = {
+  ES256: createVerifier('ES256'),
+  ES384: createVerifier('ES384'),
+  ES512: createVerifier('ES512'),
+}
+
+/**
+ *
+ * @param {'ES256' | 'ES384' | 'ES512'} type
+ * @param {import('../types.js').VerifyInput} param1
+ * @returns
+ */
+export async function verify(type, { signature, message, publicKey }) {
+  return await verifier[type]({ signature, message, publicKey })
+}

package/src/verifiers/eddsa.js

@@ -0,0 +1,12 @@
+/* eslint-disable unicorn/numeric-separators-style */
+import { verifyAsync } from '@noble/ed25519'
+
+/** @type {import('../types').Verify} */
+export function verify({ signature, message, publicKey }) {
+  return verifyAsync(signature, message, publicKey)
+}
+
+/** @type {import('../types').Verifier<'EdDSA'>} */
+export const verifier = {
+  EdDSA: verify,
+}