akramer/digital-credentials-public-validator
akramer/digital-credentials-public-validator
0
0
Fork 0
Code Issues Pull Requests Activity

WIP, signature additions.

Browse Source
This commit is contained in:
Miles Lyon 2022-06-24 15:16:28 -04:00
parent a913ac97d8
commit 98e00ccf48
5 changed files with 104 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
inspector-vc/pom.xml
View File

@ -11,5 +11,30 @@
<groupId>org.1edtech</groupId>
<artifactId>inspector-core</artifactId>
</dependency>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk15on</artifactId>
<version>1.58</version>
</dependency>
<dependency>
<groupId>com.auth0</groupId>
<artifactId>auth0</artifactId>
<version>1.20.0</version>
</dependency>
<dependency>
<groupId>com.auth0</groupId>
<artifactId>jwks-rsa</artifactId>
<version>0.12.0</version>
</dependency>
<dependency>
<groupId>com.auth0</groupId>
<artifactId>java-jwt</artifactId>
<version>3.10.3</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-core</artifactId>
<version>5.0.12.RELEASE</version>
</dependency>
</dependencies>
</project>

4
inspector-vc/src/main/java/org/oneedtech/inspect/vc/Credential.java
View File

@ -53,6 +53,10 @@ public class Credential extends GeneratedObject {
return credentialType;
}
public String getJwt() {
return jwt;
}
/**
* Get the canonical schema for this credential if such exists.
*/

11
inspector-vc/src/main/java/org/oneedtech/inspect/vc/OB30Inspector.java
View File

@ -6,6 +6,7 @@ import static org.oneedtech.inspect.core.report.ReportUtil.onProbeException;
import static org.oneedtech.inspect.util.json.ObjectMapperCache.Config.DEFAULT;
import static org.oneedtech.inspect.vc.EndorsementInspector.ENDORSEMENT_KEY;
import static org.oneedtech.inspect.vc.util.JsonNodeUtil.getEndorsements;
import static com.google.common.base.Strings.isNullOrEmpty;
import java.net.URI;
import java.util.ArrayList;
@ -105,10 +106,12 @@ public class OB30Inspector extends VCInspector {
probeCount++;
accumulator.add(new InlineJsonSchemaProbe().run(crd, ctx));
//verify signatures TODO @Miles
probeCount++;
accumulator.add(new SignatureVerifierProbe().run(crd, ctx));
if(broken(accumulator)) return abort(ctx, accumulator, probeCount);
//If this credential was originally contained in a JWT we must validate the jwt and external proof.
if(!isNullOrEmpty(crd.getJwt())){
probeCount++;
accumulator.add(new SignatureVerifierProbe().run(crd, ctx));
if(broken(accumulator)) return abort(ctx, accumulator, probeCount);
}
//verify proofs TODO @Miles
probeCount++;

5
inspector-vc/src/main/java/org/oneedtech/inspect/vc/probe/CredentialTypeProbe.java
View File

@ -49,18 +49,13 @@ public class CredentialTypeProbe extends Probe<Resource> {
if(type.isPresent()) {
resource.setType(type.get());
//TODO: Refactor to return the entire credential so we can include optional encoded JWT.
if(type.get() == ResourceType.PNG) {
//crd = new Credential(resource, fromPNG(resource, context));
crd = fromPNG(resource, context);
} else if(type.get() == ResourceType.SVG) {
//crd = new Credential(resource, fromSVG(resource, context));
crd = fromSVG(resource, context);
} else if(type.get() == ResourceType.JSON) {
//crd = new Credential(resource, fromJson(resource, context));
crd = fromJson(resource, context);
} else if(type.get() == ResourceType.JWT) {
//crd = new Credential(resource, fromJWT(resource, context));
crd = fromJWT(resource, context);
}
}

70
inspector-vc/src/main/java/org/oneedtech/inspect/vc/probe/SignatureVerifierProbe.java
View File

@ -1,9 +1,30 @@
package org.oneedtech.inspect.vc.probe;
import static com.google.common.base.Strings.isNullOrEmpty;
import java.math.BigInteger;
import java.nio.charset.StandardCharsets;
import java.security.KeyFactory;
import java.security.PublicKey;
import java.security.interfaces.RSAPublicKey;
import java.security.spec.RSAPublicKeySpec;
import java.util.List;
import java.util.Base64;
import java.util.Base64.Decoder;
import org.oneedtech.inspect.core.probe.Probe;
import org.oneedtech.inspect.core.probe.RunContext;
import org.oneedtech.inspect.core.report.ReportItems;
import org.oneedtech.inspect.vc.Credential;
import org.springframework.util.Base64Utils;
import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.interfaces.DecodedJWT;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.google.common.base.Splitter;
/**
* A Probe that verifies credential signatures
@ -17,12 +38,57 @@ public class SignatureVerifierProbe extends Probe<Credential> {
@Override
public ReportItems run(Credential crd, RunContext ctx) throws Exception {
//TODO @Miles -- if sigs fail, report OutCome.Fatal
try {
testingSignatureValidationCode(crd);
} catch (Exception e) {
return fatal("Error verifying jwt signature: " + e.getMessage(), ctx);
}
return success(ctx);
}
private void testingSignatureValidationCode(Credential crd) throws Exception {
DecodedJWT decodedJwt = null;
String jwt = crd.getJwt();
if(isNullOrEmpty(jwt)) throw new IllegalArgumentException("invalid jwt");
List<String> parts = Splitter.on('.').splitToList(jwt);
if(parts.size() != 3) throw new IllegalArgumentException("invalid jwt");
final Decoder decoder = Base64.getUrlDecoder();
String joseHeader = new String(decoder.decode(parts.get(0)));
ObjectMapper mapper = new ObjectMapper();
JsonNode headerObj = mapper.readTree(joseHeader);
//MUST be "RS256"
//Option 1, fetch directly from header
JsonNode jwk = headerObj.get("jwk");
//Option 2, fetch from a hosting url
JsonNode kid = headerObj.get("kid");
if(jwk == null && kid == null) { throw new Exception("asdf"); }
if(kid != null){
//TODO @Miles load jwk JsonNode from url and do the rest the same below. Need to set up testing.
String kidUrl = kid.textValue();
}
//Clean up may be required. Currently need to cleanse extra double quoting.
String modulusString = jwk.get("n").textValue();
String exponentString = jwk.get("e").textValue();
BigInteger modulus = new BigInteger(1, org.springframework.util.Base64Utils.decodeFromUrlSafeString(modulusString));
BigInteger exponent = new BigInteger(1, org.springframework.util.Base64Utils.decodeFromUrlSafeString(exponentString));
PublicKey pub = KeyFactory.getInstance("RSA").generatePublic(new RSAPublicKeySpec(modulus, exponent));
Algorithm algorithm = Algorithm.RSA256((RSAPublicKey)pub, null);
JWTVerifier verifier = JWT.require(algorithm)
.build(); //Reusable verifier instance
decodedJwt = verifier.verify(jwt);
}
public static final String ID = SignatureVerifierProbe.class.getSimpleName();
}