Skip to content

RSA Proof wrong canonicalization #174

@fabrii

Description

@fabrii

RsaSignature2018 is broken in VC context v1. More info in: w3c/vc-data-model#778

For that reason, in vc.js the canonicalization of a RsaSignature2018 proof is not being expanded. The result of the library is like this:

_:c14n0 <http://purl.org/dc/terms/created> "2023-06-03T20:00:01Z"^^<xsd:dateTime> .
_:c14n0 <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://w3id.org/security#RsaSignature2018> .
_:c14n0 <sec:proofPurpose> <https://w3id.org/security#assertionMethod> .
_:c14n0 <sec:verificationMethod> <urn:oid:2.16.858.0.0.0.3.0#1> .

when it should be like this:

_:c14n0 <http://purl.org/dc/terms/created> "2023-06-03T20:00:01Z"^^<http://www.w3.org/2001/XMLSchema#dateTime> .
_:c14n0 <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://w3id.org/security#RsaSignature2018> .
_:c14n0 <https://w3id.org/security#proofPurpose> <https://w3id.org/security#assertionMethod> .
_:c14n0 <https://w3id.org/security#verificationMethod> <urn:oid:2.16.858.0.0.0.3.0#1> .

After some discussion in w3c/vc-data-model#1151, seems that the correct solution to preserve interoperability with another implementations, is to expand the items as they should be.
For that, I am proposing a specific fix that can be done at LinkedDataSignature or JwsLinkedDataSignature.

I picture something like, if "RsaSignature2018" then apply a fix to expand correctly during canonicalization. Might be done in the createVerifyData method. At JwsLinkedDataSignature level, will be less "intrusive", and we could override that specific method.

Reproducer: https://github.com/fabrii/dc-playground

Thanks!

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions