-
Notifications
You must be signed in to change notification settings - Fork 42
Description
RsaSignature2018 is broken in VC context v1. More info in: w3c/vc-data-model#778
For that reason, in vc.js the canonicalization of a RsaSignature2018 proof is not being expanded. The result of the library is like this:
_:c14n0 <http://purl.org/dc/terms/created> "2023-06-03T20:00:01Z"^^<xsd:dateTime> .
_:c14n0 <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://w3id.org/security#RsaSignature2018> .
_:c14n0 <sec:proofPurpose> <https://w3id.org/security#assertionMethod> .
_:c14n0 <sec:verificationMethod> <urn:oid:2.16.858.0.0.0.3.0#1> .
when it should be like this:
_:c14n0 <http://purl.org/dc/terms/created> "2023-06-03T20:00:01Z"^^<http://www.w3.org/2001/XMLSchema#dateTime> .
_:c14n0 <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://w3id.org/security#RsaSignature2018> .
_:c14n0 <https://w3id.org/security#proofPurpose> <https://w3id.org/security#assertionMethod> .
_:c14n0 <https://w3id.org/security#verificationMethod> <urn:oid:2.16.858.0.0.0.3.0#1> .
After some discussion in w3c/vc-data-model#1151, seems that the correct solution to preserve interoperability with another implementations, is to expand the items as they should be.
For that, I am proposing a specific fix that can be done at LinkedDataSignature or JwsLinkedDataSignature.
I picture something like, if "RsaSignature2018" then apply a fix to expand correctly during canonicalization. Might be done in the createVerifyData method. At JwsLinkedDataSignature level, will be less "intrusive", and we could override that specific method.
Reproducer: https://github.com/fabrii/dc-playground
Thanks!