feat: new key management service with multiple backends #2203

TimoGlastra · 2025-02-22T08:16:07Z

~~Still quite some stuff to do, but wanted to open as draft so it's easy to track my progress / see the changes.~~

TODO:

Signed-off-by: Timo Glastra <timo@animo.id>

changeset-bot · 2025-02-22T08:16:10Z

🦋 Changeset detected

Latest commit: e6f74f2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 14 packages

Name	Type
@credo-ts/core	Minor
@credo-ts/indy-sdk-to-askar-migration	Minor
@credo-ts/question-answer	Minor
@credo-ts/react-native	Minor
@credo-ts/action-menu	Minor
@credo-ts/anoncreds	Minor
@credo-ts/openid4vc	Minor
@credo-ts/indy-vdr	Minor
@credo-ts/didcomm	Minor
@credo-ts/tenants	Minor
@credo-ts/askar	Minor
@credo-ts/cheqd	Minor
@credo-ts/drpc	Minor
@credo-ts/node	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

TimoGlastra · 2025-02-22T08:19:12Z

packages/askar/src/AskarApi.ts

+   * @throws {AskarStoreNotFoundError} if the wallet does not exist
+   * @throws {AskarStoreError} if another error occurs
+   */
+  public async rotateStoreKey(options: AskarStoreRotateKeyOptions): Promise<void> {


Askar specific operations will now be part of the askar api. So there's no global rotateWalletKey anymore, as that's specific to Askars way of doing this.

TimoGlastra · 2025-02-22T08:20:33Z

packages/askar/src/AskarModule.ts

    }
  }
+
+  public async onProvisionContext(agentContext: AgentContext) {


I added new module methods:

onProvisionContext

onCloseContext

onDeleteContext

onInitializeContext

this will allow for lifecycle handling of specific contexts

This is really great!

TimoGlastra · 2025-02-22T08:20:44Z

packages/askar/src/AskarModuleConfig.ts

  ProfilePerWallet = 'ProfilePerWallet',
 }

+export interface AskarModuleConfigStoreOptions {


Wallet config is now askar specific

Signed-off-by: Timo Glastra <timo@animo.id>

…ore generic, support multiple backends at the same time, support generic encrypting and decryption, support symmetric keys, and enable backends that use key ids rather than the public key to identify a key. This has resulted in significant breaking changes, and all usages of the wallet api should be updated to use the new `agent.kms` APIs. In addition the wallet is not available anymore on the agentContext. If you used this, instead inject the KMS API using `agentContext.resolve(Kms.KeyManagementApi)`. Signed-off-by: Timo Glastra <timo@animo.id>

…our of a new `PublicJwk` class, and all APIs in Credo have been updated to use the new `PublicJwk` class. Leveraging Jwk as the base for all APIs provides more flexility and makes it easier to support key types where it's not always so easy to extract the raw public key bytes. In addition all the previous Jwk relatedfunctionality has been replaced with the new KMS jwk functionalty. For example `JwaSignatureAlgorithm` is now `Kms.KnownJwaSignatureAlgorithms`. Signed-off-by: Timo Glastra <timo@animo.id>

…that all DIDs have an associated `DidRecord` with the created role. With the new KMS API we now need to keep track of key ids for keys within a did document, and these are stored on the did document. You can import a did using `agent.dids.import` and provide the `keys` array to define the mapping between verification method and key id. If a verification method mapping to key id is not provided in the did record, we will assume the legacy key id format is used (the base58 encoded public key) Signed-off-by: Timo Glastra <timo@animo.id>

…reference a key id. For DIDs this is extracted from the DidRecord, and for JWKs (e.g. in holder binding) this is extracted form the `kid` of the JWK. For X509 certificates you need to make sure there is a key id attached to the certificate manually for now, since we don't have a X509 record like we have a DidRecord. For x509 certificates created before 0.6 you can use the legacy key id (`certificate.keyId = certificate.publicJwk.legacyKeyId`), for certificates created after 0.6 you need to manually store the key id and set it on the certificate after decoding. Signed-off-by: Timo Glastra <timo@animo.id>

Signed-off-by: Timo Glastra <timo@animo.id>

…nt config, to allow for more flexibility. Instead, each module can now define their own config for the storage and kms. For askar there is a new `store` property which must be provided on the askar module config where you can set the wallet id and key. It is also possible to disable the kms or storage for askar using `enableKms` and `enableStorage`. Signed-off-by: Timo Glastra <timo@animo.id>

Signed-off-by: Timo Glastra <timo@animo.id>

berendsliedrecht

611 files, Only took me half a day :).

I think there are a lot of good, and necessary, changes here. The main things I think can be better DX-wise, are the import key API to also accept privatekey bytes instead of converting it manually before to a jwk, using keyType instead of kty (curve instead of crv, etc.) when importing a key. This makes more sense to me as we pass them outside of the jwk object/class I think. (If this is incorrect, feel free to ignore, its hard to remember the details haha). And the randomBytes API might need an async counterpart for the use of remote CSPRNGs, or just any async one.

berendsliedrecht · 2025-05-14T09:35:59Z

packages/askar/src/AskarModuleConfig.ts

+   *
+   * @default 'kdf:argon2i:mod'
+   */
+  keyDerivationMethod?: `${KdfMethod.Argon2IInt}` | `${KdfMethod.Argon2IMod}` | `${KdfMethod.Raw}`


I think if we add the None here, we resolve #2277

Is it ok to do this in a follow up PR? It will require additional tests to make sure it works and don't want to expand the scope any further

packages/askar/src/AskarStoreManager.ts

packages/core/src/modules/kms/jwk/humanDescription.ts

packages/core/src/modules/kms/jwk/jwa.ts

packages/core/src/modules/kms/jwk/kty/ec/ecSignature.ts

packages/core/src/modules/kms/options/KmsRandomBytesOptions.ts

packages/core/src/utils/type.ts

genaris

Amazing work, @TimoGlastra ! I think it is a big step towards making the framework more flexible and moving away from legacy Askar storage

packages/askar/src/kms/AskarKeyManagementService.ts

demo-openid/src/Holder.ts

demo/src/BaseAgent.ts

demo/src/Faber.ts

packages/core/src/modules/kms/KeyManagementApi.ts

genaris · 2025-05-14T20:52:18Z

packages/didcomm/src/getOutboundMessageContext.ts

@@ -91,6 +91,9 @@ export async function getConnectionlessOutboundMessageContext(
    `Creating outbound message context for message ${message.id} using connection-less exchange`
  )

+  // FIXME: we should remove support for the flow where no out of band record is used.


I agree but we should deprecate connections API first I guess. If we do a refactor merging functionalities from connections and oob for 0.6, probably it is safe to remove this support in 0.7

We can already deprecate this flow i think? This is where you receive a connectionless legacy message by calling receiveMessage on the message receiver directly, and thus OOB is skipped.

This flow is already deprecated for quite a while, and you should just use agent.oob.recevieInvitationFromUrl instead.

packages/core/src/modules/kms/KeyManagementApi.ts

genaris · 2025-05-14T21:12:16Z

packages/askar/src/AskarModule.ts

    }
  }
+
+  public async onProvisionContext(agentContext: AgentContext) {


This is really great!

packages/askar/src/AskarModule.ts

TimoGlastra · 2025-05-15T13:30:21Z

are the import key API to also accept privatekey bytes instead of converting it manually before to a jwk, using keyType instead of kty (curve instead of crv, etc.) when importing a key

I tried to stay as consistent with JWK apis to not create inconsistencies, because if we do it for importKey, we should do it for createKey, and there I wanted to stay aligned with JWK so there's no possibility of inconsistency.

Regarding the private key, i wanted to be careful of this, as private key is often not enough. The encoding of the private key matters, and this can differ between algorithms. Do you have any suggestions on how to consistently transform from a private key to private jwk? I'm not 100% sure which encoding askar expects, and whether that will work for all key types (like RSA?).

For example if you look at the importKey from webcrypto, you can 4 formatS:

RAW
PKCS Additional repo improvements #8
SPKI
JWK

For private keys you can only use RAW for AES or HMAC secret keys. Otherwise you need to use another format. So we'd need to add a importKey with format and then support different format types. We could e.g. support SPKI because of the ASN.1 support we have, but still not sure about RAW. I would rather add better conversion utils outside of the specific crypto backends, but it can be quite complex to do the transformation without a crypto implementation.

So input welcome, but I'd rather move this to a follow up PR if we have a concrete plan

Signed-off-by: Timo Glastra <timo@animo.id>

TimoGlastra · 2025-05-15T18:03:56Z

I will address the remaining taks in follow up PR:

move the generic JWK stuff to jose directory
generalize the public key extraction, with a format
add unencrypted askar support
export from @credo-ts/core/kms
add pre-hashes algorithms, for X509 signing
remove usages of verkey completely

ajile-in · 2025-05-23T17:04:32Z

This is really amazing work @TimoGlastra

…oundation#2203) Signed-off-by: Timo Glastra <timo@animo.id> Signed-off-by: Ariel Gentile <gentilester@gmail.com>

TimoGlastra added 5 commits November 30, 2024 20:11

feat: kms for secure env, node, askar

39b3ea3

Signed-off-by: Timo Glastra <timo@animo.id>

temp

d9d73f6

Signed-off-by: Timo Glastra <timo@animo.id>

Merge remote-tracking branch 'upstream/main' into feat/kms

02d5e49

temp

ba5ae40

Signed-off-by: Timo Glastra <timo@animo.id>

chore: valibot to zod

1e35cf3

Signed-off-by: Timo Glastra <timo@animo.id>

TimoGlastra commented Feb 22, 2025

View reviewed changes

TimoGlastra added 10 commits April 7, 2025 22:32

Merge remote-tracking branch 'upstream/main' into feat/kms

b605d0d

a lot of changes

70085ce

Signed-off-by: Timo Glastra <timo@animo.id>

tenants package working

05043b0

Signed-off-by: Timo Glastra <timo@animo.id>

qa package working

eda0701

Signed-off-by: Timo Glastra <timo@animo.id>

drpc package working

6bc2963

Signed-off-by: Timo Glastra <timo@animo.id>

cheqd package working

2409e45

Signed-off-by: Timo Glastra <timo@animo.id>

askar package working

1afa3ba

Signed-off-by: Timo Glastra <timo@animo.id>

action menu package works

2a4f595

Signed-off-by: Timo Glastra <timo@animo.id>

indy vdr package working

064fb32

Signed-off-by: Timo Glastra <timo@animo.id>

test: v2-indy-connectionless-proofs.e2e.test.ts working

5f960c9

Signed-off-by: Timo Glastra <timo@animo.id>

TimoGlastra mentioned this pull request Apr 29, 2025

Replace InjectionSymbols.Stop$ #2268

Open

TimoGlastra added 8 commits May 1, 2025 11:22

fixed more modules

f70f883

Signed-off-by: Timo Glastra <timo@animo.id>

connections module working

a1aa274

Signed-off-by: Timo Glastra <timo@animo.id>

didcomm package working

2fa433a

Signed-off-by: Timo Glastra <timo@animo.id>

anoncreds package working

caa0d18

Signed-off-by: Timo Glastra <timo@animo.id>

fix: revert bbs in kms

df2b5fa

Signed-off-by: Timo Glastra <timo@animo.id>

docs(changeset): refactor!: remove support for BBS signatures

47d93fe

Signed-off-by: Timo Glastra <timo@animo.id>

remove Key and KeyType

cfa36cb

Signed-off-by: Timo Glastra <timo@animo.id>

more updates

5d2926a

Signed-off-by: Timo Glastra <timo@animo.id>

TimoGlastra mentioned this pull request May 6, 2025

Out of band record state should already be updated to done when the out of band message is handled #2269

Open

more updates

6963e16

Signed-off-by: Timo Glastra <timo@animo.id>

TimoGlastra added 10 commits May 12, 2025 16:55

fix test

c2e2718

Signed-off-by: Timo Glastra <timo@animo.id>

Merge remote-tracking branch 'upstream/main' into feat/kms

9c268c5

fix type errors

7b13bdb

Signed-off-by: Timo Glastra <timo@animo.id>

fix type errors

324f8ad

Signed-off-by: Timo Glastra <timo@animo.id>

fix type errors

90cca62

Signed-off-by: Timo Glastra <timo@animo.id>

TimoGlastra marked this pull request as ready for review May 12, 2025 15:43

TimoGlastra requested a review from a team as a code owner May 12, 2025 15:43

TimoGlastra added 3 commits May 12, 2025 17:48

fix some tets

0e31465

Signed-off-by: Timo Glastra <timo@animo.id>

fix demo

9aaae00

Signed-off-by: Timo Glastra <timo@animo.id>

increase timeout as RSA signatures are kinda slow

cd40964

Signed-off-by: Timo Glastra <timo@animo.id>

berendsliedrecht reviewed May 14, 2025

View reviewed changes

genaris reviewed May 14, 2025

View reviewed changes

genaris approved these changes May 14, 2025

View reviewed changes

berendsliedrecht mentioned this pull request May 15, 2025

feat: redis cache #2286

Closed

Merge remote-tracking branch 'upstream/main' into feat/kms

132246d

TimoGlastra added 4 commits May 15, 2025 16:21

first batch of feedback

40bccfd

Signed-off-by: Timo Glastra <timo@animo.id>

more feedback

c4eb831

Signed-off-by: Timo Glastra <timo@animo.id>

make jwk private

41defce

Signed-off-by: Timo Glastra <timo@animo.id>

refactor key vs keyId

e6f74f2

Signed-off-by: Timo Glastra <timo@animo.id>

TimoGlastra merged commit e936068 into openwallet-foundation:main May 15, 2025
20 checks passed

genaris mentioned this pull request May 21, 2025

fix: remove Wallet injection symbol #2293

Merged

genaris pushed a commit to genaris/credo-ts that referenced this pull request Oct 9, 2025

feat: new key management service with multiple backends (openwallet-f…

94b0ead

…oundation#2203) Signed-off-by: Timo Glastra <timo@animo.id> Signed-off-by: Ariel Gentile <gentilester@gmail.com>

feat: new key management service with multiple backends #2203

feat: new key management service with multiple backends #2203

Uh oh!

Conversation

TimoGlastra commented Feb 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Feb 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

berendsliedrecht left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

genaris left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

TimoGlastra commented May 15, 2025

Uh oh!

Uh oh!

TimoGlastra commented May 15, 2025

Uh oh!

ajile-in commented May 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

TimoGlastra commented Feb 22, 2025 •

edited

Loading

changeset-bot bot commented Feb 22, 2025 •

edited

Loading