Developing a Signer for P-256. (work in progress)

package.json

@@ -58,6 +58,7 @@
     "@semantic-release/git": "9.0.1",
     "@types/elliptic": "6.4.14",
     "@types/jest": "27.0.3",
+    "@types/jsonwebtoken": "^8.5.8",
     "@typescript-eslint/eslint-plugin": "4.33.0",
     "@typescript-eslint/parser": "4.33.0",
     "codecov": "3.8.2",
@@ -67,6 +68,7 @@
     "eslint-plugin-prettier": "4.0.0",
     "jest": "27.4.5",
     "jsontokens": "3.0.0",
+    "jwk-to-pem": "^2.0.5",
     "microbundle": "0.14.2",
     "mockdate": "3.0.5",
     "prettier": "2.5.1",

src/JWE.ts

@@ -1,3 +1,4 @@
+import { fromString } from 'uint8arrays'
 import { base64ToBytes, bytesToBase64url, decodeBase64url, toSealed } from './util'
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -128,7 +129,7 @@ export async function decryptJWE(jwe: JWE, decrypter: Decrypter): Promise<Uint8A
   if (protHeader.enc !== decrypter.enc)
     throw new Error(`not_supported: Decrypter does not supported: '${protHeader.enc}'`)
   const sealed = toSealed(jwe.ciphertext, jwe.tag)
-  const aad = new Uint8Array(Buffer.from(jwe.aad ? `${jwe.protected}.${jwe.aad}` : jwe.protected))
+  const aad = fromString(jwe.aad ? `${jwe.protected}.${jwe.aad}` : jwe.protected)
   let cleartext = null
   if (protHeader.alg === 'dir' && decrypter.alg === 'dir') {
     cleartext = await decrypter.decrypt(sealed, base64ToBytes(jwe.iv), aad)

src/JWT.ts

@@ -91,6 +91,8 @@ export interface PublicKeyTypes {
   [name: string]: string[]
 }
 export const SUPPORTED_PUBLIC_KEY_TYPES: PublicKeyTypes = {
+  ES256: ['JsonWebKey2020', 'EcdsaSecp256r1VerificationKey2022'],
+  'ES256-R': ['JsonWebKey2020', 'EcdsaSecp256r1VerificationKey2022'],
   ES256K: [
     'EcdsaSecp256k1VerificationKey2019',
     /**

src/SignerAlg/CommonSignerAlg.ts

@@ -0,0 +1,6 @@
+import { EcdsaSignature } from '../util'
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function instanceOfEcdsaSignature(object: any): object is EcdsaSignature {
+  return typeof object === 'object' && 'r' in object && 's' in object
+}

src/SignerAlg/ES256KSignerAlg.ts

@@ -0,0 +1,17 @@
+import { Signer, SignerAlgorithm } from '../JWT'
+import { EcdsaSignature, fromJose, toJose } from '../util'
+import * as CommonSignerAlg from './CommonSignerAlg'
+
+export function ES256KSignerAlg(recoverable?: boolean): SignerAlgorithm {
+  return async function sign(payload: string, signer: Signer): Promise<string> {
+    const signature: EcdsaSignature | string = await signer(payload)
+    if (CommonSignerAlg.instanceOfEcdsaSignature(signature)) {
+      return toJose(signature, recoverable)
+    } else {
+      if (recoverable && typeof fromJose(signature).recoveryParam === 'undefined') {
+        throw new Error(`not_supported: ES256K-R not supported when signer doesn't provide a recovery param`)
+      }
+      return signature
+    }
+  }
+}

src/SignerAlg/ES256SignerAlg.ts

@@ -0,0 +1,17 @@
+import { Signer, SignerAlgorithm } from '../JWT'
+import { EcdsaSignature, fromJose, toJose } from '../util'
+import * as CommonSignerAlg from './CommonSignerAlg'
+
+export function ES256SignerAlg(recoverable?: boolean): SignerAlgorithm {
+  return async function sign(payload: string, signer: Signer): Promise<string> {
+    const signature: EcdsaSignature | string = await signer(payload)
+    if (CommonSignerAlg.instanceOfEcdsaSignature(signature)) {
+      return toJose(signature, recoverable)
+    } else {
+      if (recoverable && typeof fromJose(signature).recoveryParam === 'undefined') {
+        throw new Error(`not_supported: ES256-R not supported when signer doesn't provide a recovery param`)
+      }
+      return signature
+    }
+  }
+}

src/SignerAlg/Ed25519SignerAlg.ts

@@ -0,0 +1,14 @@
+import { Signer, SignerAlgorithm } from '../JWT'
+import { EcdsaSignature } from '../util'
+import * as CommonSignerAlg from './CommonSignerAlg'
+
+export function Ed25519SignerAlg(): SignerAlgorithm {
+  return async function sign(payload: string, signer: Signer): Promise<string> {
+    const signature: EcdsaSignature | string = await signer(payload)
+    if (!CommonSignerAlg.instanceOfEcdsaSignature(signature)) {
+      return signature
+    } else {
+      throw new Error('invalid_config: expected a signer function that returns a string instead of signature object')
+    }
+  }
+}

src/SignerAlgorithm.ts

@@ -1,49 +1,25 @@
-import { Signer, SignerAlgorithm } from './JWT'
-import { EcdsaSignature, fromJose, toJose } from './util'
+import { SignerAlgorithm } from './JWT'
 
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-function instanceOfEcdsaSignature(object: any): object is EcdsaSignature {
-  return typeof object === 'object' && 'r' in object && 's' in object
-}
-
-export function ES256KSignerAlg(recoverable?: boolean): SignerAlgorithm {
-  return async function sign(payload: string, signer: Signer): Promise<string> {
-    const signature: EcdsaSignature | string = await signer(payload)
-    if (instanceOfEcdsaSignature(signature)) {
-      return toJose(signature, recoverable)
-    } else {
-      if (recoverable && typeof fromJose(signature).recoveryParam === 'undefined') {
-        throw new Error(`not_supported: ES256K-R not supported when signer doesn't provide a recovery param`)
-      }
-      return signature
-    }
-  }
-}
+import * as ES256KSignerAlg from './SignerAlg/ES256KSignerAlg'
+import * as Ed25519SignerAlg from './SignerAlg/Ed25519SignerAlg'
 
-export function Ed25519SignerAlg(): SignerAlgorithm {
-  return async function sign(payload: string, signer: Signer): Promise<string> {
-    const signature: EcdsaSignature | string = await signer(payload)
-    if (!instanceOfEcdsaSignature(signature)) {
-      return signature
-    } else {
-      throw new Error('invalid_config: expected a signer function that returns a string instead of signature object')
-    }
-  }
-}
+import * as ES256SignerAlg from './SignerAlg/ES256SignerAlg'
 
 interface SignerAlgorithms {
   [alg: string]: SignerAlgorithm
 }
 
 const algorithms: SignerAlgorithms = {
-  ES256K: ES256KSignerAlg(),
+  ES256: ES256SignerAlg.ES256SignerAlg(),
+  'ES256-R': ES256SignerAlg.ES256SignerAlg(true),
+  ES256K: ES256KSignerAlg.ES256KSignerAlg(),
   // This is a non-standard algorithm but retained for backwards compatibility
   // see https://github.com/decentralized-identity/did-jwt/issues/146
-  'ES256K-R': ES256KSignerAlg(true),
+  'ES256K-R': ES256KSignerAlg.ES256KSignerAlg(true),
   // This is actually incorrect but retained for backwards compatibility
   // see https://github.com/decentralized-identity/did-jwt/issues/130
-  Ed25519: Ed25519SignerAlg(),
-  EdDSA: Ed25519SignerAlg(),
+  Ed25519: Ed25519SignerAlg.Ed25519SignerAlg(),
+  EdDSA: Ed25519SignerAlg.Ed25519SignerAlg(),
 }
 
 function SignerAlg(alg: string): SignerAlgorithm {

src/VerifierAlg/CommonVerifierAlg.ts

@@ -0,0 +1,59 @@
+import { ec as EC } from 'elliptic'
+import type { VerificationMethod } from 'did-resolver'
+import { bases } from 'multiformats/basics'
+import { hexToBytes, base58ToBytes, base64ToBytes, bytesToHex, EcdsaSignature } from '../util'
+
+const secp256k1 = new EC('secp256k1')
+const secp256r1 = new EC('p256')
+
+// converts a JOSE signature to it's components
+export function toSignatureObject(signature: string, recoverable = false): EcdsaSignature {
+  const rawSig: Uint8Array = base64ToBytes(signature)
+  if (rawSig.length !== (recoverable ? 65 : 64)) {
+    throw new Error('wrong signature length')
+  }
+  const r: string = bytesToHex(rawSig.slice(0, 32))
+  const s: string = bytesToHex(rawSig.slice(32, 64))
+  const sigObj: EcdsaSignature = { r, s }
+  if (recoverable) {
+    sigObj.recoveryParam = rawSig[64]
+  }
+  return sigObj
+}
+
+interface LegacyVerificationMethod extends VerificationMethod {
+  publicKeyBase64: string
+}
+
+export function extractPublicKeyBytes(pk: VerificationMethod): Uint8Array {
+  if (pk.publicKeyBase58) {
+    return base58ToBytes(pk.publicKeyBase58)
+  } else if ((<LegacyVerificationMethod>pk).publicKeyBase64) {
+    return base64ToBytes((<LegacyVerificationMethod>pk).publicKeyBase64)
+  } else if (pk.publicKeyHex) {
+    return hexToBytes(pk.publicKeyHex)
+  } else if (pk.publicKeyJwk && pk.publicKeyJwk.crv === 'secp256k1' && pk.publicKeyJwk.x && pk.publicKeyJwk.y) {
+    return hexToBytes(
+      secp256k1
+        .keyFromPublic({
+          x: bytesToHex(base64ToBytes(pk.publicKeyJwk.x)),
+          y: bytesToHex(base64ToBytes(pk.publicKeyJwk.y)),
+        })
+        .getPublic('hex')
+    )
+  } else if (pk.publicKeyJwk && pk.publicKeyJwk.crv === 'P-256' && pk.publicKeyJwk.x && pk.publicKeyJwk.y) {
+    return hexToBytes(
+      secp256r1
+        .keyFromPublic({
+          x: bytesToHex(base64ToBytes(pk.publicKeyJwk.x)),
+          y: bytesToHex(base64ToBytes(pk.publicKeyJwk.y)),
+        })
+        .getPublic('hex')
+    )
+  } else if (pk.publicKeyMultibase) {
+    const { base16, base58btc, base64, base64url } = bases
+    const baseDecoder = base16.decoder.or(base58btc.decoder.or(base64.decoder.or(base64url.decoder)))
+    return baseDecoder.decode(pk.publicKeyMultibase)
+  }
+  return new Uint8Array()
+}

src/VerifierAlg/ES256KVerifierAlg.ts

@@ -0,0 +1,91 @@
+import { ec as EC, SignatureInput } from 'elliptic'
+import { sha256, toEthereumAddress } from '../Digest'
+import type { VerificationMethod } from 'did-resolver'
+import { bytesToHex, EcdsaSignature } from '../util'
+import { verifyBlockchainAccountId } from '../blockchains'
+import * as CommonVerifierAlg from './CommonVerifierAlg'
+
+const secp256k1 = new EC('secp256k1')
+
+/*
+interface LegacyVerificationMethod extends VerificationMethod {
+  publicKeyBase64: string
+}
+*/
+
+export function verifyES256K(
+  data: string,
+  signature: string,
+  authenticators: VerificationMethod[]
+): VerificationMethod {
+  const hash: Uint8Array = sha256(data)
+  const sigObj: EcdsaSignature = CommonVerifierAlg.toSignatureObject(signature)
+  const fullPublicKeys = authenticators.filter(({ ethereumAddress, blockchainAccountId }) => {
+    return typeof ethereumAddress === 'undefined' && typeof blockchainAccountId === 'undefined'
+  })
+  const blockchainAddressKeys = authenticators.filter(({ ethereumAddress, blockchainAccountId }) => {
+    return typeof ethereumAddress !== 'undefined' || typeof blockchainAccountId !== 'undefined'
+  })
+
+  let signer: VerificationMethod | undefined = fullPublicKeys.find((pk: VerificationMethod) => {
+    try {
+      const pubBytes = CommonVerifierAlg.extractPublicKeyBytes(pk)
+      return secp256k1.keyFromPublic(pubBytes).verify(hash, <SignatureInput>sigObj)
+    } catch (err) {
+      return false
+    }
+  })
+
+  if (!signer && blockchainAddressKeys.length > 0) {
+    signer = verifyRecoverableES256K(data, signature, blockchainAddressKeys)
+  }
+
+  if (!signer) throw new Error('invalid_signature: Signature invalid for JWT')
+  return signer
+}
+
+export function verifyRecoverableES256K(
+  data: string,
+  signature: string,
+  authenticators: VerificationMethod[]
+): VerificationMethod {
+  let signatures: EcdsaSignature[]
+  if (signature.length > 86) {
+    signatures = [CommonVerifierAlg.toSignatureObject(signature, true)]
+  } else {
+    const so = CommonVerifierAlg.toSignatureObject(signature, false)
+    signatures = [
+      { ...so, recoveryParam: 0 },
+      { ...so, recoveryParam: 1 },
+    ]
+  }
+
+  const checkSignatureAgainstSigner = (sigObj: EcdsaSignature): VerificationMethod | undefined => {
+    const hash: Uint8Array = sha256(data)
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const recoveredKey: any = secp256k1.recoverPubKey(hash, <SignatureInput>sigObj, <number>sigObj.recoveryParam)
+    const recoveredPublicKeyHex: string = recoveredKey.encode('hex')
+    const recoveredCompressedPublicKeyHex: string = recoveredKey.encode('hex', true)
+    const recoveredAddress: string = toEthereumAddress(recoveredPublicKeyHex)
+
+    const signer: VerificationMethod | undefined = authenticators.find((pk: VerificationMethod) => {
+      const keyHex = bytesToHex(CommonVerifierAlg.extractPublicKeyBytes(pk))
+      return (
+        keyHex === recoveredPublicKeyHex ||
+        keyHex === recoveredCompressedPublicKeyHex ||
+        pk.ethereumAddress?.toLowerCase() === recoveredAddress ||
+        pk.blockchainAccountId?.split('@eip155')?.[0].toLowerCase() === recoveredAddress || // CAIP-2
+        verifyBlockchainAccountId(recoveredPublicKeyHex, pk.blockchainAccountId) // CAIP-10
+      )
+    })
+
+    return signer
+  }
+
+  const signer: VerificationMethod[] = signatures
+    .map(checkSignatureAgainstSigner)
+    .filter((key) => typeof key !== 'undefined') as VerificationMethod[]
+
+  if (signer.length === 0) throw new Error('invalid_signature: Signature invalid for JWT')
+  return signer[0]
+}

src/VerifierAlg/ES256VerifierAlg.ts

@@ -0,0 +1,87 @@
+import { ec as EC, SignatureInput } from 'elliptic'
+import { sha256, toEthereumAddress } from '../Digest'
+import type { VerificationMethod } from 'did-resolver'
+import { bytesToHex, EcdsaSignature } from '../util'
+import { verifyBlockchainAccountId } from '../blockchains'
+import * as CommonVerifierAlg from './CommonVerifierAlg'
+
+const secp256r1 = new EC('p256')
+
+/*
+interface LegacyVerificationMethod extends VerificationMethod {
+  publicKeyBase64: string
+}
+*/
+
+export function verifyES256(data: string, signature: string, authenticators: VerificationMethod[]): VerificationMethod {
+  const hash: Uint8Array = sha256(data)
+  const sigObj: EcdsaSignature = CommonVerifierAlg.toSignatureObject(signature)
+  const fullPublicKeys = authenticators.filter(({ ethereumAddress, blockchainAccountId }) => {
+    return typeof ethereumAddress === 'undefined' && typeof blockchainAccountId === 'undefined'
+  })
+  const blockchainAddressKeys = authenticators.filter(({ ethereumAddress, blockchainAccountId }) => {
+    return typeof ethereumAddress !== 'undefined' || typeof blockchainAccountId !== 'undefined'
+  })
+
+  let signer: VerificationMethod | undefined = fullPublicKeys.find((pk: VerificationMethod) => {
+    try {
+      const pubBytes = CommonVerifierAlg.extractPublicKeyBytes(pk)
+      return secp256r1.keyFromPublic(pubBytes).verify(hash, <SignatureInput>sigObj)
+    } catch (err) {
+      return false
+    }
+  })
+
+  if (!signer && blockchainAddressKeys.length > 0) {
+    signer = verifyRecoverableES256(data, signature, blockchainAddressKeys)
+  }
+
+  if (!signer) throw new Error('invalid_signature: Signature invalid for JWT')
+  return signer
+}
+
+export function verifyRecoverableES256(
+  data: string,
+  signature: string,
+  authenticators: VerificationMethod[]
+): VerificationMethod {
+  let signatures: EcdsaSignature[]
+  if (signature.length > 86) {
+    signatures = [CommonVerifierAlg.toSignatureObject(signature, true)]
+  } else {
+    const so = CommonVerifierAlg.toSignatureObject(signature, false)
+    signatures = [
+      { ...so, recoveryParam: 0 },
+      { ...so, recoveryParam: 1 },
+    ]
+  }
+
+  const checkSignatureAgainstSigner = (sigObj: EcdsaSignature): VerificationMethod | undefined => {
+    const hash: Uint8Array = sha256(data)
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const recoveredKey: any = secp256r1.recoverPubKey(hash, <SignatureInput>sigObj, <number>sigObj.recoveryParam)
+    const recoveredPublicKeyHex: string = recoveredKey.encode('hex')
+    const recoveredCompressedPublicKeyHex: string = recoveredKey.encode('hex', true)
+    const recoveredAddress: string = toEthereumAddress(recoveredPublicKeyHex)
+
+    const signer: VerificationMethod | undefined = authenticators.find((pk: VerificationMethod) => {
+      const keyHex = bytesToHex(CommonVerifierAlg.extractPublicKeyBytes(pk))
+      return (
+        keyHex === recoveredPublicKeyHex ||
+        keyHex === recoveredCompressedPublicKeyHex ||
+        pk.ethereumAddress?.toLowerCase() === recoveredAddress ||
+        pk.blockchainAccountId?.split('@eip155')?.[0].toLowerCase() === recoveredAddress || // CAIP-2
+        verifyBlockchainAccountId(recoveredPublicKeyHex, pk.blockchainAccountId) // CAIP-10
+      )
+    })
+
+    return signer
+  }
+
+  const signer: VerificationMethod[] = signatures
+    .map(checkSignatureAgainstSigner)
+    .filter((key) => typeof key !== 'undefined') as VerificationMethod[]
+
+  if (signer.length === 0) throw new Error('invalid_signature: Signature invalid for JWT')
+  return signer[0]
+}