fix: use encryption key #49
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tzskp1
force-pushed
the
fix/use-encryption-key
branch
3 times, most recently
from
222ed8c to
d674e47
Compare
tzskp1
force-pushed
the
fix/use-encryption-key
branch
3 times, most recently
from
be54244 to
1780665
Compare
tzskp1
force-pushed
the
fix/use-encryption-key
branch
from
1780665 to
be7b620
Compare
tzskp1
force-pushed
the
fix/use-encryption-key
branch
from
be7b620 to
d11862d
Compare
tzskp1
force-pushed
the
fix/use-encryption-key
branch
from
d11862d to
6f97191
Compare
tzskp1
commented
Jul 31, 2024
Comment on lines
-119
to
-162
| let shared_key = runtime::secp256k1::Secp256k1::ecdh( | ||
| &from_keyring.sign.get_secret_key(), | ||
| &other_key.get_public_key(), | ||
| )?; | ||
|
|
||
| let sk = StaticSecret::from(array_ref!(shared_key, 0, 32).to_owned()); | ||
| let pk = PublicKey::from(&sk); | ||
|
|
||
| // NOTE: message | ||
| let body = self.vc_service.generate(from_did, from_keyring, message, issuance_date)?; | ||
| let body = serde_json::to_string(&body).context("failed to serialize")?; | ||
|
|
||
| let mut message = | ||
| Message::new().from(from_did).to(&[to_did]).body(&body).map_err(|e| { | ||
| anyhow::anyhow!("Failed to initialize message with error = {:?}", e) | ||
| })?; | ||
|
|
||
| // NOTE: Has attachment | ||
| if let Some(value) = metadata { | ||
| let id = cuid::cuid2(); | ||
|
|
||
| // let media_type = "application/json"; | ||
| let data = AttachmentDataBuilder::new() | ||
| .with_link(&self.attachment_link) | ||
| .with_json(&value.to_string()); | ||
|
|
||
| message.append_attachment( | ||
| AttachmentBuilder::new(true).with_id(&id).with_format("metadata").with_data(data), | ||
| ) | ||
| } | ||
|
|
||
| let seal_signed_message = message | ||
| .as_jwe(&CryptoAlgorithm::XC20P, Some(pk.as_bytes().to_vec())) | ||
| .seal_signed( | ||
| sk.to_bytes().as_ref(), | ||
| Some(vec![Some(pk.as_bytes().to_vec())]), | ||
| SignatureAlgorithm::Es256k, | ||
| &from_keyring.sign.get_secret_key(), | ||
| ) | ||
| .map_err(|e| { | ||
| DIDCommEncryptedServiceGenerateError::EncryptFailed(anyhow::Error::msg( | ||
| e.to_string(), | ||
| )) | ||
| })?; |
There was a problem hiding this comment.
This procedure is totaly insane.
First, secp256k1 is not adapted to DIDComm encryption.
See:
Second, the didcomm-rs api does the ecdh scheme. However, this implementation does the ecdh scheme before calling the didcomm-rs api.
In other words, this implementation performs the ecdh scheme twice.
See:
- https://github.com/nodecross/didcomm-rs/blob/b206c57b85165dec6e4e5a8f734b27ad5ef7befe/src/messages/message.rs#L633
In addition, this implementation uses the seal_signed API even though the message is converted to VC.
curry-like
previously approved these changes
Jul 31, 2024
tzskp1
force-pushed
the
fix/use-encryption-key
branch
from
6f97191 to
659f0d1
Compare
|
DIDComm Sequence Diagram (New Implementation) sequenceDiagram
autonumber
actor app1 as Your App1
participant agent1 as NodeX Agent
actor app2 as Your App2
participant agent2 as NodeX Agent
participant studio as NodeX Studio
participant sidetree as Sidetree
app1->>agent1: /create-didcomm-message
Note left of agent1: Message
agent1->>agent1: sign as VC
Note left of agent1: Use signing secret key of agent1 from the keyring.
agent1->>sidetree: get DIDDocument of agent2
sidetree-->agent1: response
agent1->>agent1: encrypt as DIDComm message
Note left of agent1: Use encryption public key of agent2 from the DIDDocument.
Note left of agent1: Use encryption secret key of agent1 from the keyring.
agent1->>studio: http post
Note right of agent1: Log(from, to, message_id, code)
studio-->agent1: response
agent1-->app1: Message(Encrypted)
app1->>app2: send over any transport
Note left of app2: Message(Encrypted)
app2->>agent2: /verify-didcomm-message
Note left of agent2: Message(Encrypted)
agent2->>agent2: check that what is sender DID
agent2->>sidetree: get DIDDocument of sender
sidetree-->agent2: response
agent2->>agent2: decrypt as DIDComm message
Note left of agent2: Use encryption public key of agent1(sender) from the DIDDocument.
Note left of agent2: Use encryption secret key of agent2 from the keyring.
agent2->>agent2: verify as VC
Note left of agent2: Use signing public key of agent1(sender) from the DIDDocument.
agent2->>studio: http post
Note left of studio: Log(from, to, message_id, code)
studio->>studio: verify message_id is matched
studio->>studio: check that sender and receiver belong to the same project
studio-->agent2: response
agent2-->app2: response
Note left of agent2: Message
app2->>app2: message processing...
|
This was referenced Aug 3, 2024
curry-like
approved these changes
Aug 3, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
WHY
WHAT
anyhowcrate from the code and dependencies.rand_core).Box<dyn trait>to enhance performance and readability.