Eliminate usages of key material's identifier

Author: nodh

vck/src/commonMain/kotlin/at/asitplus/wallet/lib/jws/JwsService.kt

@@ -66,7 +66,11 @@ fun interface JwsHeaderIdentifierFun {
 class JwsHeaderCertOrJwk : JwsHeaderIdentifierFun {
     override suspend operator fun invoke(it: JwsHeader, keyMaterial: KeyMaterial) =
         when (keyMaterial) {
-            is PublishedKeyMaterial -> it.copy(keyId = keyMaterial.identifier, jsonWebKeySetUrl = keyMaterial.keySetUrl)
+            is PublishedKeyMaterial -> it.copy(
+                keyId = keyMaterial.identifier,
+                jsonWebKeySetUrl = keyMaterial.keySetUrl
+            )
+
             else -> keyMaterial.getCertificate()?.let { x5c ->
                 it.copy(certificateChain = listOf(x5c))
             } ?: it.copy(jsonWebKey = keyMaterial.jsonWebKey)

vck/src/commonTest/kotlin/at/asitplus/wallet/lib/agent/AgentTest.kt

@@ -29,6 +29,7 @@ import kotlin.random.Random
 
 class AgentTest : FreeSpec({
 
+    lateinit var issuerIdentifier: String
     lateinit var issuer: Issuer
     lateinit var statusListIssuer: StatusListIssuer
     lateinit var holder: Holder
@@ -60,9 +61,10 @@ class AgentTest : FreeSpec({
         issuerCredentialStore = InMemoryIssuerCredentialStore()
         holderCredentialStore = InMemorySubjectCredentialStore()
 
+        issuerIdentifier = "https://issuer.example.com/${uuid4()}"
         issuer = IssuerAgent(
             issuerCredentialStore = issuerCredentialStore,
-            identifier = "https://issuer.example.com/"
+            identifier = issuerIdentifier
         )
         statusListIssuer = StatusListAgent(issuerCredentialStore = issuerCredentialStore)
 
@@ -129,7 +131,7 @@ class AgentTest : FreeSpec({
             val presentationParameters = holder.createPresentation(
                 request = PresentationRequestParameters(
                     nonce = challenge,
-                    audience = issuer.keyMaterial.identifier
+                    audience = issuerIdentifier,
                 ),
                 credentialPresentation = singularPresentationDefinition,
             ).getOrThrow()
@@ -322,7 +324,7 @@ class AgentTest : FreeSpec({
             val presentationParameters = holder.createDefaultPresentation(
                 request = PresentationRequestParameters(
                     nonce = challenge,
-                    audience = issuer.keyMaterial.identifier
+                    audience = issuerIdentifier,
                 ),
                 credentialPresentationRequest = CredentialPresentationRequest.DCQLRequest(singularDCQLRequest)
             ).getOrThrow() as PresentationResponseParameters.DCQLParameters

vck/src/commonTest/kotlin/at/asitplus/wallet/lib/agent/ValidatorSdJwtTest.kt

@@ -140,7 +140,7 @@ private suspend fun issueVcSd(
     val vcSdJwt = VerifiableCredentialSdJwt(
         subject = if (scrambleSubject) subjectId.reversed() else subjectId,
         notBefore = issuanceDate,
-        issuer = holderKeyMaterial.identifier,
+        issuer = "https://issuer.example.com/",
         expiration = expirationDate,
         issuedAt = issuanceDate,
         jwtId = vcId,

vck/src/commonTest/kotlin/at/asitplus/wallet/lib/agent/ValidatorVcTest.kt

@@ -17,6 +17,7 @@ import at.asitplus.wallet.lib.data.rfc.tokenStatusList.primitives.TokenStatusVal
 import at.asitplus.wallet.lib.data.rfc3986.UniformResourceIdentifier
 import at.asitplus.wallet.lib.jws.JwsContentTypeConstants
 import at.asitplus.wallet.lib.jws.JwsHeaderCertOrJwk
+import at.asitplus.wallet.lib.jws.JwsHeaderIdentifierFun
 import at.asitplus.wallet.lib.jws.SignJwt
 import at.asitplus.wallet.lib.jws.SignJwtFun
 import com.benasher44.uuid.uuid4
@@ -33,6 +34,7 @@ import kotlin.time.Duration.Companion.seconds
 
 class ValidatorVcTest : FreeSpec() {
 
+    private lateinit var issuerIdentifier: String
     private lateinit var issuer: Issuer
     private lateinit var statusListIssuer: StatusListIssuer
     private lateinit var issuerCredentialStore: IssuerCredentialStore
@@ -64,10 +66,11 @@ class ValidatorVcTest : FreeSpec() {
             )
             issuerCredentialStore = InMemoryIssuerCredentialStore()
             issuerKeyMaterial = EphemeralKeyWithoutCert()
+            issuerIdentifier = "https://issuer.example.com/"
             issuer = IssuerAgent(
                 keyMaterial = issuerKeyMaterial,
                 issuerCredentialStore = issuerCredentialStore,
-                identifier = "https://issuer.example.com/"
+                identifier = issuerIdentifier
             )
             statusListIssuer = StatusListAgent(issuerCredentialStore = issuerCredentialStore)
             issuerSignVc = SignJwt(issuerKeyMaterial, JwsHeaderCertOrJwk())
@@ -377,7 +380,7 @@ class ValidatorVcTest : FreeSpec() {
 
         return VerifiableCredential(
             id = vcId,
-            issuer = issuer.keyMaterial.identifier,
+            issuer = issuerIdentifier,
             credentialStatus = credentialStatus,
             credentialSubject = sub,
             credentialType = type,
@@ -402,25 +405,23 @@ class ValidatorVcTest : FreeSpec() {
         jwtId = jwtId
     )
 
-    private suspend fun signJws(vcJws: VerifiableCredentialJws): String = issuerSignVc(
-        JwsContentTypeConstants.JWT,
-        vcJws,
-        VerifiableCredentialJws.serializer()
-    ).getOrThrow().serialize()
-
-    private suspend fun wrapVcInJwsWrongKey(vcJws: VerifiableCredentialJws): String {
-        val jwsHeader = JwsHeader(
-            algorithm = JwsAlgorithm.Signature.ES256,
-            keyId = verifierKeyMaterial.identifier,
-            type = JwsContentTypeConstants.JWT
-        )
-
-        val signatureInput =
-            vckJsonSerializer.encodeToString(jwsHeader).encodeToByteArray().encodeToString(Base64UrlStrict) +
-                    "." + vckJsonSerializer.encodeToString(vcJws).encodeToByteArray().encodeToString(Base64UrlStrict)
-        val signatureInputBytes = signatureInput.encodeToByteArray()
-        val signature = issuerKeyMaterial.sign(signatureInputBytes).signature
-        return JwsSigned(jwsHeader, vcJws, signature, signatureInputBytes).serialize()
-    }
+    private suspend fun signJws(vcJws: VerifiableCredentialJws): String =
+        issuerSignVc(
+            JwsContentTypeConstants.JWT,
+            vcJws,
+            VerifiableCredentialJws.serializer()
+        ).getOrThrow().serialize()
+
+    private suspend fun wrapVcInJwsWrongKey(vcJws: VerifiableCredentialJws) =
+        SignJwt<VerifiableCredentialJws>(
+            issuerKeyMaterial
+        ) { header: JwsHeader, keyMaterial: KeyMaterial ->
+            // this should be issuerKeyMaterial.jsonWebKey, but is a wrong key
+            header.copy(jsonWebKey = EphemeralKeyWithoutCert().jsonWebKey)
+        }(
+            JwsContentTypeConstants.JWT,
+            vcJws,
+            VerifiableCredentialJws.serializer()
+        ).getOrThrow().serialize()
 
 }

vck/src/commonTest/kotlin/at/asitplus/wallet/lib/agent/ValidatorVpTest.kt

@@ -248,12 +248,11 @@ class ValidatorVpTest : FreeSpec({
     "Wrong jwtId in VP is not valid" {
         val credentials = holderCredentialStore.getCredentials().getOrThrow()
             .filterIsInstance<SubjectCredentialStore.StoreEntry.Vc>()
-            .map { it.vcSerialized }
-        val vp = VerifiablePresentation(credentials)
+        val vp = VerifiablePresentation(credentials.map { it.vcSerialized })
         val vpSerialized = VerifiablePresentationJws(
             vp = vp,
             challenge = challenge,
-            issuer = holder.keyMaterial.identifier,
+            issuer = credentials.first().vc.vc.credentialSubject.id,
             audience = verifierId,
             jwtId = "wrong_jwtId",
         )
@@ -270,16 +269,15 @@ class ValidatorVpTest : FreeSpec({
     "Wrong type in VP is not valid" {
         val credentials = holderCredentialStore.getCredentials().getOrThrow()
             .filterIsInstance<SubjectCredentialStore.StoreEntry.Vc>()
-            .map { it.vcSerialized }
         val vp = VerifiablePresentation(
             id = "urn:uuid:${uuid4()}",
             type = "wrong_type",
-            verifiableCredential = credentials
+            verifiableCredential = credentials.map { it.vcSerialized }
         )
 
         val vpSerialized = vp.toJws(
             challenge = challenge,
-            issuerId = holder.keyMaterial.identifier,
+            issuerId = credentials.first().vc.vc.credentialSubject.id,
             audienceId = verifierId,
         )
         val vpJws = holderSignVp(