axone-protocol
diff --git a/‎Cargo.lock
Copy file name to clipboard
+53Lines changed: 53 additions & 0 deletions b/‎Cargo.lock
Copy file name to clipboard
+53Lines changed: 53 additions & 0 deletions
diff --git a/‎Cargo.toml
Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions b/‎Cargo.toml
Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions
diff --git a/‎contracts/okp4-dataverse/Cargo.toml
Copy file name to clipboard
+4Lines changed: 4 additions & 0 deletions b/‎contracts/okp4-dataverse/Cargo.toml
Copy file name to clipboard
+4Lines changed: 4 additions & 0 deletions
diff --git a/‎contracts/okp4-dataverse/src/credential/crypto.rs
Copy file name to clipboard
+79Lines changed: 79 additions & 0 deletions b/‎contracts/okp4-dataverse/src/credential/crypto.rs
Copy file name to clipboard
+79Lines changed: 79 additions & 0 deletions
diff --git a/‎contracts/okp4-dataverse/src/credential/error.rs
Copy file name to clipboard
+22-1Lines changed: 22 additions & 1 deletion b/‎contracts/okp4-dataverse/src/credential/error.rs
Copy file name to clipboard
+22-1Lines changed: 22 additions & 1 deletion
diff --git a/‎contracts/okp4-dataverse/src/credential/mod.rs
Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions b/‎contracts/okp4-dataverse/src/credential/mod.rs
Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions
diff --git a/‎contracts/okp4-dataverse/src/credential/proof.rs
Copy file name to clipboard
+50-20Lines changed: 50 additions & 20 deletions b/‎contracts/okp4-dataverse/src/credential/proof.rs
Copy file name to clipboard
+50-20Lines changed: 50 additions & 20 deletions
@@ -5,6 +5,7 @@ members = ["contracts/*", "packages/*"]
 cosmwasm-schema = "1.5.2"
 cosmwasm-std = { version = "1.5.2", features = ["cosmwasm_1_4"] }
 cosmwasm-storage = "1.5.2"
+cosmwasm-crypto = "1.5.2"
 cw-multi-test = "0.20.0"
 cw-storage-plus = "1.2.0"
 cw-utils = "1.0.3"
 
@@ -31,6 +31,7 @@ rpath = false
 cosmwasm-schema.workspace = true
 cosmwasm-std.workspace = true
 cosmwasm-storage.workspace = true
+cosmwasm-crypto.workspace = true
 cw-storage-plus.workspace = true
 cw-utils.workspace = true
 cw2.workspace = true
@@ -43,6 +44,9 @@ serde.workspace = true
 thiserror.workspace = true
 rio_turtle.workspace = true
 bs58 = "0.5.0"
+sha2 = "0.10.8"
+multibase = "0.9.1"
+unsigned-varint = "0.8.0"
 
 [dev-dependencies]
 cw-multi-test.workspace = true
 
@@ -0,0 +1,79 @@
+use crate::credential::error::VerificationError;
+use okp4_rdf::normalize::Normalizer;
+use rio_api::model::Quad;
+use sha2::Digest;
+
+pub enum CanonicalizationAlg {
+    Urdna2015,
+}
+
+pub enum DigestAlg {
+    Sha256,
+}
+
+pub enum SignatureAlg {
+    Ed25519,
+}
+
+pub struct CryptoSuite {
+    canon: CanonicalizationAlg,
+    hash: DigestAlg,
+    sign: SignatureAlg,
+}
+
+impl From<(CanonicalizationAlg, DigestAlg, SignatureAlg)> for CryptoSuite {
+    fn from(value: (CanonicalizationAlg, DigestAlg, SignatureAlg)) -> Self {
+        Self {
+            canon: value.0,
+            hash: value.1,
+            sign: value.2,
+        }
+    }
+}
+
+impl CryptoSuite {
+    pub fn verify_document(
+        &self,
+        unsecured_document: &[Quad<'_>],
+        proof_value: &[u8],
+        pub_key: &[u8],
+    ) -> Result<bool, VerificationError> {
+        let transformed_document = self.canonicalize(unsecured_document)?;
+        let hash = self.hash(transformed_document);
+        self.verify(&hash, proof_value, pub_key)
+    }
+
+    fn canonicalize(&self, unsecured_document: &[Quad<'_>]) -> Result<String, VerificationError> {
+        match self.canon {
+            CanonicalizationAlg::Urdna2015 => {
+                let mut normalizer = Normalizer::new();
+                normalizer
+                    .normalize(unsecured_document)
+                    .map_err(VerificationError::from)
+            }
+        }
+    }
+
+    fn hash(&self, transformed_document: String) -> Vec<u8> {
+        match self.hash {
+            DigestAlg::Sha256 => {
+                let mut hasher = sha2::Sha256::new();
+                hasher.update(transformed_document);
+
+                hasher.finalize().to_vec()
+            }
+        }
+    }
+
+    fn verify(
+        &self,
+        hash: &[u8],
+        signature: &[u8],
+        pub_key: &[u8],
+    ) -> Result<bool, VerificationError> {
+        match self.sign {
+            SignatureAlg::Ed25519 => cosmwasm_crypto::ed25519_verify(hash, signature, pub_key)
+                .map_err(VerificationError::from),
+        }
+    }
+}
@@ -1,3 +1,5 @@
+use cosmwasm_crypto::CryptoError;
+use okp4_rdf::normalize::NormalizationError;
 use thiserror::Error;
 
 #[derive(Error, Debug, PartialEq)]
@@ -11,7 +13,7 @@ pub enum InvalidCredentialError {
     #[error("Missing issuance date")]
     MissingIssuanceDate,
 
-    #[error("Missing proof")]
+    #[error("Missing proof, at least a supported one")]
     MissingProof,
 
     #[error("Invalid proof: {0}")]
@@ -38,9 +40,28 @@ pub enum InvalidProofError {
     #[error("Missing proof value")]
     MissingProofValue,
 
+    #[error("Malformed proof value: {0}")]
+    MalformedProofValue(#[from] multibase::Error),
+
     #[error("Could not decode public key")]
     InvalidPubKey,
 
     #[error("Malformed: {0}")]
     Malformed(String),
+
+    // Used internally only
+    #[error("Unsupported proof type")]
+    Unsupported,
+}
+
+#[derive(Error, Debug)]
+pub enum VerificationError {
+    #[error("Couldn't canonicalize document: {0}")]
+    RdfCanonError(#[from] NormalizationError),
+
+    #[error("Couldn't verify signature: {0}")]
+    CryptoError(#[from] CryptoError),
+
+    #[error("Couldn't find a suitable proof")]
+    NoSuitableProof,
 }
@@ -1,3 +1,4 @@
+mod crypto;
 mod error;
 mod proof;
 mod rdf_marker;
 
@@ -1,3 +1,4 @@
+use crate::credential::crypto::{CanonicalizationAlg, CryptoSuite, DigestAlg, SignatureAlg};
 use crate::credential::error::InvalidProofError;
 use crate::credential::rdf_marker::{
     PROOF_RDF_PROOF_PURPOSE, PROOF_RDF_PROOF_VALUE, PROOF_RDF_PROOF_VALUE_TYPE,
@@ -11,7 +12,6 @@ use rio_api::model::{GraphName, Literal, Term};
 #[derive(Debug, PartialEq)]
 pub enum Proof<'a> {
     Ed25519Signature2020(Ed25519Signature2020Proof<'a>),
-    Unsupported,
 }
 
 #[allow(dead_code)]
@@ -21,7 +21,29 @@ impl<'a> Proof<'a> {
             Self::Ed25519Signature2020(proof) => {
                 proof.verification_method.controller == issuer && proof.purpose == purpose
             }
-            Self::Unsupported => false,
+        }
+    }
+
+    pub fn crypto_suite(&self) -> CryptoSuite {
+        match self {
+            Proof::Ed25519Signature2020(_) => (
+                CanonicalizationAlg::Urdna2015,
+                DigestAlg::Sha256,
+                SignatureAlg::Ed25519,
+            )
+                .into(),
+        }
+    }
+
+    pub fn pub_key(&'a self) -> &'a [u8] {
+        match self {
+            Proof::Ed25519Signature2020(p) => &p.verification_method.pub_key,
+        }
+    }
+
+    pub fn value(&'a self) -> &'a [u8] {
+        match self {
+            Proof::Ed25519Signature2020(p) => &p.value,
         }
     }
 
@@ -158,12 +180,12 @@ impl<'a> TryFrom<(&'a Dataset<'a>, GraphName<'a>)> for Proof<'a> {
                 )),
             })?;
 
-        Ok(match proof_type {
-            "https://w3id.org/security#Ed25519Signature2020" => Self::Ed25519Signature2020(
+        match proof_type {
+            "https://w3id.org/security#Ed25519Signature2020" => Ok(Self::Ed25519Signature2020(
                 Ed25519Signature2020Proof::try_from((dataset, proof_graph))?,
-            ),
-            _ => Self::Unsupported,
-        })
+            )),
+            _ => Err(InvalidProofError::Unsupported),
+        }
     }
 }
 
@@ -184,13 +206,14 @@ impl<'a> TryFrom<(&'a Dataset<'a>, GraphName<'a>)> for Ed25519Signature2020Proof
     ) -> Result<Self, Self::Error> {
         let v_method = Proof::extract_verification_method(dataset, proof_graph)?;
         let p_purpose = Proof::extract_proof_purpose(dataset, proof_graph)?;
-        let p_value = Proof::extract_proof_value(dataset, proof_graph)?;
+        let (_, p_value) = multibase::decode(Proof::extract_proof_value(dataset, proof_graph)?)
+            .map_err(InvalidProofError::from)?;
 
         Ok(Self {
             verification_method: v_method.try_into()?,
             created: Proof::extract_created(dataset, proof_graph)?,
             purpose: p_purpose.into(),
-            value: p_value.as_bytes().to_vec(),
+            value: p_value,
         })
     }
 }
@@ -207,12 +230,12 @@ impl<'a> TryFrom<&'a str> for Ed25519VerificationKey2020<'a> {
     type Error = InvalidProofError;
 
     fn try_from(value: &'a str) -> Result<Self, Self::Error> {
-        Ok(match value.split(":").collect::<Vec<_>>()[..] {
-            ["did", "key", content] => match content.split("#").collect::<Vec<_>>()[..] {
-                [controller, key] if controller == key => Self {
+        Ok(match value.split("#").collect::<Vec<_>>()[..] {
+            [controller, key] => match controller.split(":").collect::<Vec<_>>()[..] {
+                ["did", "key", controller_key] if controller_key == key => Self {
                     id: value,
                     controller,
-                    pub_key: multibase::decode_ed25519(key)?,
+                    pub_key: multiformats::decode_ed25519_key(key)?,
                 },
                 _ => Err(InvalidProofError::Malformed(
                     "couldn't parse did key for verification method".to_string(),
@@ -240,15 +263,22 @@ impl<'a> From<&'a str> for ProofPurpose {
     }
 }
 
-mod multibase {
+mod multiformats {
     use crate::credential::error::InvalidProofError;
+    use multibase::Base;
+
+    pub fn decode_ed25519_key(src: &str) -> Result<Vec<u8>, InvalidProofError> {
+        let (base, data) = multibase::decode(src).map_err(|_| InvalidProofError::InvalidPubKey)?;
+        if base != Base::Base58Btc {
+            Err(InvalidProofError::InvalidPubKey)?
+        }
 
-    pub fn decode_ed25519(src: &str) -> Result<Vec<u8>, InvalidProofError> {
-        let res = bs58::decode(src.split_at(1).1).into_vec();
-        let buf = res.map_err(|_| InvalidProofError::InvalidPubKey)?;
-        match buf.split_at(1) {
-            ([0xed], key) => Ok(key.to_vec()),
-            _ => Err(InvalidProofError::InvalidPubKey),
+        let (codec, key) =
+            unsigned_varint::decode::u16(&data).map_err(|_| InvalidProofError::InvalidPubKey)?;
+        if codec != 0xed {
+            Err(InvalidProofError::InvalidPubKey)?
         }
+
+        Ok(key.to_vec())
     }
 }
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+mod crypto;`
`1`	`2`	`mod error;`
`2`	`3`	`mod proof;`
`3`	`4`	`mod rdf_marker;`