feat: [SIW-402] Resolve trust chain #34

balanza · 2023-09-08T11:20:09Z

List of Changes

introduced trust folder for utilities related to the trust model
Added/refined types for federaration entities
Implemented trust chain verification
added utility to fetch and parse Entity Configuration of federation entities
added trust chain verification on example app

Motivation and Context

Documents shared with other parties (credentials, attestations, authz requests, etc) are signed and trusted according to https://italia.github.io/eudi-wallet-it-docs/v0.4.1/en/trust.html. Such documents contain a trust_chain field, which is intended to provide a static representation of the federation trust chain that connects the Leaf entity (i.e. the entity whose trustworthiness is being checked) to the known Trust Anchor entity,

The trust_chain is a list of signed token in the form:

[
  leaf entity configuration token,
  leaf entity statement token,
  intermediate1 entity statement token,
  ...
  intermediateN entity statement token,
  (optional) trust anchor entity configuration token,
]

Each token MUST be signed using one of the keys declared in the token next to it in the chain. The last token's signature will be checked against the known Trust Anchor's keys. Optionally, Trust Anchor entity configuration can be added as last element of the chain.

This PR proposes the verifyTrustChain function to be used as

import { getEntityConfiguration, verifyTrustChain } from "@pagopa/io-react-native-wallet";

const trustAnchorEC = await getEntityConfiguration("https://trustanchor.example");
const document = // the document received from the issuer/relying party, whose trust must be verified

const chain = await verifyTrustChain(trustAnchor, document.header.trust_chain);

How Has This Been Tested?

Screenshots (if appropriate):

Checklist:

My change requires a change to the documentation.
I have updated the documentation accordingly.

grausof · 2023-09-11T08:25:13Z

src/rp/types.ts

-      // FIXME: SIW-422 require federation_metadata field
-      // Actual RP implementation does not comply with the spec
-      /* federation_entity: z.object({
-        organization_name: z.string(),
-        homepage_uri: z.string(),
-        policy_uri: z.string(),
-        logo_uri: z.string(),
-        contacts: z.array(z.string()),
-      }), */


Sorry for rework but federation_entity has been added!

done in 98ca656

Sorry but I still don't see the update here

grausof · 2023-09-11T08:27:48Z

example/src/scenarios/cross-device-flow-with-rp.tsx

@@ -80,7 +90,7 @@ export default async () => {
    ).then((t) => RP.getRequestObject(t, authRequestUrl, entity));

    // Attest Relying Party trust
-    // TODO [SIW-354]
+    await verifyTrustChain(trustAnchorEntity, requestObj.header.trust_chain);


what do you think about adding this check also into the SDK function (like getEntityConfiguration())making sure that the caller is not responsible for doing the checks.

Interesting point. That is true for every trustable document we have (including PID, WIA, RequestObject, etc).

I think it's good, anyway I'd do it in another PR as it involves a sensible refactor of classes because:

we must provide Trust Anchor data

we must model better error to avoid to hide informations on error.

yep! Thanks you

src/trust/chain.ts

grausof · 2023-09-11T08:46:27Z

src/trust/chain.ts

+  const selectTokenShape = (elementIndex: number) =>
+    elementIndex === 0
+      ? FirstElementShape
+      : elementIndex === chain.length - 1
+      ? LastElementShape
+      : MiddleElementShape;
+


grausof · 2023-09-11T08:47:22Z

src/trust/types.ts

+      // Actual RP implementation does not comply with the spec
+      /* federation_entity: z.object({
+        organization_name: z.string(),
+        homepage_uri: z.string(),
+        policy_uri: z.string(),
+        logo_uri: z.string(),
+        contacts: z.array(z.string()),
+      }), */


RP added federation_entity. You can uncomment this part

grausof

Please fix test since code review fail!

Please check again, I pushed something new

grausof · 2023-09-12T17:00:52Z

It is necessary to add (certainly with a separate PR) fast renewal for entity configurations.

grausof

LGTM

Co-authored-by: grausof <[email protected]>

balanza added 6 commits September 5, 2023 15:53

wip

bc4901e

improve jwt verify mock

58cfd44

implement trust chain validation

239e727

refactor types

647c042

add entity configuration utility

f8065ff

Update example app

c20f28e

balanza requested a review from a team as a code owner September 8, 2023 11:20

balanza requested review from grausof and hevelius September 8, 2023 11:20

balanza added 2 commits September 8, 2023 15:46

Merge branch 'master' into SIW-402--resolve-trust-chain

1bf6e7a

fix example

0e37b77

github-actions bot added example feat labels Sep 8, 2023

grausof requested changes Sep 11, 2023

View reviewed changes

grausof previously approved these changes Sep 12, 2023

View reviewed changes

restore entity metadata

98ca656

balanza force-pushed the SIW-402--resolve-trust-chain branch from e205909 to 98ca656 Compare September 12, 2023 14:14

balanza requested a review from grausof September 12, 2023 14:16

balanza enabled auto-merge September 12, 2023 14:16

grausof disabled auto-merge September 12, 2023 15:20

retrofit tests

242493e

balanza enabled auto-merge September 13, 2023 07:31

grausof and others added 2 commits September 13, 2023 17:02

Merge branch 'master' into SIW-402--resolve-trust-chain

eb6b3f6

comment

79a91ab

balanza added this pull request to the merge queue Sep 13, 2023

grausof approved these changes Sep 13, 2023

View reviewed changes

Merged via the queue into master with commit d73b3a3 Sep 13, 2023
3 checks passed

balanza deleted the SIW-402--resolve-trust-chain branch September 13, 2023 15:21

balanza mentioned this pull request Sep 14, 2023

Fix #34 Entity Configuration parsing #38

Merged

2 tasks

github-merge-queue bot pushed a commit that referenced this pull request Sep 14, 2023

Fix #34 Entity Configuration parsing (#38)

e2396e7

Co-authored-by: grausof <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: [SIW-402] Resolve trust chain #34

feat: [SIW-402] Resolve trust chain #34

balanza commented Sep 8, 2023 •

edited

Loading

grausof Sep 11, 2023

balanza Sep 12, 2023

grausof Sep 12, 2023

grausof Sep 11, 2023

balanza Sep 12, 2023

grausof Sep 12, 2023

grausof Sep 11, 2023

grausof Sep 11, 2023

grausof left a comment

grausof commented Sep 12, 2023

grausof left a comment

feat: [SIW-402] Resolve trust chain #34

feat: [SIW-402] Resolve trust chain #34

Conversation

balanza commented Sep 8, 2023 • edited Loading

List of Changes

Motivation and Context

How Has This Been Tested?

Screenshots (if appropriate):

Checklist:

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

grausof left a comment

Choose a reason for hiding this comment

grausof commented Sep 12, 2023

grausof left a comment

Choose a reason for hiding this comment

balanza commented Sep 8, 2023 •

edited

Loading