TBD54566975 / web5-kt

Apache License 2.0
10 stars 10 forks source link

`did:dht` does not have assertionMethodVerificationMethodsDereferenced and fails `Message.verify()` check #252

Closed jiyoontbd closed 7 months ago

jiyoontbd commented 7 months ago

Steps to reproduce this issue

  1. Re-generate test-vectors to have did:dht:... DIDs for both pfi and alice in building various tbdex messages
  2. Pull in the re-generated test vectors in the tbdex submodule
  3. Run ./gradlew clean build
  4. TbdexTestVectorTests tests fail

I know this is caused by using did:dht:... for my DIDs because I cannot reproduce the issue if I do step 1 with did:jwk:... for my DIDs.

The require block fails and message.verify() called from various concrete message implementation's i.e. Rfq.parse(message) fails due to this.

val assertionMethods = didResolutionResult.didDocument?.assertionMethodVerificationMethodsDereferenced
    val assertionMethod = assertionMethods?.firstOrNull {
      val id = it.id.toString()
      verificationMethodIds.contains(id)
    }

    // this require fails. assertionMethod is null
    require(assertionMethod != null) {
      throw SignatureException(
        "Signature verification failed: Expected kid in JWS header to dereference " +
          "a DID Document Verification Method with an Assertion verification relationship"
      )
    }

Link to code on github: https://github.com/TBD54566975/tbdex-kt/blob/main/protocol/src/main/kotlin/tbdex/sdk/protocol/CryptoUtils.kt#L81-L92

jiyoontbd commented 7 months ago

@mistermoe if you'd like to investigate this further or comment?

mistermoe commented 7 months ago

Yep will do!

mistermoe commented 7 months ago

kk found the issue. PR up! https://github.com/TBD54566975/web5-kt/pull/251