[bug] `publicKeyMultibase` in a DID document is not usable to verify JWT credentials

[mirceanis]

Bug severity 3

Describe the bug

Credentials issued by did:peer fail verification. Here is a sample test to reproduce the issue:

    // using an agent with `@veramo/did-provider-peer#PeerDIDProvider`
    // and `@veramo/did-provider-peer#getResolver`

    // did:peer uses publicKeyMultibase
    const issuer = await agent.didManagerCreate({
      provider: 'did:peer',
      options: {
        num_algo: 0
      }
    })
    const payload = {
      issuer: issuer.did,
      credentialSubject: {
        nothing: 'else matters',
      },
    }
    const credential = await agent.createVerifiableCredential({
      credential: payload,
      proofFormat: 'jwt',
    })
    const verifyResult = await agent.verifyCredential({ credential })
    expect(verifyResult.verified).toBeTruthy()

Details It seems that the publicKeyMultibase is a multibase encoding of a multicodec encoding of an ed25519 public key. did-jwt@7.2.5 doesn't know how to interpret the multicodec encoding so it tries to use the byte array as is so verification fails.

The fix would be in the did-jwt library.

Versions (please complete the following information):

• Veramo: 5.4.1
• did-jwt: 7.2.5