digitalbazaar / ed25519-signature-2020 Goto Github PK
View Code? Open in Web Editor NEWEd25519Signature2020 Linked Data Proof suite for use with jsonld-signatures.
License: BSD 3-Clause "New" or "Revised" License
Ed25519Signature2020 Linked Data Proof suite for use with jsonld-signatures.
License: BSD 3-Clause "New" or "Revised" License
So when I click on Ed25519Signature2020 Crypto Suite in the readme, I get a 404 page.
When using the library in conjunction with vc-js as described in the example
import vc from '@digitalbazaar/vc';
// Required to set up a suite instance with private key
import {Ed25519VerificationKey2020} from
'@digitalbazaar/ed25519-verification-key-2020';
import {Ed25519Signature2020} from '@digitalbazaar/ed25519-signature-2020';
const keyPair = await Ed25519VerificationKey2020.generate();
const suite = new Ed25519Signature2020({key: keyPair});
// Sample unsigned credential
const credential = {
"@context": [
"https://www.w3.org/2018/credentials/v1",
"https://www.w3.org/2018/credentials/examples/v1"
],
"id": "https://example.com/credentials/1872",
"type": ["VerifiableCredential", "AlumniCredential"],
"issuer": "https://example.edu/issuers/565049",
"issuanceDate": "2010-01-01T19:23:24Z",
"credentialSubject": {
"id": "did:example:ebfeb1f712ebc6f1c276e12ec21",
"alumniOf": "Example University"
}
};
const signedVC = await vc.issue({credential, suite, documentLoader});
console.log(JSON.stringify(signedVC, null, 2));
It produces throw new TypeError('"suite.verificationMethod" property is required.');
When looking into the suite Object the verificationMethod is indeed undefined. Shouldn't the library include a default verification method, e.g. the publicKey of the keyPair which is given to the contructor?
Something seems to be wrong with this import https://github.com/digitalbazaar/ed25519-signature-2020/blob/main/lib/Ed25519Signature2020.js#L12 when consuming this library in a typescript project. Specifically I'm hitting this error while running tests in jest.
/path-to-project/node_modules/@digitalbazaar/ed25519-signature-2020/lib/Ed25519Signature2020.js:1
TypeError: Cannot read property 'constants' of undefined
at Object.<anonymous> (node_modules/@digitalbazaar/ed25519-signature-2020/lib/Ed25519Signature2020.js:14:40)
at Object.<anonymous> (/path-to-project/node_modules/@digitalbazaar/ed25519-signature-2020/lib/main.js:1)
Just wondering if anyone has seen anything like this and how I could get around it
If the 2020 signature suite encounters a 2018 type key, convert it to 2020 and enable verification.
The additional functionality we're looking for is:
Be able to verify proofs of type Ed25519Signature2020
, using legacy 2018 keys (keys of type Ed25519VerificationKey2018
). (This is needed since much of our peer ecosystem does not have 2020 keys implemented, so we need this for wallet interop, etc.)
Specifically, when a documentLoader
returns a public key object of type 2018 (AND that key object has the 2018 context), allow the 2020 signature suite to verify a 2020 signature with that 2018 key.
If it receives a type 2018 key but it does not have a context (or is using the 2020 context for some reason), then throw an error.
@digitalbazaar/ed25519-verification-key-2018
lib to devDependencies
.documentLoader
setup with our jsonld-document-loader
, and load it up with the ed25519 2020 AND the 2018 context.->
public key object of type 2018
assertVerificationMethod
code. Add support for the 2018 context (but only if the type is 2018 as well).getVerificationMethod
-- (after the assertVerificationMethod call, at the bottom) will need to convert from a 2018 key to a 2020 key (so that the verifySignature
logic, later on, can proceed as normal, with a 2020 key).The Example https://github.com/digitalbazaar/ed25519-signature-2020#usage uses a documentLoader
which is not imported. Could you add an example where to get the loader from?
Add usage docs to the readme.
Hi,
Our recent WhiteSource scan reported a a medium severity vulnerabilities from @digitalbazaar/ed25519-signature-2020 3.0.0.
According to WhiteSource, this vulnerabilities is caused by this chain of dependencies:
ed25519-signature-2020 3.0.0
->[email protected]
->[email protected]
->@digitalbazaar/[email protected]
->[email protected]
->[email protected]
[email protected] causes CVE-2022-0235.
It seems that upgrading to the latest ky-universal (0.10.1) will solve this issue.
Thanks
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.