generate-key-proof

#!/usr/bin/env ruby
#
# OVERVIEW
# --------
#
#   This script generates a key proof JWT that complies with
#   the OpenID for Verifiable Credential Issuance specification.
#
# USAGE
# -----
#
#   generate-key-proof
#     --client-id={CLIENT_ID}               # -c {CLIENT_ID}
#     --issuer={CREDENTIAL_ISSUER}          # -i {ISSUER}
#     --key={PRIVATE_KEY_IN_JWK_FORMAT}     # -k {PRIVATE_KEY_IN_JWK_FORMAT}
#     --nonce={C_NONCE}                     # -n {C_NONCE}
#     [--did-jwk]
#     [--key-attestation={KEY_ATTESTATION}] # -a {KEY_ATTESTATION}
#


require 'bundler/inline'

gemfile do
  source 'https://rubygems.org'
  gem 'base64'
  gem 'json-jwt'
  gem 'optparse'
end

require 'securerandom'
require 'time'


#------------------------------------------------------------
# main
#------------------------------------------------------------
def main(args)
  # Process the command line options.
  options = Options.process(args)

  # Prepare the payload of the key proof.
  payload = build_payload(options)

  # Generate a JWS by signing with the key.
  proof = sign(payload, options)

  # Write the key proof to the standard output.
  puts proof
end


#------------------------------------------------------------
# Prepare the payload of the key proof.
#------------------------------------------------------------
def build_payload(options)
  # The current time in seconds for time-related claims
  now = Time.now.to_i

  # Payload of a key proof
  payload = {
    iss:   options.client_id,
    aud:   options.issuer,
    iat:   now
  }

  if options.nonce
    payload[:nonce] = options.nonce
  end

  return payload
end


#------------------------------------------------------------
# Generate a JWS by signing with the key.
#------------------------------------------------------------
def sign(payload, options)
  # Prepare a JWT with the header and the payload.
  jwt = JSON::JWT.new(payload)

  # Set up some header parameters.
  jwt.typ = 'openid4vci-proof+jwt'

  # The private key for signing.
  signing_key = options.key

  # The public key to be embedded.
  embedded_key = options.key.normalize

  if options.did_jwk
    jwt.kid = "did:jwk:#{encode_base64url(embedded_key.to_json)}"
  else
    jwt.jwk = embedded_key
  end

  if options.key_attestation
    # Add a 'key_attestation' header parameter.
    jwt.header[:key_attestation] = options.key_attestation
  end

  # Sign the JWT with the key and convert it to JWS.
  jwt.sign(signing_key).to_s
end


#------------------------------------------------------------
# Encode the input by base64url.
#------------------------------------------------------------
def encode_base64url(input)
  Base64.urlsafe_encode64(input, padding: false)
end


#------------------------------------------------------------
# Command line options
#------------------------------------------------------------
class Options < OptionParser
  DESC_CLIENT_ID       = "The identifier of the client application (wallet)."
  DESC_ISSUER          = "The identifier of the credential issuer."
  DESC_KEY             = "A file containing a private key in the JWK format."
  DESC_NONCE           = "The server-provided 'c_nonce' value."
  DESC_DID_JWK         = "Embed the public key (not in 'jwk' but) in 'kid' using the 'did:jwk' method."
  DESC_KEY_ATTESTATION = "The key attestation set to the 'key_attestation' header parameter."

  attr_reader :client_id, :issuer, :key, :nonce, :did_jwk, :key_attestation

  def initialize
    super

    @client_id       = nil
    @issuer          = nil
    @key             = nil
    @nonce           = nil
    @did_jwk         = false
    @key_attestation = nil

    self.on('-c CLIENT_ID', '--client-id=CLIENT_ID', DESC_CLIENT_ID) do |client_id|
      @client_id = client_id
    end

    self.on('-i ISSUER', '--issuer=ISSUER', DESC_ISSUER) do |issuer|
      @issuer = issuer
    end

    self.on('-k FILE', '--key=FILE', DESC_KEY) do |file|
      @key = read_jwk(file)
    end

    self.on('-n NONCE', '--nonce=NONCE', DESC_NONCE) do |nonce|
      @nonce = nonce
    end

    self.on('-d', '--did-jwk', DESC_DID_JWK) do |flag|
      @did_jwk = flag
    end

    self.on('-a KEY_ATTESTATION', '--key-attestation=KEY_ATTESTATION', DESC_KEY_ATTESTATION) do |key_attestation|
      @key_attestation = key_attestation
    end
  end

  private

  def read_jwk(file)
    json = File.read(file)
    hash = JSON.parse(json, {symbolize_names: true})
    JSON::JWK.new(hash)
  end

  def error_if_missing(value, option)
    if value.nil?
      raise OptionParser::ParseError.new "'#{option}' is missing."
    end
  end

  public

  def verify
    error_if_missing(@client_id, '--client-id=CLIENT_ID')
    error_if_missing(@issuer,    '--issuer=ISSUER')
    error_if_missing(@key,       '--key=FILE')
  end

  def self.process(args)
    options = Options.new
    options.parse(args)
    options.verify()

    return options
  end
end


#------------------------------------------------------------
# Extension of the json-jwt library
#------------------------------------------------------------
module JSON
  class JWT
    # Override the 'sign' method not to include 'kid'.
    def sign(private_key_or_secret, algorithm = :autodetect)
      jws = JWS.new self
      jws.alg = algorithm
      jws.sign! private_key_or_secret
    end
  end
end


#------------------------------------------------------------
# Entry Point
#------------------------------------------------------------
main(ARGV)