feat: [SIW-2740] Add verify and parse mdoc #265

ChrisMattew · 2025-07-29T13:42:46Z

List of Changes

Added the @pagopa/io-react-native-iso18013 and jsrsasign packages
Upgraded the @pagopa/io-react-native-crypto package
Restricted the format type returned by obtainCredential to a union of string literals (dc+sd-jwt and mso_mdoc)
Added the x5chain verification and the signature validation for the credentials in mdoc format
Added the parsing function for credentials in mdoc format, preserving the namespace while keeping the structure of ParsedCredential unchanged compared to the dc+sd-jwt format
Updated the example app and documentation accordingly, based on the changes made in the core library

Motivation and Context

This PR adds support for credentials in mdoc format, integrating the verification and parsing mechanisms for the credential

How to test it?

From the example app, once you have obtained what is needed to request credentials, request the MDL in mdoc format.
The credential verification must succeed (using a proxy tool, verify that after the /credential call, the /pki/ta-sub.crl endpoint is also called).
Once the credential has been obtained, using the debug interface available in the app, make sure that the structure of the parsedCredential matches the example below:

{
 // ...
 "org.iso.18013.5.1:claim_name": {
    "value": "...",
    "name": {
        "it-IT": "...",
        "en-EN": "...",
     }
  }
 // ...
}

Note

The test can be performed in both the PRE and PROD environments.

Demo:

PRE	PROD
PRE_mdl_mdoc.mov	PROD_mdl_mdoc.mov

Checklist:

My change requires a change to the documentation.
I have updated the documentation accordingly.

…-parse-mdoc

…upgrade io-react-native-crypto

src/mdoc/index.ts

Co-authored-by: grausof <[email protected]>

example/src/screens/ProximityScreen.tsx

src/utils/crypto.ts

src/credential/issuance/07-verify-and-parse-credential.ts

grausof

Great work 🎉

grausof · 2025-08-01T14:42:51Z

src/mdoc/index.ts

+/**
+ * This function verifies that the signature is valid for all certificates in the x5c chain.
+ * If not, it throws an error
+ *
+ * @param issuerSigned The decoded mdoc
+ */
+const verifySignatures = async (issuerSigned: CBOR.IssuerSigned) => {
+  await Promise.all(
+    issuerSigned.issuerAuth.unprotectedHeader.x5chain!.map(async (cert) => {
+      const pemcert = convertBase64DerToPem(b64utob64(cert));
+      const jwk = getSigninJwkFromCert(pemcert);
+
+      jwk.x = b64utob64(jwk.x!);
+      jwk.y = b64utob64(jwk.y!);
+
+      console.info(b64utob64(issuerSigned.issuerAuth.rawValue!));
+
+      const signatureCorrect = await COSE.verify(
+        b64utob64(issuerSigned.issuerAuth.rawValue!),
+        jwk as PublicKey
+      ).catch((e: any) => console.error(e));
+
+      if (!signatureCorrect) throw new Error("Invalid mDoc signature");
+    })
+  );
+};


The credential is signed only with the public key of the leaf certificate in the chain. Here, we're iterating through all the certificates, verifying the signature with all the public keys (this probably works now because there's only one certificate in the chain). My suggestion is to have a function that verifies the signature, like verifyMdocSignature(token, publicKey), and pass the public key from the caller, which in the example can be retrieved from the leaf certificate (usually the first in the X5c array).

Thanks, I applied your suggestion! It’s actually working now because there’s only one certificate in the chain.

Let me know if it's ok now

grausof · 2025-08-01T14:54:17Z

src/utils/crypto.ts

+ * This function takes two {@link PublicKey} and evaluates and compares their thumbprints
+ * @param key1 The first key
+ * @param key2 The second key
+ * @returns true if the keys' thumbprints are equal, false otherwise
+ */
+export const compareKeysByThumbprint = async (
+  key1: PublicKey,
+  key2: PublicKey
+) => {
+  //Parallel for optimization
+  const [thumbprint1, thumbprint2] = await Promise.all([
+    thumbprint(key1),
+    thumbprint(key2),
+  ]);
+  return thumbprint1 === thumbprint2;
+};


You already have isSameThumbprint from utils/jwks.ts

Thanks, I hadn't noticed there was already a function for that

Addressed here

…f the x5chain

gispada · 2025-08-01T15:37:24Z

src/credential/issuance/07-verify-and-parse-credential.ts

+  const key =
+    decodedCredential.issuerSigned.issuerAuth.payload.deviceKeyInfo.deviceKey;
+
+  if (!isSameThumbprint(key, holderBindingKey as PublicKey)) {


Suggested change

if (!isSameThumbprint(key, holderBindingKey as PublicKey)) {

if (!(await isSameThumbprint(key, holderBindingKey as PublicKey))) {

Good catch! Thank you!

ChrisMattew added 9 commits July 22, 2025 17:52

feat: add io-react-native-cbor

d4e97bc

feat: add verifyAndParseCredentialMdoc

0c5ee1b

Merge remote-tracking branch 'origin/master' into SIW-2740-verify-and…

091ce78

…-parse-mdoc

refactor: Unify parsedCredential output regardless of credential format

8bfead9

refactor: improve 'format' attribute typing in obtainCredential output

9f9f190

fix: wrong import

9b500ac

Merge remote-tracking branch 'origin/master' into SIW-2740-verify-and…

222df16

…-parse-mdoc

feat(android): restore minSdkVersion to 26

2dfd7a6

feat: replace io-react-native-cbor with io-react-native-iso18013 and …

df16891

…upgrade io-react-native-crypto

github-actions bot added example feat labels Jul 29, 2025

adelloste mentioned this pull request Jul 29, 2025

feat: [SIW-2789] Add proximity presentation in the example app #259

Merged

2 tasks

ChrisMattew and others added 7 commits July 29, 2025 16:29

style: prettify

fc6b623

test: add @pagopa/io-react-native-iso18013 mock

ee1a38d

feat: add authorityHints in the evaluateIssuerTrust output

6550a5b

feat: verify trust_chain for mdoc credentials

2d798fe

chore: add react-native-dialog to prompt cie pin insertion dialog

e963dbe

feat(mdoc): improve verifySignature and verifyChain

45f2ea0

Merge branch 'master' into SIW-2740-verify-and-parse-mdoc

77d3a41

grausof reviewed Jul 31, 2025

View reviewed changes

src/mdoc/index.ts Outdated Show resolved Hide resolved

src/mdoc/index.ts Outdated Show resolved Hide resolved

ChrisMattew added 3 commits July 31, 2025 17:54

refactor: decouple x5chain verification from the issuer's EC

2ecfabd

docs: uptade README accordingly with the changes proposed in this task

ae5e624

style: clean code

4a1f723

ChrisMattew self-assigned this Aug 1, 2025

ChrisMattew added documentation Improvements or additions to documentation enhancement New feature or request labels Aug 1, 2025

ChrisMattew marked this pull request as ready for review August 1, 2025 09:18

ChrisMattew requested a review from a team as a code owner August 1, 2025 09:18

ChrisMattew requested review from grausof and manuraf August 1, 2025 09:18

feat: [SIW-2789] Add proximity presentation in the example app (#259)

c3606b6

Co-authored-by: grausof <[email protected]>

grausof reviewed Aug 1, 2025

View reviewed changes

ChrisMattew added 4 commits August 1, 2025 14:21

feat: enable compareKeysByThumbprint for mdoc credentials

aaecc5a

docs: improve convertBase64DerToPem docs

1910287

chore: remove code duplication

a6b98b2

style: unified parsePublicKey and getSigningJwk in a dedicated function

6697ef6

grausof approved these changes Aug 1, 2025

View reviewed changes

Merge branch 'master' into SIW-2740-verify-and-parse-mdoc

7e349d5

ChrisMattew added the dont-merge ✋ label Aug 1, 2025

grausof reviewed Aug 1, 2025

View reviewed changes

ChrisMattew added 2 commits August 1, 2025 17:25

refactor: verify the mdoc signature using only the leaf certificate o…

5d4297d

…f the x5chain

style: remove code duplication

d3b1b92

gispada reviewed Aug 1, 2025

View reviewed changes

fix: wait for isSameThumbprint result

76ef1fe

ChrisMattew removed the dont-merge ✋ label Aug 1, 2025

ChrisMattew merged commit bb499b9 into master Aug 1, 2025
7 checks passed

ChrisMattew deleted the SIW-2740-verify-and-parse-mdoc branch August 1, 2025 15:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: [SIW-2740] Add verify and parse mdoc #265

feat: [SIW-2740] Add verify and parse mdoc #265

Uh oh!

ChrisMattew commented Jul 29, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

grausof left a comment

Uh oh!

grausof Aug 1, 2025

Uh oh!

ChrisMattew Aug 1, 2025

Uh oh!

grausof Aug 1, 2025

Uh oh!

ChrisMattew Aug 1, 2025

Uh oh!

ChrisMattew Aug 1, 2025

Uh oh!

gispada Aug 1, 2025

Uh oh!

ChrisMattew Aug 1, 2025

Uh oh!

Uh oh!

Uh oh!

	if (!isSameThumbprint(key, holderBindingKey as PublicKey)) {
	if (!(await isSameThumbprint(key, holderBindingKey as PublicKey))) {

feat: [SIW-2740] Add verify and parse mdoc #265

feat: [SIW-2740] Add verify and parse mdoc #265

Uh oh!

Conversation

ChrisMattew commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

List of Changes

Motivation and Context

How to test it?

Demo:

Checklist:

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

grausof left a comment

Choose a reason for hiding this comment

Uh oh!

grausof Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

ChrisMattew Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

grausof Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

ChrisMattew Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

ChrisMattew Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

gispada Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

ChrisMattew Aug 1, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ChrisMattew commented Jul 29, 2025 •

edited

Loading