Difference between MdocCborIssuer private key and wallet devicekeyinfo

[oligatorr]

Hello

In the example code of the Readme (Usage/Issue an MDOC CBOR) one can see:

mdoci = MdocCborIssuer(
    private_key=PKEY
)

mdoc = mdoci.new(
    doctype="eu.europa.ec.eudiw.pid.1",
    data=PID_DATA,
    devicekeyinfo=PKEY  # TODO
)

According to this example, the private key utilised to sign the attestation in CBOR is the same as the devicekeyinfo. However devicekeyinfo in my understanding is a secret concealed in the wallet that is used to ensure that the attestations stored in the wallet are cryptographically linked to the wallet. (Furthermore I think this is the private key linked to the Wallet Instance Attestation).

Is this example meaningful ? Shouldn't MdocCborIssuer private_key attribute and devicekeyinfo be two different private keys

• one owned by the issuer and
• the other concealed in the wallet in which attestations will be issued ?

Thank you in advance for your answers/comments

Olivier

[peppelinux]

you are right, the example naively uses the same key while the device signed part must use a private cryptographic material under the sole control of the holder and therefore different from the one used by the credential issuer

if you might want, you can offer a contribution in the form of a PR adding another key as owned only by holder

[oligatorr]

Hello Giuseppe,

I have forked this project in an internal repository and brought some necessary changes (IMHO) to make it work with python script attestation generator of our own. I will consider to make a public fork on github so that a proper PR could be submitted as my preference is not to depend of a fork of your library.

"Necessary changes" include a fix in the check signature functions in the library and other stuff like unit tests enhancing.

I'll let you know when it is ready.

Olivier

[peppelinux]

@oligatorr if you are ready with the PR, please do

[oligatorr]

Hello @peppelinux

I recently figured out that I actually (hopefully) enhanced a fork (https://github.com/eu-digital-identity-wallet/pyMDOC-CBOR) of this lib. So if I suggest a PR, it will be based on the latest version of the here before repo which includes this commit eu-digital-identity-wallet@d46a5f7

I was not sure that merging back the fork from https://github.com/eu-digital-identity-wallet/pyMDOC-CBOR, is what is needed or wished for this library so I have put the question aside. I am ready to discuss these questions in a private channel if you feel it useful. Unfortunately I already tried to figure out how to create a private channel from github without success.

Regards

Olivier

[peppelinux]

we hare handling a merge of the eudiw fork here: #9
please join in the review and provide the changes within the review or using the same branch opening a sub fork

ottherwise you can wait for the PR 9 to be merged before proceed

[oligatorr]

I prefer to wait for your eudiw fork merge to avoid to mixing different subject and goals together. In the mean time you could have a look to my last commit: oligatorr@9703fdf in https://github.com/oligatorr/pyMDOC-CBOR

[peppelinux]

@oligatorr I just have release version 0.7.0 with all the alignments taken from the eu reference implementation

we now are ready to take your PR. I have read your commit, it is pretty good

looking forward for your contributions

[oligatorr]

Hello @peppelinux

As you have seen I have proposed my PR (see #12). Two remarks:

1. Looks like Luis P. and I add the same argument to pass status list (revocation) to mdoc and mso. I kept my naming because it is more specific ("Status list" revocation vs "Identifier list" revocation refs) (and easier for me :o)
2. In the code that use this library I have an implementation of status list reference integration into mso, would that make sense to move status list implementation into this lib instead of having to build status list dictionary before passing it to the mdoc/mso objects ? It will imply more parameter though (cert, index,url...)

[peppelinux]

@oligatorr what about moving the status list python impl into a dedicated python project?

it would be usable also for other token data formts, like sd-jwt-vc.

we may also think in the future to migrate it into identitypython and invite you as an active contributor of this community

I just have completed my last review on your PR, you will find it there

[peppelinux]

Resolved by #12