Post-Quantum (PQ) and Post-Quantum/Traditional (PQ/T) hybrid signatures for VCs #1625

AleCla97 · 2025-03-31T10:20:53Z

Description of change

Integration of Post-Quantum (PQ) and Post-Quantum/Traditional (PQ/T) hybrid signatures for VCs

New features: pqc for PQ related code, hybrid for hybrid related code, pqc-liboqs for the pq signatures implementation based on liboqs, hybrid-liboqs for the hybrid signatures implementation, based on this draft
JwkStoragePQ: Extension of the JwkStorage for pq keys and Memstore implementation
Algorithm Key Pair (AKP), new Jwktype for PQ JWKs based on ML-DSA for JOSE and COSE
draft
CompositeAlgId: Hybrid keytype MLDSA44/65-ED25519
DID JWK extension: create a new DID JWK with traditional, pq, hybrid and zk keys
DIDCompositeJWK, did method for hybrid keys and his relative resolver
JwtCredentialValidatorHybrid and JwtPresentationValidatorHybrid, hybrid signature validators
PQCJwsVerifier, verifier for PQ signatures with an implementation based on liboqs
New examples: pq and hybrid
Wasm: bindings of the new functions
Wasm: new examples: pq and hybrid
Wasm: JwkPqMemStore and PQJwsVerifier implementation of JwkStorage and IJwsVerifier with noble post quantum for ML-DSA

Other changes

Bump zkryptium and json proof token version to match the latest BBS and JPT drafts

Type of change

Add an x to the boxes that are relevant to your changes.

Bug fix (a non-breaking change which fixes an issue)
Enhancement (a non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Documentation Fix

How the change has been tested

cargo test --release to see that there were no incompatibilities.
the new features were tested through the new pq and hybrid tests( both rust and wasm.)
the update of zkryptium and json proof token was also tested by running the zkp tests

Change checklist

Add an x to the boxes that are relevant to your changes.

I have followed the contribution guidelines for this project
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation
I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes

…jose

…efined in it

…wp implementation

…tPresentationValidationOptions

…ntial is supported during presentation

…tion

… BBS and JPT drafts

This reverts commit 40192b3.

UMR1352

Thank you for your outstanding effort 🙇! I went through your changes, leaving some comments here and there.
What's left to do now is:

address the comments and review again;
format the code accordingly to our formatting rules;
resolve merge conflicts and adapt this to work with the latest version of the library;
harmonize the licence headers (for files that you guys edited I'd remove the additional modification comment and instead add the LINKS foundation name next to ours);

As always, let us now how much you want to be involved in the aforementioned steps.

UMR1352 · 2025-05-21T08:38:25Z

Cargo.toml

+json-proof-token = { version = "0.4.1" }
+zkryptium = { version = "0.4.0", default-features = false, features = ["bbsplus"] }
+oqs = {version = "0.10.0", default-features = false, features = ["sigs", "std", "vendored"] }


Unless it's really needed, let's try to avoid pinning dependencies to a specific patch version. For instance:
oqs = { version = "0.10.0", ... } should be oqs = { version = "0.10", ... }

UMR1352 · 2025-05-22T09:12:05Z

identity_jose/src/jwk/composite_jwk.rs

+
+use crate::jwk::Jwk;
+
+/// Mame of algorithms used to generate the hybrid signature.


Suggested change

/// Mame of algorithms used to generate the hybrid signature.

/// Algorithms used to generate hybrid signatures.

UMR1352 · 2025-05-22T09:15:34Z

identity_jose/src/jwk/composite_jwk.rs

+pub enum CompositeAlgId {
+  /// DER encoded value in hex = 060B6086480186FA6B5008013E
+  #[serde(rename = "id-MLDSA44-Ed25519")]
+  IdMldsa44Ed25519,
+  /// DER encoded value in hex = 060B6086480186FA6B50080147
+  #[serde(rename = "id-MLDSA65-Ed25519")]
+  IdMldsa65Ed25519,
+}
+


Is there any chance that more algorithms will be added in the close-ish future? If that's so we might want to annotate this enum with the #[non_exhaustive] attribute to allow extending the list without causing breaking changes.

UMR1352 · 2025-05-22T09:25:50Z

identity_jose/src/jwk/composite_jwk.rs

+/// Represent a combination of a traditional public key and a post-quantum public key both in Jwk format.
+#[derive(Clone, Debug, PartialEq, Eq, serde::Deserialize, serde::Serialize)]
+pub struct CompositeJwk {
+  #[serde(rename = "algId")]
+  alg_id: CompositeAlgId,
+  #[serde(rename = "traditionalPublicKey")]
+  traditional_public_key: Jwk,
+  #[serde(rename = "pqPublicKey")]
+  pq_public_key: Jwk,
+}
+
+impl CompositeJwk {
+  /// Create a new CompositePublicKey structure.
+  pub fn new(alg_id: CompositeAlgId, traditional_public_key: Jwk, pq_public_key: Jwk) -> Self {
+    Self {
+      alg_id,
+      traditional_public_key,
+      pq_public_key,
+    }
+  }


We have a slight issue with this definition of CompositeJwk. The current API doesn't prevent its users from misusing it. For instance, one could create a CompositeJwk providing a non-post-quantum JWK for pq_public_key.
To enhance type correctness we could define a struct PostQuantumJwk(Jwk) that upholds this invariant - i.e. post quantum key encoded as JWK. Such a type, equipped with the right methods and traits implementation would make it seamlessly work with Jwk while strengthening the correctness of our API.

The same argument would be made for the fact that the passed JWKs might be private keys instead of public ones, though in this instance we can simply make sure to clear out the private components of the passed keys before creating a CompositeJwk.

UMR1352 · 2025-05-22T09:28:03Z

identity_jose/src/jwk/jwk_akp.rs

+impl Default for JwkParamsAKP {
+    fn default() -> Self {
+        Self::new()
+    }
+}


This could be derived.

UMR1352 · 2025-05-23T10:31:33Z

bindings/wasm/src/jose/compositejwk.rs

+use crate::jose::IJwkParams;
+
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
+#[wasm_bindgen(js_name = CompositeJwk, inspectable)]


inspectable doens't do anything as there are no public fields.

UMR1352 · 2025-05-23T10:34:03Z

bindings/wasm/src/did/did_compositejwk.rs

+  }
+
+  /// Returns the JSON WEB KEY (JWK) encoded inside this `did:jwk`.
+  #[wasm_bindgen]


Suggested change

#[wasm_bindgen]

#[wasm_bindgen(js_name = compositeJwk)]

UMR1352 · 2025-05-23T10:37:01Z

bindings/wasm/src/credential/jwt_credential_validation/jwt_credential_validator_hybrid.rs

Are we sure we want to expose these JWT/Credential handling utilities?

UMR1352 · 2025-05-23T12:02:51Z

identity_jose/src/jwk/composite_jwk.rs

+pub struct CompositeJwk {
+  #[serde(rename = "algId")]
+  alg_id: CompositeAlgId,
+  #[serde(rename = "traditionalPublicKey")]
+  traditional_public_key: Jwk,
+  #[serde(rename = "pqPublicKey")]
+  pq_public_key: Jwk,
+}


Suggested change

pub struct CompositeJwk {

#[serde(rename = "algId")]

alg_id: CompositeAlgId,

#[serde(rename = "traditionalPublicKey")]

traditional_public_key: Jwk,

#[serde(rename = "pqPublicKey")]

pq_public_key: Jwk,

}

#[serde(rename_all = "camelCase")]

pub struct CompositeJwk {

alg_id: CompositeAlgId,

traditional_public_key: Jwk,

pq_public_key: Jwk,

}

UMR1352 · 2025-05-23T12:21:24Z

bindings/wasm/src/iota/iota_document_ext.rs

wasm_bindgen supports async functions

AlbertoSvg added 30 commits November 14, 2023 17:53

mapping from Jwk (JwkExt) from json-proof-token to Jwk from identity_…

12722a3

…jose

implemented JwpDocumentExt for IotaDocument and CoreDocument

b012e97

generate_method_extended that handles both JWS and JWP algorithm

b170249

new trait JwpDocumentExt separated from JwkDocumentExt using macros d…

7d9fee0

…efined in it

json-proof-token dependency update

d948aea

From<CredentialJwtClaims> trait for JptClaims and create_credential_j…

db46722

…wp implementation

new JwpOptions

21b9588

successful issuing of a jpt VC

fb8e303

fix stronhold path

732e4c6

fix JPT type

234843f

update to latest version of json-proof-token library

e783430

Merge branch 'iotaledger:main' into jwp-integration

55749ca

fix key conversion

53051fe

alternative selective disclosure method

4b9a199

Jwp Presentation creation

a7fbe6b

remove JwpOptions and introduce JptCredentialValidationOptions and Jp…

9e5a595

…tPresentationValidationOptions

JWP Presentation verification

217a754

removed multiple issuers during JWP verification since only one Crede…

b33a604

…ntial is supported during presentation

extract_issuer_from_presented_jpt util and remove identity_zk module

6429817

add some comments

820672f

fix jti undisclose

1fea3be

comments and fix nbf undisclosing

ef77d68

new RevocationTimeframeStatus and revocation check

4becafb

remove unused 'use' statements

b03bdc1

remove ValidityTimeframeGranularity::SECOND

f274243

Merge remote-tracking branch 'origin/main' into zk-revocation-integra…

2e4ad45

…tion

rename examples and minor fix

9f3a5d9

add RevocationTimeframeStatus

a74f5aa

revocation in credential and presentation validation

23938a7

add TimeframeRevocationExtension for Core/IotaDocument

071e6b8

AleCla97 and others added 16 commits April 9, 2025 09:23

revert changes

4f84977

revert changes

0ef1e93

Enhance documentation

82b5195

Bump zkryptium and json proof token to match to latest BBS and JPT draft

bc063d5

Wasm: Bump zkryptium and json proof token version to match the latest…

00bd898

… BBS and JPT drafts

Update VerificationMethod to use CompositeJsonWebKey type

1c6c692

Add missing wasm bindings

ed4ecb1

wasm: JwtPresentationValidatorHybrid bindings

b4f8b6d

wasm: PQ and PQ/T examples

043e115

add noble pq

b2288cf

fix

f7dd7c3

fix

df13906

hybrid signature implementation update to the latest draft

0335674

WASM: hydrid signature update

18c4894

Merge branch 'main' into feat/pq-t-integration

bfbbd47

fix and cleanup

1f1a4e2

eike-hass added Wasm Related to Wasm bindings. Becomes part of the Wasm changelog Added A new feature that requires a minor release. Part of "Added" section in changelog Rust Related to the core Rust code. Becomes part of the Rust changelog. labels Apr 17, 2025

eike-hass force-pushed the main branch 2 times, most recently from bb21207 to 42fc734 Compare April 22, 2025 16:04

AleCla97 added 5 commits April 23, 2025 14:14

fix fmt

4dab177

fix fmt

12a0674

synch

40192b3

Revert "synch"

bd9cfed

This reverts commit 40192b3.

remove example number

f38f0ee

AleCla97 marked this pull request as ready for review April 23, 2025 14:03

AleCla97 requested a review from a team as a code owner April 23, 2025 14:03

Adding missing copyright headers

e13d256

UMR1352 reviewed May 23, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Post-Quantum (PQ) and Post-Quantum/Traditional (PQ/T) hybrid signatures for VCs #1625

Post-Quantum (PQ) and Post-Quantum/Traditional (PQ/T) hybrid signatures for VCs #1625

AleCla97 commented Mar 31, 2025 •

edited

Loading

Uh oh!

UMR1352 left a comment

Uh oh!

UMR1352 May 21, 2025

Uh oh!

UMR1352 May 22, 2025

Uh oh!

UMR1352 May 22, 2025

Uh oh!

UMR1352 May 22, 2025

Uh oh!

UMR1352 May 22, 2025

Uh oh!

UMR1352 May 23, 2025

Uh oh!

UMR1352 May 23, 2025

Uh oh!

UMR1352 May 23, 2025

Uh oh!

UMR1352 May 23, 2025

Uh oh!

UMR1352 May 23, 2025

Uh oh!

Uh oh!


		use crate::jwk::Jwk;

		/// Mame of algorithms used to generate the hybrid signature.

	/// Mame of algorithms used to generate the hybrid signature.
	/// Algorithms used to generate hybrid signatures.

Post-Quantum (PQ) and Post-Quantum/Traditional (PQ/T) hybrid signatures for VCs #1625

Are you sure you want to change the base?

Post-Quantum (PQ) and Post-Quantum/Traditional (PQ/T) hybrid signatures for VCs #1625

Conversation

AleCla97 commented Mar 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description of change

Type of change

How the change has been tested

Change checklist

Uh oh!

UMR1352 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

AleCla97 commented Mar 31, 2025 •

edited

Loading