Implement W3C ecdsa-sd-2023 disclosure proof derivation and verification

[brody-0125]

Summary

Implements the holder-side and verifier-side logic for W3C ecdsa-sd-2023 selective disclosure, enabling credential holders to derive disclosure proofs from base proofs without exposing the issuer's HMAC key, and enabling verifiers to validate those derived proofs.

Key Changes

• SelectiveDisclosure.deriveProof(): Derives a disclosure proof from a base proof by:

  • Re-canonicalizing the credential to reproduce the exact quad list the issuer signed
  • Building a labelMap that maps canonical blank-node labels to their HMAC-derived equivalents
  • Stripping the HMAC key from the proof (critical security property)
  • Encoding the result as CBOR tag 0xd95d01 with base signature, public key, per-quad signatures, label map, and mandatory indexes

• SelectiveDisclosure.verifyDerivedProof(): Verifies a derived proof by:

  • Canonicalizing the revealed document and rewriting labels via the labelMap
  • Reconstructing the signed canonical form without needing the HMAC key
  • Splitting quads into mandatory (verified via base signature) and non-mandatory (individually verified)
  • Validating the base signature over SHA256(proofConfig) || SHA256(mandatoryQuads)
  • Validating each non-mandatory quad's individual ECDSA P-256 signature

• CborDecoder (new): Minimal CBOR decoder supporting the subset of types needed for ecdsa-sd-2023:

  • Decodes base proof values (tag 0xd95d02)
  • Decodes derived proof values (tag 0xd95d01)
  • Supports unsigned integers, byte strings, text strings, arrays, maps, and 2-byte CBOR tags

• CborEncoder.encodeDerivedProofValue(): Encodes derived proof values as CBOR, intentionally omitting the HMAC key to prevent verifiers from reversing blank-node masking

• Helper methods:

  • decompressP256PublicKey(): Decompresses SEC1 33-byte compressed P-256 public keys
  • buildLabelMap(): Maps canonical labels to HMAC-derived labels
  • applyLabelMap(): Rewrites N-Quads using the label map
  • verifyEcdsaP256(): Validates ECDSA P-256 signatures with fallback for different JCA implementations

• Comprehensive test suite (SelectiveDisclosureTest): Validates:

  • Derived proof structure and CBOR tag correctness
  • HMAC key is stripped from derived proofs (security guarantee)
  • Round-trip derivation and verification succeeds
  • Verification fails on tampered documents or corrupted signatures
  • Derivation is deterministic for fixed inputs

Notable Implementation Details

• The HMAC key is intentionally excluded from derived proofs — including it would allow any verifier to brute-force the small canonical-label space and recover undisclosed claims via dictionary attacks
• Verification never requires the HMAC key, enabling true selective disclosure
• The labelMap enables verifiers to reconstruct the exact canonical form the issuer signed without holding the HMAC key
• Mandatory vs. non-mandatory quad split is preserved via mandatoryIndexes to distinguish base-signature-covered quads from individually-signed quads
• Initial implementation reveals the entire document; selective subsetting at presentation time is deferred to a follow-up

https://claude.ai/code/session_01Gr5Er7AoKJj7UH3aeJat4L