AttestoClient.KeyAttestation (AttestoClient v2.3.0)

Copy Markdown View Source

Build an OID4VCI Key Attestation JWT (OpenID4VCI 1.0 "Key Attestation in JWT format" §D.1), the client-side mirror of Attesto.KeyAttestation.verify/2.

A key attestation, issued by the wallet's key-storage component or its Wallet Provider, vouches that a set of public keys are held in a class of secure storage. A wallet attaches one to a Credential Request in the key_attestation JOSE header of its jwt proof (see AttestoClient.Wallet.Proof); the issuer, configured to trust the signer, then requires the proof's key to appear in the attestation's attested_keys.

Signing and key-bound :alg/:kid validation behave as in AttestoClient.Wallet.Proof (shared AttestoClient.Builder internals).

Summary

Types

build_opt()
error()
jwk()

Functions

build(provider_key, opts)

Build a key attestation JWT, returning {:ok, compact_jws} or {:error, reason}. Fails fast on invalid input.

Types

build_opt()

@type build_opt() ::
  {:attested_keys, [jwk()]}
  | {:key_storage, [String.t()]}
  | {:user_authentication, [String.t()]}
  | {:certification, String.t()}
  | {:nonce, String.t()}
  | {:x5c, [String.t()]}
  | {:lifetime, pos_integer()}
  | {:alg, String.t()}
  | {:kid, String.t()}
  | {:now, integer()}

error()

@type error() ::
  :invalid_key
  | :invalid_attested_keys
  | :invalid_lifetime
  | :unsupported_alg
  | :unsupported_key
  | :invalid_time
  | {:signing_failed, String.t()}

jwk()

@type jwk() :: JOSE.JWK.t() | map()

Functions

build(provider_key, opts)

@spec build(jwk(), [build_opt()]) :: {:ok, String.t()} | {:error, error()}

Build a key attestation JWT, returning {:ok, compact_jws} or {:error, reason}. Fails fast on invalid input.

provider_key is the key-storage / Wallet Provider private key that signs the attestation. Required option :attested_keys is a non-empty list of the keys the attestation vouches for (JOSE.JWKs or JWK maps); their public halves are embedded, and the proof's holder key must be among them.

Optional: :key_storage / :user_authentication (attack-potential-resistance string lists), :certification (a URL), :nonce (echo the issuer's c_nonce), :x5c (base64 DER certificates for the header), :lifetime (seconds to exp, default 300), and :alg, :kid, :now as in AttestoClient.Wallet.Proof.build/2.