path-check / dcc-sdk.js

Verifiable QR SDK for EU Digital Green Certificates

Verifiable QR SDK for EU Digital Covid Certificates

JavaScript Implementation of EU's Digital Covid Certificates, a CBOR/COSE-based Verifiable QR Credentials.

Install

npm install @pathcheck/dcc-sdk --save

Setting up CSCA, DCS and Key IDs

./gen-csca-dsc.sh

It will generate a dsc-worker.p8 file like this:

-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgZgp3uylFeCIIXozb
ZkCkSNr4DcLDxplZ1ax/u7ndXqahRANCAARkJeqyO85dyR+UrQ5Ey8EdgLyf9Nts
CrwORAj6T68/elL19aoISQDbzaNYJjdD77XdHtd+nFGTQVpB88wPTwgb
-----END PRIVATE KEY-----

and a dsc-worker.pem certificate as:

-----BEGIN CERTIFICATE-----
MIIBYDCCAQYCEQCAG8uscdLb0ppaneNN5sB7MAoGCCqGSM49BAMCMDIxIzAhBgNV
BAMMGk5hdGlvbmFsIENTQ0Egb2YgRnJpZXNsYW5kMQswCQYDVQQGEwJGUjAeFw0y
MTA0MjcyMDQ3MDVaFw0yNjAzMTIyMDQ3MDVaMDYxJzAlBgNVBAMMHkRTQyBudW1i
ZXIgd29ya2VyIG9mIEZyaWVzbGFuZDELMAkGA1UEBhMCRlIwWTATBgcqhkjOPQIB
BggqhkjOPQMBBwNCAARkJeqyO85dyR+UrQ5Ey8EdgLyf9NtsCrwORAj6T68/elL1
9aoISQDbzaNYJjdD77XdHtd+nFGTQVpB88wPTwgbMAoGCCqGSM49BAMCA0gAMEUC
IQDvDacGFQO3tuATpoqf40CBv09nfglL3wh5wBwA1uA7lAIgZ4sOK2iaaTsFNqEN
AF7zi+d862ePRQ9Lwymr7XfwVm0=
-----END CERTIFICATE-----

Usage

With the keys:

const PRIVATE_KEY = `-----BEGIN PRIVATE KEY-----
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgZgp3uylFeCIIXozb
ZkCkSNr4DcLDxplZ1ax/u7ndXqahRANCAARkJeqyO85dyR+UrQ5Ey8EdgLyf9Nts
CrwORAj6T68/elL19aoISQDbzaNYJjdD77XdHtd+nFGTQVpB88wPTwgb
-----END PRIVATE KEY-----`;

const PUB_KEY_ID = `-----BEGIN CERTIFICATE-----
MIIBYDCCAQYCEQCAG8uscdLb0ppaneNN5sB7MAoGCCqGSM49BAMCMDIxIzAhBgNV
BAMMGk5hdGlvbmFsIENTQ0Egb2YgRnJpZXNsYW5kMQswCQYDVQQGEwJGUjAeFw0y
MTA0MjcyMDQ3MDVaFw0yNjAzMTIyMDQ3MDVaMDYxJzAlBgNVBAMMHkRTQyBudW1i
ZXIgd29ya2VyIG9mIEZyaWVzbGFuZDELMAkGA1UEBhMCRlIwWTATBgcqhkjOPQIB
BggqhkjOPQMBBwNCAARkJeqyO85dyR+UrQ5Ey8EdgLyf9NtsCrwORAj6T68/elL1
9aoISQDbzaNYJjdD77XdHtd+nFGTQVpB88wPTwgbMAoGCCqGSM49BAMCA0gAMEUC
IQDvDacGFQO3tuATpoqf40CBv09nfglL3wh5wBwA1uA7lAIgZ4sOK2iaaTsFNqEN
AF7zi+d862ePRQ9Lwymr7XfwVm0=
-----END CERTIFICATE-----`

And a Payload

const TEST_PAYLOAD = {
  "ver": "1.0.0",
  "nam": {
    "fn": "d'Arsøns - van Halen",
    "gn": "François-Joan",
    "fnt": "DARSONS<VAN<HALEN",
    "gnt": "FRANCOIS<JOAN"
  },
  "dob": "2009-02-28",
  "v": [
    {
      "tg": "840539006",
      "vp": "1119349007",
      "mp": "EU/1/20/1528",
      "ma": "ORG-100030215",
      "dn": 2,
      "sd": 2,
      "dt": "2021-04-21",
      "co": "NL",
      "is": "Ministry of Public Health, Welfare and Sport",
      "ci": "urn:uvci:01:NL:PlA8UWS60Z4RZXVALl6GAZ"
    }
  ]
};

Call the signAndPack to create the URI for the QR Code:

const qrUri = await signAndPack(await makeCWT(TEST_PAYLOAD), PUBLIC_KEY_PEM, PRIVATE_KEY_P8);

And call the unpack and verify to convert the URI into the payload:

var cachedCerts = {}

// Load the testing certificates into the local registry.
cachedCerts["Rjene8QvRwA="] = "MIIBYDCCAQYCEQCAG8uscdLb0ppaneNN5sB7MAoGCCqGSM49BAMCMDIxIzAhBgNVBAMMGk5hdGlvbmFsIENTQ0Egb2YgRnJpZXNsYW5kMQswCQYDVQQGEwJGUjAeFw0yMTA0MjcyMDQ3MDVaFw0yNjAzMTIyMDQ3MDVaMDYxJzAlBgNVBAMMHkRTQyBudW1iZXIgd29ya2VyIG9mIEZyaWVzbGFuZDELMAkGA1UEBhMCRlIwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARkJeqyO85dyR+UrQ5Ey8EdgLyf9NtsCrwORAj6T68/elL19aoISQDbzaNYJjdD77XdHtd+nFGTQVpB88wPTwgbMAoGCCqGSM49BAMCA0gAMEUCIQDvDacGFQO3tuATpoqf40CBv09nfglL3wh5wBwA1uA7lAIgZ4sOK2iaaTsFNqENAF7zi+d862ePRQ9Lwymr7XfwVm0="

DCC.addCachedCerts(cachedCerts)

const payload = await unpackAndVerify(qrUri);

Development

npm install

Test

npm test

dcc-sdk.js's Issues

Setting up CSCA, DCS and Key IDs

Hi, first of all thank you for this lib, I was trying to test it but I'm stuck with the command ./gen-csca-dsc.sh
The terminal change title to "openssl" but stay still, it generates only the "csca.key"
Any suggestion?

KeyID not found: XkVWZqUeeFc

Hello,

first of all thank you very much for developing this library. I could already successfully debug a vaccination certificate.

I tested a German certificate but it can not be verified due to the error message KeyID not found: XkVWZqUeeFc.

I'm not sure if the public keys are out of the scope of this project but I saw some in the resolver.js so maybe there is 'just' ca key missing.

Problems importing the library from a ESM module

Hello,

I just wanted to create a minimal script for trying out this library and came across two issues that I want to report.

I created a new directory and installed the library as mentioned in the README via

npm install @pathcheck/dcc-sdk --save

As I get it, the library is already implemented as ESM, and the file index.js basically just converts the whole thing to CommonJS. But I wasn't sure how to properly import the library, ideally without converting the ESM module to CommonJS first and then back to ESM again, by directly accessing main.js instead of index.js.

So maybe you could mention how to properly import the library in the README file, both via ESM and CommonJS?

Anyway, since I wasn't sure how to import the library via ESM, I started by simply creating a minimal test.mjs file just to see what's being exported and how to import it:

import * as dcc_sdk1 from '@pathcheck/dcc-sdk';

console.log('a1', dcc_sdk1);

import dcc_sdk2 from '@pathcheck/dcc-sdk';

console.log('a2', dcc_sdk2);

I ran the script via node test.mjs (Node version v14.17.0, AFAIK the latest LTS release), but for some reason, the output suggested that nothing was being imported at all:

a1 [Module: null prototype] { default: {} }
a2 {}

Strangely, when I made a tiny modification to the index.js file of dcc-sdk, by simply replacing the line

module.exports = require('./main.js');

with

const main = require('./main.js');
module.exports = main;

the output of my little test script suggested that everything was now imported just fine (even though I don't understand why it even makes any difference):

a1 [Module: null prototype] {
  default: {
    sign: [AsyncFunction: sign],
    verify: [AsyncFunction: verify],
    pack: [AsyncFunction: pack],
    unpack: [AsyncFunction: unpack],
    signAndPack: [AsyncFunction: signAndPack],
    unpackAndVerify: [AsyncFunction: unpackAndVerify],
    signAndPack32: [AsyncFunction: signAndPack32],
    signAndPack45: [AsyncFunction: signAndPack45],
    makeCWT: [AsyncFunction: makeCWT],
    parseCWT: [AsyncFunction: parseCWT],
    debug: [AsyncFunction: debug],
    encode: [Function: encode],
    decode: [Function: decode],
    decodeToUtf8String: [Function: decodeToUtf8String]
  }
}
a2 {
  sign: [AsyncFunction: sign],
  verify: [AsyncFunction: verify],
  pack: [AsyncFunction: pack],
  unpack: [AsyncFunction: unpack],
  signAndPack: [AsyncFunction: signAndPack],
  unpackAndVerify: [AsyncFunction: unpackAndVerify],
  signAndPack32: [AsyncFunction: signAndPack32],
  signAndPack45: [AsyncFunction: signAndPack45],
  makeCWT: [AsyncFunction: makeCWT],
  parseCWT: [AsyncFunction: parseCWT],
  debug: [AsyncFunction: debug],
  encode: [Function: encode],
  decode: [Function: decode],
  decodeToUtf8String: [Function: decodeToUtf8String]
}

523 passing, 13 test failed

Just playing around with the sdk.
Tried to run tests and got the following:

Env details:
OpenSSL 1.1.1k 25 Mar 2021
Node v10.20.1

  13 failing
 
  1) CH
       should verify CH_2DCode_raw_1:
     AssertionError: expected undefined not to be undefined
      at Context.it (test/CH.spec.js:8:33)
      at process._tickCallback (internal/process/next_tick.js:68:7)
 
  2) CH
       should verify CH_2DCode_raw_3:
     AssertionError: expected undefined not to be undefined
      at Context.it (test/CH.spec.js:16:33)
      at process._tickCallback (internal/process/next_tick.js:68:7)
 
  3) ES
       should verify ES_2DCode_raw_1002:
     AssertionError: expected undefined not to be undefined
      at Context.it (test/ES.spec.js:31:33)
      at process._tickCallback (internal/process/next_tick.js:68:7)
 
  4) ES
       should verify ES_2DCode_raw_1003:
     AssertionError: expected undefined not to be undefined
      at Context.it (test/ES.spec.js:84:33)
      at process._tickCallback (internal/process/next_tick.js:68:7)
 
  5) ES
       should verify ES_2DCode_raw_1001:
     AssertionError: expected undefined not to be undefined
      at Context.it (test/ES.spec.js:129:33)
      at process._tickCallback (internal/process/next_tick.js:68:7)
 
  6) IS
       should verify IS_2DCode_raw_3:
     AssertionError: expected undefined not to be undefined
      at Context.it (test/IS.spec.js:24:33)
      at process._tickCallback (internal/process/next_tick.js:68:7)
 
  7) IS
       should verify IS_2DCode_raw_4:
     AssertionError: expected undefined not to be undefined
      at Context.it (test/IS.spec.js:32:33)
      at process._tickCallback (internal/process/next_tick.js:68:7)
 
  8) IS
       should verify IS_2DCode_raw_5:
     AssertionError: expected undefined not to be undefined
      at Context.it (test/IS.spec.js:40:33)
      at process._tickCallback (internal/process/next_tick.js:68:7)
 
  9) LT
       should verify LT_2DCode_raw_1:
     AssertionError: expected undefined not to be undefined
      at Context.it (test/LT.spec.js:8:33)
      at process._tickCallback (internal/process/next_tick.js:68:7)
 
  10) LT
       should verify LT_2DCode_raw_2:
     AssertionError: expected undefined not to be undefined
      at Context.it (test/LT.spec.js:16:33)
      at process._tickCallback (internal/process/next_tick.js:68:7)
 
  11) LT
       should verify LT_2DCode_raw_3:
     AssertionError: expected undefined not to be undefined
      at Context.it (test/LT.spec.js:24:33)
      at process._tickCallback (internal/process/next_tick.js:68:7)
 
  12) common
       should verify common_2DCode_raw_CO2:
     AssertionError: expected undefined not to be undefined
      at Context.it (test/common.spec.js:23:33)
      at process._tickCallback (internal/process/next_tick.js:68:7)
 
  13) common
       should verify common_2DCode_raw_CO1:
     AssertionError: expected undefined not to be undefined
      at Context.it (test/common.spec.js:155:33)
      at process._tickCallback (internal/process/next_tick.js:68:7)
 

Problem with the Digital COVID Certificate

Dear Vitorpamplona

I Have used your code, https://github.pathcheck.org/eu.dgc.html, here and used the CH1 generated QR Code. Everything works only if I check it with the official Corona app an failure occurs. COVID Certificate has no valid singature.
I have used the COVID CERTIFICATE app for Samsung to read in the CH1 generated QR Code, it exchanged it to an othere QR Code where all the datas are correct. But the problem is if I scan now this code with the COVID CERTIFICATE
CHECK app it shows Certificate has no valid signature.
All the APPS are from Switzerland Government.
If anyone can helpf me fixing it I would very appreciate.

I do not have the programming background available and no progrmmer tool.

Thanks a lot and help is very appreciated

Avoid unnecessary async functions?

When looking at the source code, I came to realize that there are some functions that seem to be unnecessarily marked as being async.

The debug function in file dcc.js for example has the following implementation

export async function debug(uri) {
  return await decodeCbor(await unpack(uri));
}

So it is probably being marked as async because it uses and awaits the functions decodeCbor and unpack, which are both marked as being async.
But it seems to me that these two functions don't need to be async either; there is no await statement in the unpack function, and the only await statements in decodeCbor are when the decodeCbor function itself is being called recursively, so async/await should be unnecessary here as well.

I haven't looked at the rest of the code, so there might be more functions that are ultimately unnecessarily marked as being async.