[VCI] Support Cred Request encryption

Author: QZHelen

app/src/main/java/com/credman/cmwallet/openid4vci/OpenId4VCI.kt

@@ -7,6 +7,7 @@ import android.util.Log
 import androidx.compose.ui.input.key.Key
 import com.credman.cmwallet.CmWalletApplication.Companion.TAG
 import com.credman.cmwallet.createJWTES256
+import com.credman.cmwallet.jweSerialization
 import com.credman.cmwallet.loadECPrivateKey
 import com.credman.cmwallet.openid4vci.data.CredentialOffer
 import com.credman.cmwallet.openid4vci.data.CredentialRequest
@@ -37,6 +38,7 @@ import io.ktor.http.parameters
 import io.ktor.serialization.kotlinx.json.json
 import io.ktor.util.encodeBase64
 import kotlinx.coroutines.delay
+import kotlinx.serialization.encodeToString
 import kotlinx.serialization.json.Json
 import kotlinx.serialization.json.JsonArray
 import kotlinx.serialization.json.JsonObject
@@ -283,6 +285,19 @@ class OpenId4VCI(val credentialOfferJson: String) {
         return result.body()
     }
 
+    fun requireCredentialRequestEncryption(): Boolean = credentialOffer.issuerMetadata.credentialRequestEncryption?.encryptionRequired ?: false
+    fun getCredentialRequestEncryptionKey(): JSONObject {
+        require(credentialOffer.issuerMetadata.credentialRequestEncryption!!.encValuesSupported.contains("A128GCM")) {
+            "Don't support the credential request encryption method yet"
+        }
+        val keys = credentialOffer.issuerMetadata.credentialRequestEncryption.jwks.keys
+        val key = keys.firstOrNull{
+            it.alg == "ECDH-ES"
+        } ?: throw java.lang.UnsupportedOperationException("No supported encryption key")
+        return JSONObject(Json.encodeToString(key))
+    }
+    fun requireCredentialResponseEncryption(): Boolean = credentialOffer.issuerMetadata.credentialResponseEncryption?.encryptionRequired ?: false
+
     @OptIn(ExperimentalUuidApi::class)
     suspend fun requestCredentialFromEndpoint(
         accessToken: String,
@@ -299,9 +314,18 @@ class OpenId4VCI(val credentialOfferJson: String) {
             header(HttpHeaders.Authorization, "Dpop $accessToken")
             header("dpop", dpop)
 
-            contentType(ContentType.Application.Json)
-            setBody(json.encodeToJsonElement(credentialRequest))
-
+            if (requireCredentialRequestEncryption()) {
+                contentType(ContentType("application", "jwt"))
+                setBody(jweSerialization(
+                    recipientKeyJwk = getCredentialRequestEncryptionKey(),
+                    plainText = json.encodeToJsonElement(credentialRequest).toString()
+                ))
+            } else {
+                contentType(ContentType.Application.Json)
+                setBody(
+                    json.encodeToJsonElement(credentialRequest)
+                )
+            }
         }
 
         if (result.status == HttpStatusCode.Unauthorized) {

app/src/main/java/com/credman/cmwallet/openid4vci/data/CredentialOfferEndpoint.kt

@@ -25,6 +25,29 @@ data class Grants(
     @SerialName("authorization_code") val authorizationCode: GrantAuthorizationCode?,
 )
 
+@Serializable
+data class JwkKey(
+    @SerialName("kty") val kty: String,
+    @SerialName("use") val use: String?,
+    @SerialName("alg") val alg: String?,
+    @SerialName("kid") val kid: String?,
+    @SerialName("x") val x: String?,
+    @SerialName("y") val y: String?,
+)
+
+@Serializable
+data class Jwks(
+    @SerialName("keys") val keys: List<JwkKey>,
+)
+
+
+@Serializable
+data class CredentialRequestEncryption(
+    @SerialName("jwks") val jwks: Jwks,
+    @SerialName("enc_values_supported") val encValuesSupported: List<String>,
+    @SerialName("encryption_required") val encryptionRequired: Boolean
+)
+
 @Serializable
 data class CredentialResponseEncryption(
     @SerialName("alg_values_supported") val algValuesSupported: List<String>,
@@ -170,6 +193,7 @@ data class CredentialIssuerMetadata(
     @SerialName("nonce_endpoint") val nonceEndpoint: String?,
     @SerialName("deferred_credential_endpoint") val deferredCredentialEndpoint: String?,
     @SerialName("notification_endpoint") val notificationEndpoint: String?,
+    @SerialName("credential_request_encryption") val credentialRequestEncryption: CredentialRequestEncryption?,
     @SerialName("credential_response_encryption") val credentialResponseEncryption: CredentialResponseEncryption?,
     @SerialName("batch_credential_issuance") val batchCredentialIssuance: BatchCredentialIssuance?,
     @SerialName("signed_metadata") val signedMetadata: String?,