[PNV Demo Part 2] Process a phone number request

QZHelen · QZHelen · commit fb916b1173ef · 2025-05-13T06:54:51.000Z
diff --git a/app/src/main/java/com/credman/cmwallet/getcred/GetCredentialActivity.kt b/app/src/main/java/com/credman/cmwallet/getcred/GetCredentialActivity.kt
@@ -39,6 +39,7 @@ import com.credman.cmwallet.openid4vp.OpenId4VP
 import com.credman.cmwallet.openid4vp.OpenId4VPMatchedCredential
 import com.credman.cmwallet.openid4vp.OpenId4VPMatchedMDocClaims
 import com.credman.cmwallet.openid4vp.OpenId4VPMatchedSdJwtClaims
+import com.credman.cmwallet.pnv.maybeHandlePnv
 import com.credman.cmwallet.sdjwt.SdJwt
 import com.credman.cmwallet.toBase64UrlNoPadding
 import com.google.android.gms.identitycredentials.Credential
@@ -238,6 +239,27 @@ class GetCredentialActivity : FragmentActivity() {
                     val selectedId = selectedEntryId.getString("id")
                     val dqclCredId = selectedEntryId.getString("dcql_cred_id")
 
+                    val pnvResponse = maybeHandlePnv(
+                        it.requestJson,
+                        providerIdx,
+                        selectedId,
+                        dqclCredId,
+                        webOriginOrAppOrigin(
+                            origin,
+                            request.callingAppInfo.signingInfoCompat.signingCertificateHistory[0].toByteArray()
+                        ),
+                        request.callingAppInfo
+                    )
+                    if (pnvResponse != null) {
+                        PendingIntentHandler.setGetCredentialResponse(
+                            resultData,
+                            GetCredentialResponse(DigitalCredential(pnvResponse.responseJsonModern))
+                        )
+                        setResult(RESULT_OK, resultData)
+                        finish()
+                        return
+                    }
+
                     val response = processDigitalCredentialOption(
                         it.requestJson,
                         providerIdx,
@@ -435,8 +457,6 @@ class GetCredentialActivity : FragmentActivity() {
                     openId4VPRequest.performQueryOnCredential(selectedCredential, dcqlCredId)
                 Log.i("GetCredentialActivity", "matchedCredential $matchedCredential")
 
-
-
                 return createOpenID4VPResponse(
                     openId4VPRequest,
                     origin,
diff --git a/app/src/main/java/com/credman/cmwallet/openid4vp/DCQL.kt b/app/src/main/java/com/credman/cmwallet/openid4vp/DCQL.kt
@@ -19,6 +19,18 @@ data class MatchedCredential(
     val matchedClaims: MutableList<MatchedClaim> = mutableListOf()
 )
 
+fun getDqclCredentialById(query: JSONObject, id: String): JSONObject? {
+    require(query.has("credentials")) { "dcql_query must contain a credentials" }
+    val credentials = query.getJSONArray("credentials")
+    for (i in 0..<credentials.length()) {
+        val dcqlCred = credentials.getJSONObject(i)
+        if (dcqlCred.optString("id") == id) {
+            return dcqlCred
+        }
+    }
+    return null
+}
+
 fun performQueryOnCredential(
     query: JSONObject,
     selectedCredential: CredentialItem,
diff --git a/app/src/main/java/com/credman/cmwallet/openid4vp/OpenId4VP.kt b/app/src/main/java/com/credman/cmwallet/openid4vp/OpenId4VP.kt
@@ -151,6 +151,9 @@ class OpenId4VP(
         return DCQLQuery(dcqlQuery, credentialStore)
     }
 
+    fun getDcqlCredentialObject(dcqlId: String): JSONObject? = getDqclCredentialById(dcqlQuery, dcqlId)
+
+
     fun performQueryOnCredential(selectedCredential: CredentialItem, dcqlCredId: String? = null): OpenId4VPMatchedCredential {
         return performQueryOnCredential(dcqlQuery, selectedCredential, dcqlCredId)
     }
diff --git a/app/src/main/java/com/credman/cmwallet/pnv/PnvTokenRegistry.kt b/app/src/main/java/com/credman/cmwallet/pnv/PnvTokenRegistry.kt
@@ -1,10 +1,36 @@
 package com.credman.cmwallet.pnv
 
+import android.util.Base64
+import android.util.Log
+import androidx.credentials.provider.CallingAppInfo
+import com.credman.cmwallet.CmWalletApplication.Companion.TAG
+import com.credman.cmwallet.CmWalletApplication.Companion.computeClientId
+import com.credman.cmwallet.createJWTES256
+import com.credman.cmwallet.getcred.GetCredentialActivity.DigitalCredentialRequestOptions
+import com.credman.cmwallet.getcred.GetCredentialActivity.DigitalCredentialResult
+import com.credman.cmwallet.jweSerialization
+import com.credman.cmwallet.jwsDeserialization
+import com.credman.cmwallet.loadECPrivateKey
+import com.credman.cmwallet.openid4vp.OpenId4VP
+import com.credman.cmwallet.openid4vp.OpenId4VP.Companion.IDENTIFIERS_1_0
+import com.credman.cmwallet.openid4vp.OpenId4VPMatchedCredential
+import com.credman.cmwallet.openid4vp.OpenId4VPMatchedMDocClaims
+import com.credman.cmwallet.openid4vp.OpenId4VPMatchedSdJwtClaims
+import com.credman.cmwallet.pnv.PnvTokenRegistry.Companion.TEST_PNV_1_GET_PHONE_NUMBER
+import com.credman.cmwallet.pnv.PnvTokenRegistry.Companion.TEST_PNV_1_VERIFY_PHONE_NUMBER
+import com.credman.cmwallet.pnv.PnvTokenRegistry.Companion.TEST_PNV_2_GET_PHONE_NUMBER
+import com.credman.cmwallet.pnv.PnvTokenRegistry.Companion.VCT_GET_PHONE_NUMBER
+import com.credman.cmwallet.pnv.PnvTokenRegistry.Companion.VCT_VERIFY_PHONE_NUMBER
+import com.credman.cmwallet.toJWK
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.put
 import org.json.JSONArray
 import org.json.JSONObject
 import java.io.ByteArrayOutputStream
 import java.nio.ByteBuffer
 import java.nio.ByteOrder
+import java.security.interfaces.ECPrivateKey
+import java.time.Instant
 
 /**
  * A phone number verification entry to be registered with the Credential Manager.
@@ -23,9 +49,10 @@ data class PnvTokenRegistry(
     val vct: String,
     val title: String,
     val providerConsent: String?,
-    val subscriptionHint: Int?,
-    val carrierHint: String?,
-    val phoneNumberHint: String?
+    val subscriptionHint: Int,
+    val carrierHint: String,
+    val phoneNumberHint: String?,
+    val iss: String,
 ) {
     /** Converts this TS43 entry to the more generic SD-JWT registry item(s). */
     private fun toSdJwtRegistryItems(): SdJwtRegistryItem {
@@ -63,7 +90,8 @@ data class PnvTokenRegistry(
             providerConsent = "CMWallet will enable your carrier {carrier name} to share your phone number iwth {app/domain name}",
             subscriptionHint = 1,
             carrierHint = "310250",
-            phoneNumberHint = "+16502154321"
+            phoneNumberHint = "+16502154321",
+            iss = "https://example-carrier2.com",
         )
         val TEST_PNV_1_VERIFY_PHONE_NUMBER = TEST_PNV_1_GET_PHONE_NUMBER.copy(
             vct = VCT_VERIFY_PHONE_NUMBER,
@@ -75,7 +103,8 @@ data class PnvTokenRegistry(
             providerConsent = "CMWallet will enable your carrier MOCK-CARRIER-2 to share your phone number",
             subscriptionHint = 2,
             carrierHint = "380250",
-            phoneNumberHint = "+16502157890"
+            phoneNumberHint = "+16502157890",
+            iss = "https://example-carrier2.com"
         )
 
         fun buildRegistryDatabase(items: List<PnvTokenRegistry>): ByteArray {
@@ -131,4 +160,127 @@ private class SdJwtRegistryItem(
     val vct: String,
     val claims: List<RegistryClaim>,
     val displayData: ItemDisplayData,
-)
+)
+
+fun maybeHandlePnv(
+    requestJson: String,
+    providerIdx: Int,
+    selectedID: String,
+    dcqlCredId: String,
+    origin: String, // Either the web origin or the calling app sha
+    callingAppInfo: CallingAppInfo
+): DigitalCredentialResult? {
+    if (selectedID != TEST_PNV_1_GET_PHONE_NUMBER.tokenId && selectedID != TEST_PNV_2_GET_PHONE_NUMBER.tokenId) {
+        return null
+    }
+    val digitalCredentialOptions = DigitalCredentialRequestOptions.createFrom(requestJson)
+    val requestProtocol = DigitalCredentialRequestOptions.getRequestProtocolAtIndex(
+        digitalCredentialOptions, providerIdx
+    )
+    val requestData: JSONObject = DigitalCredentialRequestOptions.getRequestDataAtIndex(
+        digitalCredentialOptions, providerIdx
+    )
+    Log.i(PNV_TAG, "processDigitalCredentialOption protocol $requestProtocol")
+    require(IDENTIFIERS_1_0.contains(requestProtocol)) {"Unsupported protocol identifier $requestProtocol"}
+    val openId4VPRequest = OpenId4VP(requestData, computeClientId(callingAppInfo), requestProtocol)
+    Log.i(PNV_TAG, "nonce ${openId4VPRequest.nonce}")
+
+    val dcqlObject = openId4VPRequest.getDcqlCredentialObject(dcqlCredId)!!
+    Log.i(PNV_TAG, "dqcl $dcqlObject")
+    val vct = dcqlObject.getJSONObject("meta").getJSONArray("vct_values").let {
+        for (i in 0..<it.length()) {
+            val currVct = it.getString(i)
+            if (currVct == VCT_GET_PHONE_NUMBER || currVct == VCT_VERIFY_PHONE_NUMBER) {
+                return@let currVct
+            }
+        }
+        throw IllegalStateException("Could not find a valid vct value for pnv")
+    }
+
+    val selectedCred = when (selectedID) {
+        TEST_PNV_1_GET_PHONE_NUMBER.tokenId -> if (vct == TEST_PNV_1_GET_PHONE_NUMBER.vct) TEST_PNV_1_GET_PHONE_NUMBER else TEST_PNV_1_VERIFY_PHONE_NUMBER
+        TEST_PNV_2_GET_PHONE_NUMBER.tokenId -> TEST_PNV_2_GET_PHONE_NUMBER
+        else -> return null
+    }
+
+    val credAuthJwt = dcqlObject.getJSONObject("meta").getString("credential_authorization_jwt")
+    val (credAuthJwtHeader, credAuthJwtpayload) = jwsDeserialization(credAuthJwt)
+
+    require(credAuthJwtHeader.has("x5c")) { "Missing aggregator cert" }
+    val aggregatorCertChain = credAuthJwtHeader.getJSONArray("x5c") // See the x5c cert chain defined at https://datatracker.ietf.org/doc/html/rfc7515#section-4.1.6
+    // TODO: validate the aggregator cert is allowed to request phone number verification for the given carrier
+
+    val consentData = credAuthJwtpayload.optString("consent_data")
+    // TODO: when the matcher renders the consent data, create the consent data digest to sign over
+    // and prove that it has been displayed.
+    val consentDataHash: String? = null
+
+    val aggregatorNonce = credAuthJwtpayload.getString("nonce")
+    require(aggregatorNonce == openId4VPRequest.nonce) { "Aggregator nonce should match the verifier nonce" }
+
+    val aggregatorJwks = credAuthJwtpayload.getJSONObject("jwks").getJSONArray("keys")
+    val aggregatorEncKey = aggregatorJwks.let {
+        for (i in 0..<it.length()) {
+            val jwk = it[i] as JSONObject
+            if (jwk.has("use")
+                && jwk["use"] == "enc"
+                && jwk["kty"] == "EC"
+                && jwk["crv"] == "P-256"
+            ) {
+                return@let jwk
+            }
+        }
+        throw IllegalArgumentException("Given aggregator did not provide a valid encryption key")
+    }
+
+    // Generate the phone number token SD-JWT
+    val tempTokenJson = buildJsonObject {
+        put("iss", selectedCred.iss)
+        put("vct", selectedCred.vct)
+        put("temp_token", getTempTokenForCredential(selectedCred))
+        put("subscription_hint", selectedCred.subscriptionHint)
+        put("carrier_hint", selectedCred.carrierHint)
+    }
+    val encryptedTempTokenJwe = jweSerialization(aggregatorEncKey, tempTokenJson.toString())
+
+    val tmpKey =
+        "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg6ef4-enmfQHRWUW40-Soj3aFB0rsEOp3tYMW-HJPBvChRANCAAT5N1NLZcub4bOgWfBwF8MHPGkfJ8Dm300cioatq9XovaLgG205FEXUOuNMEMQuLbrn8oiOC0nTnNIVn-OtSmSb"
+    val privateKey =
+        loadECPrivateKey(Base64.decode(tmpKey, Base64.URL_SAFE)) as ECPrivateKey
+    val tempTokenDcJwt = createJWTES256(
+        header = buildJsonObject {
+            put("alg", "ES256")
+        },
+        payload = buildJsonObject {
+            put("nonce", openId4VPRequest.nonce)
+            put("origin", origin)
+            put("encrypted_credential", encryptedTempTokenJwe)
+        },
+        privateKey = privateKey
+    )
+
+    // We don't use selective disclosure, so the sd-jwt is simply jwt + "~"
+    val tempTokenDcSdJwt = "${tempTokenDcJwt}~"
+
+    val vpToken = JSONObject().apply {
+        put(dcqlCredId, tempTokenDcSdJwt)
+    }
+    val response = openId4VPRequest.generateResponse(vpToken)
+    Log.d(PNV_TAG, "Returning $response")
+
+    return DigitalCredentialResult(
+        responseJsonLegacy = "",
+        authenticationTitle = "",
+        authenticationSubtitle = null,
+        responseJsonModern = JSONObject().apply {
+            put("protocol", openId4VPRequest.protocolIdentifier)
+            put("data", JSONObject(response))
+        }.toString()
+    )
+}
+
+fun getTempTokenForCredential(cred: PnvTokenRegistry): String {
+    return "TODO: generate temp token"
+}
+
+private const val PNV_TAG = "PnvHandler"

Original file line number	Diff line number	Diff line change
`@@ -151,6 +151,9 @@ class OpenId4VP(`
`151`	`151`	`return DCQLQuery(dcqlQuery, credentialStore)`
`152`	`152`	`}`
`153`	`153`
	`154`	`+ fun getDcqlCredentialObject(dcqlId: String): JSONObject? = getDqclCredentialById(dcqlQuery, dcqlId)`
	`155`	`+`
	`156`	`+`
`154`	`157`	`fun performQueryOnCredential(selectedCredential: CredentialItem, dcqlCredId: String? = null): OpenId4VPMatchedCredential {`
`155`	`158`	`return performQueryOnCredential(dcqlQuery, selectedCredential, dcqlCredId)`
`156`	`159`	`}`