aries-cloudagent-python icon indicating copy to clipboard operation
aries-cloudagent-python copied to clipboard

About legacy `/jsonld/sign` endpoint and re-using key material

Open PatStLouis opened this issue 1 year ago • 0 comments

The jsonld set of endpoints are marked as deprecated. Are we planning to remove them before the 1.0 release?

Before doing so there's one important feature we should preserve to the new set of vc-api issuance endpoint and it's the ability to provide a verkey as an option and sign with an arbitrary did uri as the issue. This use case is valuable when a controller wants to publish the verkey on multiple resolvable endpoints and sign with the same private key. As an issuer, I might want to have multiple did:web identifiers associated with the same keypair. Or alternately, I might want to publish the same verkey on an indy ledger and the web, and have the choice of using a did:web or a did:indy as issuer value, inheriting some of the trust associated to the indy ledger's governance with my web did (maybe even refering to it in my alsoKnownAs field in the did document). For this I would register my did in acapy and refer to it through the associated verkey when signing. This is the current behavior of the /jsonld/sign endpoint.

My suggestion would be to make an optional proofKey field in the LDProofVCOptionsSchema and if provided, the ldproofmanager will use this value to fetch the corresponding key in the wallet instead of the issuer did value.

@dbluhm @jamshale ?

PatStLouis avatar Apr 02 '24 23:04 PatStLouis