Subject: [SCITT] DID Web & X509

From: Orie Steele <[email-masked]>
Date: Thu, 14 Apr 2022 11:03:01 -0500

Not sure if I shared this before, so apologies if this is the second time.

https://github.com/transmute-industries/openssl-did-web-tutorial

@Mike Prorock <[email-masked]> and I did some work trying to map
traditional X509 to DID Web... it was an experiment, mostly powered by
openssl.

Regards,

OS

-- 
*ORIE STEELE*
Chief Technical Officer
www.transmute.industries

<https://www.transmute.industries>

---

From: Maik Riechert <[email-masked]>
Date: Thu, 14 Apr 2022 17:29:12 +0000

I'm not sure I understand this. Resolution of did:web identifiers assumes a TLS trust store. Is this repo an extension of did:web? Is this trying to use the TLS cert of the domain to sign/verify claims? Is this a good idea?

From: SCITT <[email-masked]> On Behalf Of Orie Steele
Sent: Donnerstag, 14. April 2022 17:03
To: [email-masked]; Mike Prorock <[email-masked]>
Subject: [EXTERNAL] [SCITT] DID Web & X509

https://github.com/transmute-industries/openssl-did-web-tutorial<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftransmute-industries%2Fopenssl-did-web-tutorial&data=05%7C01%7CMaik.Riechert%40microsoft.com%7C5a302f5d9346482c224e08da1e30507a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637855491569453896%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000%7C%7C%7C&sdata=wuWNZ8YoCa3%2B69WzeqzE%2F5iRFe6XXaqPpoSF5ceZs%2Bg%3D&reserved=0>

@Mike Prorock<mailto:[email-masked]> and I did some work trying to map traditional X509 to DID Web... it was an experiment, mostly powered by openssl.

Regards,

OS

--
ORIE STEELE
Chief Technical Officer
www.transmute.industries<http://www.transmute.industries>

[https://drive.google.com/a/transmute.industries/uc?id=1hbftCJoB5KdeV_kzj4eeyS28V3zS9d9c&export=download]<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.transmute.industries%2F&data=05%7C01%7CMaik.Riechert%40microsoft.com%7C5a302f5d9346482c224e08da1e30507a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637855491569453896%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000%7C%7C%7C&sdata=XNXRHH496OS9TfoeaEuNZNiLp%2Bo3czQB%2Fw90Ko01XKo%3D&reserved=0>

---

From: Orie Steele <[email-masked]>
Date: Thu, 14 Apr 2022 13:08:03 -0500

The repo's goal is to show that the same key material used in TLS can be
used in a did document... and to show that TLS cert chains can be embedded
in JWKs exposed in the did document using x5c... then a verifier can check
not just does the signature match, but do I trust the CA chain to the
root.... in this case the CA chain is generated by open ssl at the
beginning and then the leaf certs are converted to a did document for the
did web method.

I don't know if exposing the CA chains via x5c is a good idea, we did this
experiment to gather feedback on that part... it is for sure redundant, as
you rightly pointed out.

OS

On Thu, Apr 14, 2022 at 12:29 PM Maik Riechert <[email-masked]>
wrote:

> I’m not sure I understand this. Resolution of did:web identifiers assumes
> a TLS trust store. Is this repo an extension of did:web? Is this trying to
> use the TLS cert of the domain to sign/verify claims? Is this a good idea?
>
>
>
> *From:* SCITT <[email-masked]> *On Behalf Of * Orie Steele
> *Sent:* Donnerstag, 14. April 2022 17:03
> *To:* [email-masked]; Mike Prorock <[email-masked]>
> *Subject:* [EXTERNAL] [SCITT] DID Web & X509
>
>
>
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftransmute-industries%2Fopenssl-did-web-tutorial&data=05%7C01%7CMaik.Riechert%40microsoft.com%7C5a302f5d9346482c224e08da1e30507a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637855491569453896%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000%7C%7C%7C&sdata=wuWNZ8YoCa3%2B69WzeqzE%2F5iRFe6XXaqPpoSF5ceZs%2Bg%3D&reserved=0>
>
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.transmute.industries%2F&data=05%7C01%7CMaik.Riechert%40microsoft.com%7C5a302f5d9346482c224e08da1e30507a%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637855491569453896%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000%7C%7C%7C&sdata=XNXRHH496OS9TfoeaEuNZNiLp%2Bo3czQB%2Fw90Ko01XKo%3D&reserved=0>
>

-- 
*ORIE STEELE*
Chief Technical Officer
www.transmute.industries

---

From: Maik Riechert <[email-masked]>
Date: Thu, 14 Apr 2022 18:32:17 +0000

Just to clarify, the private key of the TLS leaf cert and the claim signing key are still two completely separate private keys, right? If they are the same, isn't it considered bad practice to (ab-)use a cert meant for TLS sessions for different purposes?

From: Orie Steele <[email-masked]>
Sent: Donnerstag, 14. April 2022 19:08
To: Maik Riechert <[email-masked]>
Cc: [email-masked]; Mike Prorock <[email-masked]>
Subject: Re: [EXTERNAL] [SCITT] DID Web & X509

The repo's goal is to show that the same key material used in TLS can be used in a did document... and to show that TLS cert chains can be embedded in JWKs exposed in the did document using x5c... then a verifier can check not just does the signature match, but do I trust the CA chain to the root.... in this case the CA chain is generated by open ssl at the beginning and then the leaf certs are converted to a did document for the did web method.

I don't know if exposing the CA chains via x5c is a good idea, we did this experiment to gather feedback on that part... it is for sure redundant, as you rightly pointed out.

OS

On Thu, Apr 14, 2022 at 12:29 PM Maik Riechert <[email-masked]<mailto:[email-masked]>> wrote:
I'm not sure I understand this. Resolution of did:web identifiers assumes a TLS trust store. Is this repo an extension of did:web? Is this trying to use the TLS cert of the domain to sign/verify claims? Is this a good idea?

From: SCITT <[email-masked]<mailto:[email-masked]>> On Behalf Of Orie Steele
Sent: Donnerstag, 14. April 2022 17:03
To: [email-masked]<mailto:[email-masked]>; Mike Prorock <[email-masked]<mailto:[email-masked]>>
Subject: [EXTERNAL] [SCITT] DID Web & X509

https://github.com/transmute-industries/openssl-did-web-tutorial<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftransmute-industries%2Fopenssl-did-web-tutorial&data=05%7C01%7CMaik.Riechert%40microsoft.com%7Ca1d908cbb8d14f0bfb9008da1e41bf42%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637855565002874877%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=4Ws4yliDXlw5lAdaX8bciAuR3Zq6AQRrgONKNIaNE1c%3D&reserved=0>

Regards,

OS

--
ORIE STEELE
Chief Technical Officer
www.transmute.industries<https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.transmute.industries%2F&data=05%7C01%7CMaik.Riechert%40microsoft.com%7Ca1d908cbb8d14f0bfb9008da1e41bf42%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637855565002874877%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=5SbWL1MB2Wvdc1iiGSpRWuD0H%2BsHu4CvtWCIkUOWsi0%3D&reserved=0>

[https://drive.google.com/a/transmute.industries/uc?id=1hbftCJoB5KdeV_kzj4eeyS28V3zS9d9c&export=download]<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.transmute.industries%2F&data=05%7C01%7CMaik.Riechert%40microsoft.com%7Ca1d908cbb8d14f0bfb9008da1e41bf42%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637855565002874877%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=47C6tS19xVhEbnpWh0MFpHxhsaHJ7T4o5MUrfBGPUIs%3D&reserved=0>

[https://drive.google.com/a/transmute.industries/uc?id=1hbftCJoB5KdeV_kzj4eeyS28V3zS9d9c&export=download]<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.transmute.industries%2F&data=05%7C01%7CMaik.Riechert%40microsoft.com%7Ca1d908cbb8d14f0bfb9008da1e41bf42%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637855565002874877%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=47C6tS19xVhEbnpWh0MFpHxhsaHJ7T4o5MUrfBGPUIs%3D&reserved=0>

---

From: Orie Steele <[email-masked]>
Date: Thu, 14 Apr 2022 14:24:40 -0500

You are correct. The goal was to show that it was possible, not to
suggest it's a good idea.

Per NIST 800-53 and 57 you basically don't want to reuse a key for multiple
purposes.

The point is that you can use the same tooling to generate keys for TLS CA
Chains (for DID Web) and VC CA Chains and rely on both with DID Web issued
Verifiable Credentials.

You could have CA Chain 1 for the DID and CA Chain 2 for the VCs, both
generated from OpenSSL.

OS

On Thu, Apr 14, 2022 at 1:32 PM Maik Riechert <[email-masked]>
wrote:

> Just to clarify, the private key of the TLS leaf cert and the claim
> signing key are still two completely separate private keys, right? If they
> are the same, isn’t it considered bad practice to (ab-)use a cert meant for
> TLS sessions for different purposes?
>
>
>
> *From:* Orie Steele <[email-masked]>
> *Sent:* Donnerstag, 14. April 2022 19:08
> *To:* Maik Riechert <[email-masked]>
> *Cc:* [email-masked]; Mike Prorock <[email-masked]>
> *Subject:* Re: [EXTERNAL] [SCITT] DID Web & X509
>
>
>
> On Thu, Apr 14, 2022 at 12:29 PM Maik Riechert <
> [email-masked]> wrote:
>
> *From:* SCITT <[email-masked]> *On Behalf Of *Orie Steele
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftransmute-industries%2Fopenssl-did-web-tutorial&data=05%7C01%7CMaik.Riechert%40microsoft.com%7Ca1d908cbb8d14f0bfb9008da1e41bf42%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637855565002874877%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=4Ws4yliDXlw5lAdaX8bciAuR3Zq6AQRrgONKNIaNE1c%3D&reserved=0>
>
> <https://nam06.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.transmute.industries%2F&data=05%7C01%7CMaik.Riechert%40microsoft.com%7Ca1d908cbb8d14f0bfb9008da1e41bf42%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637855565002874877%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=5SbWL1MB2Wvdc1iiGSpRWuD0H%2BsHu4CvtWCIkUOWsi0%3D&reserved=0>
>
>
>
>
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.transmute.industries%2F&data=05%7C01%7CMaik.Riechert%40microsoft.com%7Ca1d908cbb8d14f0bfb9008da1e41bf42%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637855565002874877%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=47C6tS19xVhEbnpWh0MFpHxhsaHJ7T4o5MUrfBGPUIs%3D&reserved=0>
>
>
>
>
> --
>
> *ORIE STEELE*
>
> Chief Technical Officer
>
> www.transmute.industries
>
>
>
>
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.transmute.industries%2F&data=05%7C01%7CMaik.Riechert%40microsoft.com%7Ca1d908cbb8d14f0bfb9008da1e41bf42%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637855565002874877%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=47C6tS19xVhEbnpWh0MFpHxhsaHJ7T4o5MUrfBGPUIs%3D&reserved=0>
>

-- 
*ORIE STEELE*
Chief Technical Officer
www.transmute.industries