Encrypted Attachments

Goals:

  • Eliminate processing and B64 33% inflation
  • Maintain message integity
  • Minimize observable artifacts

JWE attachment type

Note: I don't like the name trunk and it needs to be replaced. Suggestions Requested

This document uses jwe instead of encrypted, which I think I like. It's more opinionated about how encryption must be represented, but also less likely to be abused, possibly?

Examples are truncated for clarity.

Example DIDComm message with JWE Attachment


























{
    "type": "<sometype>",
    "to": ["did:example:mediator"],
    "body":{},
    "attachments": [
        {
            "id": "x",
            "hash": "<hash of jwe>",
            "data": {
                "jwe": {
                    "protected": "eyJ0...QmJaQl",
                    "recipients": [
                        {
                            "encrypted_key": "J1F...WLg"
                        }
                    ],
                    "iv": "u5kIzo0m_d2PjI4m",
                    "ciphertext": "ABCDEFG",
                    "extracted": "XYZ",
                    "tag": "doeAoagwJe9BwKayfcduiw"
                }
        	}
        }
    ]
}

Packing

  1. Confirm that hash is present for JWE attachments.
  2. Extract JWE Attachment ciphertext and extracted
  3. Construct Extracted string
  4. Replace extracted strings with marker information
  5. Encrypt message to JWE as normal
  6. Add extracted attribute to the JSON form of the JWE.

Extracted Extracted String and Marker Replacement

ABCDEFGXYZ

























{
    "type": "<sometype>",
    "to": ["did:example:mediator"],
    "body":{},
    "attachments": [
        {
            "id": "x",
            "data": {
                "jwe": {
                    "protected": "eyJ0...QmJaQl",
                    "recipients": [
                        {
                            "encrypted_key": "J1F...WLg"
                        }
                    ],
                    "iv": "u5kIzo0m_d2PjI4m",
                    "ciphertext_external": {'index':0,'length':7,'hash':'hash(ciphertext)'},
                    "extracted_external": {'index':7,'length':3,'hash':'hash(extracted)'},
                    "tag": "doeAoagwJe9BwKayfcduiw"
                }
            }
        }
    ]
}

https://tools.ietf.org/html/rfc7515#appendix-F

JWE Encrypted with Extracted Addition
















{
    "protected": "QmJaJ0...eyQl",
    "recipients": [
        {
            "encrypted_key": "X5T...uVw"
        }
    ],
    "iv": "o0m_d2PjI4mu5kIz",
    "ciphertext": "oag...wcdu",
    "extracted": "ABCDEFGXYZ",
    "tag": "e9BwKayfcduiwdoeAoagwJ"
}

Note: Because both the ciphertext and extracted are packed into the next extracted, the effect is recursive.

Unpacking

  1. Extract extracted attribute if present
  2. Decrypt JWE as normal
  3. Look for JWE attachments with marker information
  4. Use marker information to extract from extracted string
  5. Remove markers
  6. Verify Hash to confirm integrity

Extract Extracted Attribute if present

ABCDEFGXYZ

























{
    "type": "<sometype>",
    "to": ["did:example:mediator"],
    "body":{},
    "attachments": [
        {
            "id": "x",
            "data": {
                "jwe": {
                    "protected": "eyJ0...QmJaQl",
                    "recipients": [
                        {
                            "encrypted_key": "J1F...WLg"
                        }
                    ],
                    "iv": "u5kIzo0m_d2PjI4m",
                    "ciphertext_external": {'index':0,'length':7,'hash':'hash(ciphertext)'},
                    "extracted_external": {'index':7,'length':3,'hash':'hash(extracted)'},
                    "tag": "doeAoagwJe9BwKayfcduiw"
                }
            }
        }
    ]
}

Decrypted Message, with extracted markers replaced with content

























{
    "type": "<sometype>",
    "to": ["did:example:mediator"],
    "body":{},
    "attachments": [
        {
            "id": "x",
            "data": {
                "jwe": {
                    "protected": "eyJ0...QmJaQl",
                    "recipients": [
                        {
                            "encrypted_key": "J1F...WLg"
                        }
                    ],
                    "iv": "u5kIzo0m_d2PjI4m",
                    "ciphertext": "ABCDEFG",
                    "extracted": "XYZ",
                    "tag": "doeAoagwJe9BwKayfcduiw"
                }
        	}
        }
    ]
}

Questions

  • Extracted are available for inspection. Observers will be able to derive some information from comparing portions of the extracted.
Select a repo