Skip to content

README.md

Latest commit

 

History

History
149 lines (118 loc) · 3.63 KB

README.md

File metadata and controls

149 lines (118 loc) · 3.63 KB
Raw

Icon did:cel Create Service

Provisions a did:cel identifier by binding existing Google Cloud KMS keys as new verification relationships. Constructs a did:cel identifier and initializes the corresponding did:cel event log.

Service

Request

  • assertionMethod (required)
    Identifier of the Google Cloud KMS signing key used as the did:cel assertion method.

    The key must use one of the following supported algorithms:

Cryptosuite KMS Key Algorithm Public Key Size
ecdsa-jcs-2019 EC_SIGN_P256_SHA256 256 bits
ecdsa-jcs-2019 EC_SIGN_P384_SHA384 384 bits
eddsa-jcs-2022 EC_SIGN_ED25519 256 bits

⚛️ Post-Quantum:

Cryptosuite KMS Key Algorithm Public Key Size
mldsa44-jcs-2024 PQ_SIGN_ML_DSA_44 1312 bytes
slhdsa128-jcs-2024 PQ_SIGN_SLH_DSA_SHA2_128S 32 bytes

  • service (required)
    Defines service endpoints associated with the identifier.

  • heartbeatFrequency (optional)
    ISO-8601 duration specifying how often heartbeat events should be generated.
    Default: P3M.

The minimum request example:

{
  "assertionMethod": [{
    "type": "KmsKey",  
    "resource": "kms:KMS_KEY_ID/cryptoKeyVersions/KMS_KEY_VERSION"    
  }],	
  "service": [{
    "type": "CelStorageService",
    "serviceEndpoint": [
      "https://storage.googleapis.com/did-cel-log/",
      "..."
	]
  }]
}

A request example using the referenced verificationMethod and provisioning additional keys:

{
  "heartbeatFrequency": "P3M",
  "verificationMethod": [{
    "id": "#key-1",
    "type": "KmsKey",
    "resource": "kms:KMS_KEY_ID/cryptoKeyVersions/KMS_KEY_VERSION",
   }],  
  "assertionMethod": [
    "#key-1"
  ],
  "authentication": [
    "#key-1",
    {

    }
  ],
  "recovery": [{
    "type": "KmsKey",
    "resource": "kms:KMS_KEY_2_ID/cryptoKeyVersions/KMS_KEY_2_VERSION"
  }],
  "service": [{
    "type": "CelStorageService",
    "serviceEndpoint": [
      "https://storage.googleapis.com/did-cel-log/",
      "..."
	]
  }]
}

Response

HTTP/2 200 OK
content-type: application/json

{
  "log": [{
    Initial Event Log
  }]
}

🛫 Deploy

Configuration

The service is configured via the following environment variables:

Variable Required Description
KMS_LOCATION Yes Google Cloud region where the KMS key is located (e.g., us-central1)
KMS_KEY_RING Yes Name of the Cloud KMS KeyRing
PQ No ⚛️ Enables Post-Quantum algorithms (default false)

IAM Permissions

Create a new service account:

gcloud iam service-accounts create SA-NAME \
    --display-name="did:cel creator"

Grant these roles to the service account:

  • roles/cloudkms.publicKeyViewer (To view a public key)
  • roles/cloudkms.signer (To sign)
gcloud kms keyrings add-iam-policy-binding $KMS_KEY_RING \
  --location=$KMS_LOCATION \
  --member="serviceAccount:SA-NAME@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/cloudkms.publicKeyViewer"
gcloud kms keyrings add-iam-policy-binding $KMS_KEY_RING \
  --location=$KMS_LOCATION \
  --member="serviceAccount:SA-NAME@PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/cloudkms.signer"

Deployment

 gcloud functions deploy FUNCTION-NAME \
  --gen2 \
  --runtime=java25 \
  --source=. \
  --entry-point=CreateService \
  --trigger-http \
  --service-account=SA-NAME@PROJECT_ID.iam.gserviceaccount.com
  --set-env-vars="KMS_LOCATION=$KMS_LOCATION,KMS_KEY_RING=$KMS_KEY_RING"