Skip to content

fix(mdoc): make mdoc presentations verify as linked #107

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
moven0831 wants to merge 4 commits into
base: main
Choose a base branch
from
Open

fix(mdoc): make mdoc presentations verify as linked #107

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b1a5649
fix(mdoc): correct the shared-witness offsets
moven0831 Aug 29, 2026
b3c0ae9
fix(mdoc): bind predicate claim names when generating show inputs
moven0831 Aug 29, 2026
071a3f1
fix(mdoc): hash claim identity over the name, not the CBOR
moven0831 Aug 29, 2026
45a845f
test(circom): compare mdoc and Show claim identities
moven0831 Aug 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 22 additions & 3 deletions wallet-unit-poc/circom/circuits/mdoc.circom
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,14 @@ template MDOC(

// CHECK 3: per-claim preimage authenticity + value extraction
signal preimageHashesPoseidon[maxClaims];
signal idHash[maxClaims];

// Same width show.circom and jwt.circom hash at. Any other width gives a
// different element for the same attribute and comm_W_shared never matches.
var NAME_ID_LEN = 31;
assert(maxIdentifierLen >= NAME_ID_LEN + 1);
signal nameLengths[maxClaims];
signal boundedName[maxClaims][NAME_ID_LEN];
component idNameHashers[maxClaims];

for (var i = 0; i < maxClaims; i++) {
// claimFlags[i] must be 0 or 1; fractional values bypass gated assertions.
Expand All @@ -90,8 +97,20 @@ template MDOC(
preimageHashesPoseidon[i] <== HashBytesToFieldWithLen(maxPreimageLen)(preimages[i], preimageLengths[i]);

// MdocClaimVerifier already proved this identifier is in the signed preimage.
idHash[i] <== HashBytesToFieldWithLen(maxIdentifierLen)(identifierCbor[i], identifierLengths[i]);
claimIdentifierHashes[i] <== idHash[i] * claimFlags[i];
// identifierLengths counts the CBOR header; inactive slots stay at 0.
nameLengths[i] <== claimFlags[i] * (identifierLengths[i] - 1);

// Single-byte text-string header only, so the name is identifierCbor[1..].
// Excludes names of 24 bytes or more, which CBOR frames with two bytes.
claimFlags[i] * (identifierCbor[i][0] - 96 - nameLengths[i]) === 0;

for (var j = 0; j < NAME_ID_LEN; j++) {
boundedName[i][j] <== identifierCbor[i][j + 1];
}
idNameHashers[i] = HashBytesToFieldWithLen(NAME_ID_LEN);
idNameHashers[i].in <== boundedName[i];
idNameHashers[i].len <== nameLengths[i];
claimIdentifierHashes[i] <== idNameHashers[i].hash * claimFlags[i];

MdocClaimVerifier(maxCredLen, maxPreimageLen, maxIdentifierLen)(
message,
Expand Down
Loading
Loading