Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Wallet Attestation response code and method #287

Merged
merged 8 commits into from
Jun 27, 2024
Merged
Changes from 5 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 30 additions & 6 deletions docs/en/wallet-attestation.rst
Original file line number Diff line number Diff line change
Expand Up @@ -118,14 +118,31 @@ Wallet Instance Initialization and Registration

**Step 9**: The Wallet Instance sends the ``challenge`` with Key Attestation and Cryptographic Hardware Key Tag to the Wallet Provider Backend in order to register the Wallet Instance identified with the Cryptographic Hardware Key public key.

.. note::
The request to the Wallet Provider endpoint in order to register the Wallet Instance MUST use the HTTP POST method with the parameters in the message body encoded in ``application/json`` format and the following parameters MUST be provided:
grausof marked this conversation as resolved.
Show resolved Hide resolved

.. _table_http_request_claim:
.. list-table:: Wallet Instance registration http request parameters
:widths: 20 60 20
:header-rows: 1

The Key Attestation (``key_attestation``) MUST be encoded in base64.
* - **Claim**
- **Description**
- **Reference**
* - **challenge**
- MUST be set to the challenge obtained from the Wallet Provider throught the ``nonce`` endpoint.
- `OAuth 2.0 Nonce Endpoint`_
* - **key_attestation**
- It MUST be a ``base64url`` encoded Key Attestation obtained from the **Device Integrity Service**.
-
* - **hardware_key_tag**
- It MUST be set to the unique identifier of the **Cryptographic Hardware Keys** in ``base64url`` encoded
grausof marked this conversation as resolved.
Show resolved Hide resolved
-

Below is a non-normative example of the request.

.. code-block:: http

PUT /wallet-instance HTTP/1.1
POST /wallet-instance HTTP/1.1
Host: walletprovider.example.com
Content-Type: application/json

Expand All @@ -152,10 +169,12 @@ Wallet Instance Initialization and Registration
4. If these checks are passed, it MUST register the Wallet Instance, keeping the Cryptographic Hardware Key Tag and all useful information related to the device.
5. It SHOULD associate the Wallet Instance with a specific User uniquely identified within the Wallet Provider's systems. This will be useful for the lifecycle of the Wallet Instance and for a future revocation.

The response, in case of success, from the Wallet Provider must necessarily be a 204 No content.
grausof marked this conversation as resolved.
Show resolved Hide resolved
Below is a non-normative example of the response.

.. code-block:: http

HTTP/1.1 201 Created
Content-Type: application/json
HTTP/1.1 204 No content

If any errors occur during the Wallet Instance registration, the Wallet Provider MUST return an error response. The response MUST use the content type set to *application/json* and MUST include the following parameters:

Expand Down Expand Up @@ -352,10 +371,15 @@ Below an non-normative example of the Wallet Attestation without encoding and si
}

**Step 18**: The Wallet Instance receives the Wallet Attestation signed by the Wallet Provider and performs security and integrity verifications.
The response is returned by the Wallet Provider at the end of the issuance flow.
If the authentication is successful the http response code MUST be 200 OK.
grausof marked this conversation as resolved.
Show resolved Hide resolved


Below is a non-normative example of the response.

.. code-block:: http

HTTP/1.1 201 OK
HTTP/1.1 200 OK
Content-Type: application/jwt

eyJhbGciOiJFUzI1NiIsInR5cCI6IndhbGx... redacted
grausof marked this conversation as resolved.
Show resolved Hide resolved
Expand Down
Loading