Error in decodeMdocIssuerSigned() while decoding data encoded by @auth0/mdl

[DibbsZA]

It seems there is some incompatibility between the Sphereon cbor encode/decoder and other libraries out there.

The scenario:
I am generating a sample mdoc credential using @auth0/mdl library.
It can be successfully decoded with the same library (eg Auth0 mdl debugger https://www.mdl.me/ ) or on another site https://cbor.zone/ by Authlete, Inc.

But that credential is not decodable using the Sphereon decodeMdocIssuerSigned() method from @sphereon/ssi-types@0.32.

Going the other direction, the credential data created by Sphereon functions IS readable by Auth0 and cbor.zone.

It results in this error:

MDOC generating fails: Key (label: issuerAuth, type: CDDL(format='tstr', majorType=UNICODE_STRING, info=null, aliasFor=[])) not found in cbor map
Stack trace:
	IllegalArgumentException: Key (label: issuerAuth, type: CDDL(format='tstr', majorType=UNICODE_STRING, info=null, aliasFor=[])) not found in cbor map
	at StringLabel.protoOf.required (C:\One37\Source2\one37id-bcjs-project\node_modules\sphereon-kmp-mdoc-core\sphereon-kmp-cbor\src\commonMain\kotlin\com\sphereon\cbor\CoseLabel.kt:32:19)
	at Static_12.protoOf.fromCborItem (C:\One37\Source2\one37id-bcjs-project\node_modules\sphereon-kmp-mdoc-core\build\src\commonMain\kotlin\com\sphereon\mdoc\data\device\IssuerSigned.kt:369:42)
	at Static_12.protoOf.cborDecode (C:\One37\Source2\one37id-bcjs-project\node_modules\sphereon-kmp-mdoc-core\build\src\commonMain\kotlin\com\sphereon\mdoc\data\device\IssuerSigned.kt:374:64)
	at decodeMdocIssuerSigned (C:\One37\Source2\one37id-bcjs-project\node_modules\.pnpm\@sphereon+ssi-types@0.32.0\node_modules\@sphereon\ssi-types\src\types\mso_mdoc.ts:125:66)

Here is an example in two formats.
base64Url

uQADZ3ZlcnNpb25jMS4waWRvY3VtZW50c4GiZ2RvY1R5cGV1b3JnLmlzby4xODAxMy41LjEubURMbGlzc3VlclNpZ25lZLkAAmpuYW1lU3BhY2VzoXFteS50ZXN0Lm5hbWVzcGFjZYHYGFhZpGhkaWdlc3RJRABxZWxlbWVudElkZW50aWZpZXJjYWdlbGVsZW1lbnRWYWx1ZRgdZnJhbmRvbVggXymscBYSLPeJg-tSu1Z2yhvaOsAUS_yrzqs8-cHKOzNqaXNzdWVyQXV0aIRDoQEmogRYK1IzR1UyY3RsRFpCWkJVczcwNXNDa0pnZG5PODRPREpNN1FhVEZBTTJZYjAYIYFZAYswggGHMIIBLaADAgECAgEBMAoGCCqGSM49BAMCME0xSzAJBgNVBAYTAlVTMA8GA1UEChMITG9jYWwgUEMwLQYDVQQDEyZhaXJlZGFsZS1wcmVjaW91cy1lYWdsZS5uZ3Jvay1mcmVlLmFwcDAeFw0yNDEyMzEwMDAwMDBaFw0yNjEyMzEwMDAwMDBaME0xSzAJBgNVBAYTAlVTMA8GA1UEChMITG9jYWwgUEMwLQYDVQQDEyZhaXJlZGFsZS1wcmVjaW91cy1lYWdsZS5uZ3Jvay1mcmVlLmFwcDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABM-Pxlpg0xFWnfW12xc3NZOtV_ecHjLwxbSafovmsBDyzYT9_sEsp5xHbMVor02Y7o5liPie0th6G66Uh_NQPq0wCgYIKoZIzj0EAwIDSAAwRQIgAPvMLPlE2BnlL9ZLSAiRFYGlXJ8-SMMGeJO0iCi9iOgCIQCH2MFnO0G5Lkim2oGacldJpsxMnHiIq9Y8bozoMrJULFkBdNgYWQFvuQAGZ3ZlcnNpb25jMS4wb2RpZ2VzdEFsZ29yaXRobWdTSEEtMjU2bHZhbHVlRGlnZXN0c6FxbXkudGVzdC5uYW1lc3BhY2WhAFgg0KC4u-HbOUZyWAlOHBi-ZLjAp0Rw7YlT04N55w5T2WBtZGV2aWNlS2V5SW5mb7kAAWlkZXZpY2VLZXmlAyYBAiABIVggOGtYG_hv5omU2o2uWyoLHJelCkfyW1C5d9qOu5IXKu8iWCAdWEgStdtd610qO3jQiY_iLkSfZiDaaRHWY4wtvvSjI2dkb2NUeXBldW9yZy5pc28uMTgwMTMuNS4xLm1ETGx2YWxpZGl0eUluZm-5AARmc2lnbmVkwHQyMDI1LTAyLTA3VDExOjE3OjIwWml2YWxpZEZyb23AdDIwMjUtMDItMDdUMTE6MTc6MjBaanZhbGlkVW50aWzAdDIwMjYtMDItMDdUMTE6MTc6MjBabmV4cGVjdGVkVXBkYXRl91hAnt9d_GnswtDy2J1mkvndYQFr4n0EcBGavGmWYHATbajG9IOiMyc9fvDjAVGO79eu3hyQ27LSRiyGa2P2JhLU42ZzdGF0dXMA

Hex

b900036776657273696f6e63312e3069646f63756d656e747381a267646f6354797065756f72672e69736f2e31383031332e352e312e6d444c6c6973737565725369676e6564b900026a6e616d65537061636573a1716d792e746573742e6e616d65737061636581d8185859a46864696765737449440071656c656d656e744964656e746966696572636167656c656c656d656e7456616c7565181d6672616e646f6d58205f29ac7016122cf78983eb52bb5676ca1bda3ac0144bfcabceab3cf9c1ca3b336a697373756572417574688443a10126a204582b523347553263746c445a425a42557337303573436b4a67646e4f38344f444a4d3751615446414d3259623018218159018b308201873082012da003020102020101300a06082a8648ce3d040302304d314b3009060355040613025553300f060355040a13084c6f63616c205043302d060355040313266169726564616c652d70726563696f75732d6561676c652e6e67726f6b2d667265652e617070301e170d3234313233313030303030305a170d3236313233313030303030305a304d314b3009060355040613025553300f060355040a13084c6f63616c205043302d060355040313266169726564616c652d70726563696f75732d6561676c652e6e67726f6b2d667265652e6170703059301306072a8648ce3d020106082a8648ce3d03010703420004cf8fc65a60d311569df5b5db17373593ad57f79c1e32f0c5b49a7e8be6b010f2cd84fdfec12ca79c476cc568af4d98ee8e6588f89ed2d87a1bae9487f3503ead300a06082a8648ce3d0403020348003045022000fbcc2cf944d819e52fd64b4808911581a55c9f3e48c3067893b48828bd88e802210087d8c1673b41b92e48a6da819a725749a6cc4c9c7888abd63c6e8ce832b2542c590174d81859016fb900066776657273696f6e63312e306f646967657374416c676f726974686d675348412d3235366c76616c756544696765737473a1716d792e746573742e6e616d657370616365a1005820d0a0b8bbe1db39467258094e1c18be64b8c0a74470ed8953d38379e70e53d9606d6465766963654b6579496e666fb90001696465766963654b6579a5032601022001215820386b581bf86fe68994da8dae5b2a0b1c97a50a47f25b50b977da8ebb92172aef2258201d584812b5db5deb5d2a3b78d0898fe22e449f6620da6911d6638c2dbef4a32367646f6354797065756f72672e69736f2e31383031332e352e312e6d444c6c76616c6964697479496e666fb90004667369676e6564c074323032352d30322d30375431313a31373a32305a6976616c696446726f6dc074323032352d30322d30375431313a31373a32305a6a76616c6964556e74696cc074323032362d30322d30375431313a31373a32305a6e6578706563746564557064617465f758409edf5dfc69ecc2d0f2d89d6692f9dd61016be27d0470119abc69966070136da8c6f483a233273d7ef0e301518eefd7aede1c90dbb2d2462c866b63f62612d4e36673746174757300

[DibbsZA]

[nklomp]

Thanks the error suggest something else. It cannot find the issuerAuth structure by the looks of it. Looks like the wrong data is being passed in, as in your screenshot the surrounding data is not there.

The screenshot highlights are likely just differences in key types being used, although we will look into that as well of course

[DibbsZA]

Thank Niels,

We did some more experiments, and it seems like there is a difference in the input data expectation between yours and the Auth0 libraries.
Auth0 wants the hex for the entire mDl (as per right image) but your library only wants the inner content of the issuerSigned key (thereby making issuerAuth a top level property to find)
Once we realised this, we were able to pass that error (and ran into another (see below).

Can I ask why are taking this approach to only working with a portion and not the whole data blob?

As I mentioned above, we did have one final hurdle

(sphereon:kmp:mdoc) Validity info needs to have tagged dates, but a string was encountered. Issuer is not issuing valid mdocs!
IllegalArgumentException: tdate object expected. Got CDDL(format='undefined', majorType=SPECIAL, info=23, aliasFor=[])
    at Static_20.protoOf.fromCborItem (C:\One37\Source2\one37id-bcjs-project\node_modules\sphereon-kmp-mdoc-core\build\src\commonMain\kotlin\com\sphereon\mdoc\data\mso\ValidityInfoCbor.kt:120:39)

It seems that although the ISO spec says that the excpectedUpdate property of mDl validity info is optional, the function decodeMdocIssuerSigned(data) is expecting it and that it must be a date type.