verifyEnvelopeSignature method

Future<void> verifyEnvelopeSignature(Map envelope, { required String signerAtSign, })

Verify an envelope created by wrapAndSign or wrapAndSignAndJsonEncode.

The signature is verified against the APKAM public signing key which the signer's enrollment (the enrollmentId field of the envelope) has published at public:_apsk.<enrollmentId>.a.__e<signerAtSign>. Only the owning enrollment may write to that location, so a valid signature proves the envelope was created by a client of that (approved) enrollment.

Throws an Exception on failed validation.

Implementation

Future<void> verifyEnvelopeSignature(
  Map envelope, {
  required String signerAtSign,
}) async {
  final String signature = envelope['signature'];
  final String signerEnrollmentId = envelope['enrollmentId'];
  final hashingAlgo = HashingAlgoType.values.byName(envelope['hashingAlgo']);
  final signingAlgo = SigningAlgoType.values.byName(envelope['signingAlgo']);
  final String signableText = _signableText(envelope['payload']);

  final pk = await getApkamPublicKey(signerAtSign, signerEnrollmentId);
  AtSigningVerificationInput input =
      AtSigningVerificationInput(signableText, base64Decode(signature), pk)
        ..signingMode = AtSigningMode.pkam
        ..signingAlgoType = signingAlgo
        ..hashingAlgoType = hashingAlgo;

  AtSigningResult svr = atClient.atChops!.verify(input);
  if (svr.result != true) {
    throw AtSigningVerificationException(
        'Signature verification failed using public key for '
        '$signerAtSign enrollment $signerEnrollmentId : $pk');
  }
}