Domain Privacy

interface EncryptionKeys {
  keyAgreement: {
    id: string;
    type: "X25519KeyAgreementKey2020";
    privateKeyMultibase: string;
    publicKeyMultibase: string;
  };
  authentication: {
    id: string;
    type: "Ed25519VerificationKey2020";
    privateKeyMultibase: string;
    publicKeyMultibase: string;
  };
}

async function setupEncryptionKeys(
  controller: string
): Promise<EncryptionKeys> {
  // Generate key agreement key pair
  const keyAgreement = await X25519.generateKeyPair();
  
  // Generate authentication key pair
  const authentication = await Ed25519.generateKeyPair();
  
  return {
    keyAgreement: {
      id: `${controller}#key-1`,
      type: "X25519KeyAgreementKey2020",
      privateKeyMultibase: keyAgreement.privateKey,
      publicKeyMultibase: keyAgreement.publicKey
    },
    authentication: {
      id: `${controller}#key-2`,
      type: "Ed25519VerificationKey2020",
      privateKeyMultibase: authentication.privateKey,
      publicKeyMultibase: authentication.publicKey
    }
  };
}

interface EncryptedSettings {
  name: string;
  value: string;
  nonce: string;
  recipient: string;
  timestamp: string;
}

async function encryptDomainSettings(
  controllerKeys: EncryptionKeys,
  recipientDID: string,
  settings: any
): Promise<EncryptedSettings> {
  // Get recipient's key agreement key
  const recipientKey = await resolveKeyAgreementKey(recipientDID);
  
  // Perform ECDH
  const sharedSecret = await X25519.deriveSharedSecret(
    controllerKeys.keyAgreement.privateKeyMultibase,
    recipientKey.publicKeyMultibase
  );
  
  // Derive encryption key
  const encryptionKey = await HKDF(sharedSecret, {
    salt: randomBytes(32),
    info: "ixo-domain-settings-encryption"
  });
  
  // Encrypt settings
  const nonce = randomBytes(12);
  const ciphertext = await AES_GCM.encrypt(
    encryptionKey,
    JSON.stringify(settings),
    nonce,
    { recipient: recipientDID }
  );
  
  return {
    name: "domainSettings",
    value: base64Encode(ciphertext),
    nonce: base64Encode(nonce),
    recipient: recipientDID,
    timestamp: new Date().toISOString()
  };
}

interface EncryptedResource {
  id: string;
  type: string;
  encryptedData: EncryptedSettings[];
  proof: string;
}

async function storeEncryptedSettings(
  iidDoc: IIDDocument,
  settings: EncryptedSettings
): Promise<void> {
  // Create encrypted resource
  const resource: EncryptedResource = {
    id: `${iidDoc.id}#encrypted-settings`,
    type: "EncryptedDomainSettings",
    encryptedData: [settings],
    proof: await generateProof(settings)
  };

  // Store via polymorphic mediator
  await iidDoc.mediator.storeResource(
    resource.id,
    resource,
    {
      encryption: "required",
      access: "restricted"
    }
  );

  // Update hashgraph
  await iidDoc.resourceHashgraph.add({
    id: resource.id,
    type: resource.type,
    proof: resource.proof
  });
}

async function decryptDomainSettings(
  recipientKeys: EncryptionKeys,
  iidDoc: IIDDocument
): Promise<any> {
  // Get encrypted settings resource
  const resource = await iidDoc.mediator.getResource(
    `${iidDoc.id}#encrypted-settings`
  );
  
  // Verify recipient authorization
  if (resource.encryptedData[0].recipient !== recipientKeys.keyAgreement.id) {
    throw new Error("Unauthorized recipient");
  }
  
  // Get controller's key agreement key
  const controllerKey = await resolveKeyAgreementKey(iidDoc.id);
  
  // Perform ECDH
  const sharedSecret = await X25519.deriveSharedSecret(
    recipientKeys.keyAgreement.privateKeyMultibase,
    controllerKey.publicKeyMultibase
  );
  
  // Derive decryption key
  const decryptionKey = await HKDF(sharedSecret, {
    salt: resource.encryptedData[0].salt,
    info: "ixo-domain-settings-encryption"
  });
  
  // Decrypt settings
  const plaintext = await AES_GCM.decrypt(
    decryptionKey,
    base64Decode(resource.encryptedData[0].value),
    base64Decode(resource.encryptedData[0].nonce),
    { recipient: recipientKeys.keyAgreement.id }
  );
  
  return JSON.parse(plaintext);
}

{
  "@context": [
    "https://www.w3.org/ns/did/v1",
    "https://w3id.org/ixo/ns/interchain-identifiers/v1"
  ],
  "id": "did:ixo:domain123",
  "verificationMethod": [
    {
      "id": "did:ixo:domain123#keys-1",
      "type": "Ed25519VerificationKey2020",
      "controller": "did:ixo:domain123",
      "publicKeyMultibase": "zH3C2AVvLMv6gmMNam3uVAjZpfkcJCwDwnZn6z3wXmqPV"
    }
  ],
  "authentication": ["did:ixo:domain123#keys-1"],
  "service": [{
    "id": "did:ixo:domain123#mediator",
    "type": "polymorphicMediator2021",
    "serviceEndpoint": "http://mediator.onion/iid/mediator/did:ixo:domain123"
  }],
  "linkedResource": [{
    "id": "did:ixo:domain123#resourceHashgraph",
    "path": "did:ixo:domain123/resourceHashgraph",
    "type": "hashgraph",
    "proof": "afybeiemxf5abjwjbikoz4mcb3a3dla6ual3jsgpdr4cjr3oz",
    "endpoint": "did:ixo:domain123?service=mediator"
  }]
}

interface DomainProperties {
  // Tokenization properties
  tokenType: string;
  tokenClass: string;
  
  // Linked resources
  resources: LinkedResource[];
  
  // Rights and capabilities
  accordedRights: Right[];
  capabilities: Capability[];
  
  // Entity relationships
  linkedEntities: EntityLink[];
  
  // Blockchain accounts
  accounts: BlockchainAccount[];
}

interface LinkedResource {
  id: string;
  path: string;
  type: string;
  proof: string;
  endpoint: string;
}