Verify Digital Green Certificate ("Covid pass")

[jumpjack]

I am looking for a pure javascript implementation to verify validity of signature of "Covid Pass", but I can't understand if your version implements what I need:

cose-implementations/JavaScript/cose.js

Line 632 in 5a80e9b

Verify: function(key) {

I don't know anything about encryption and signing, I just would like to be able to perform the validity check offline.
I studied it a lot in last weeks, but didn't yet find a solution to perform offline validation. Here I am recording my progress: https://github.com/jumpjack/greenpass/blob/main/README.md

What I was able to extract from the qrcode is:

• Key Identifier (KID)
• Algorithm: -7 (if I understood correctly, it means ES256/SHA-256)
• Signature: 64 bytes (P1363 format)
• "Message": a CBOR object

Are they enough, and is your implementation enough, to validate the signature?

Test data:

Raw qrcode decoding result:
6BFOXN%TS3DH0YOJ58S S-W5HDC *M0II5XHC9B5G2+$N IOP-IA%NFQGRJPC%OQHIZC4.OI1RM8ZA.A5:S9MKN4NN3F85QNCY0O%0VZ001HOC9JU0D0HT0HB2PL/IB*09B9LW4T*8+DCMH0LDK2%K:XFE70*LP$V25$0Q:J:4MO1P0%0L0HD+9E/HY+4J6TH48S%4K.GJ2PT3QY:GQ3TE2I+-CPHN6D7LLK*2HG%89UV-0LZ 2ZJJ524-LH/CJTK96L6SR9MU9DHGZ%P WUQRENS431T1XCNCF+47AY0-IFO0500TGPN8F5G.41Q2E4T8ALW.INSV$ 07UV5SR+BNQHNML7 /KD3TU 4V*CAT3ZGLQMI/XI%ZJNSBBXK2:UG%UJMI:TU+MMPZ5$/PMX19UE:-PSR3/$NU44CBE6DQ3D7B0FBOFX0DV2DGMB$YPF62I$60/F$Z2I6IFX21XNI-LM%3/DF/U6Z9FEOJVRLVW6K$UG+BKK57:1+D10%4K83F+1VWD1NE

After BASE45 decoding and unzipping:

d2844da2044839301768cdda05130126a0590101a4041a6194e898061a60a78c8801624954390103a101a4617681aa62646e02626d616d4f52472d3130303033303231356276706a313131393334393030376264746a323032312d30342d313062636f62495462636978263031495445373330304531414232413834433731393030344631303344434231463730412336626d706c45552f312f32302f313532386269736249546273640262746769383430353339303036636e616da463666e746944493c43415052494f62666e6944692043617072696f63676e746d4d4152494c553c54455245534162676e6e4d6172696cc3b9205465726573616376657265312e302e3063646f626a313937372d30362d31365840a4ee9016c1a74ccf9caab905492d698f6992a8fa30c20db6180f06040c4870a845bb4b3a1ce3f4ed529cc78e66322547d62637c74ab17919c0aa52a614795e9e

Extracted data:

Header:

• KID (text):OTAXaM3aBRM=
• KID (hex):39301768cdda0513
• Algorithm code:-7
• Algorithm sign:ES256
• Algorithm digest:SHA-256

Signature:

• Decimal array:

  • 164,238,144,22,193,167,76,207,156,170,185,5,73,45,105,143,105,146,168,250,48,194,13,182,24,15,6,4,12,72,112,168,69,187,75,58,28,227,244,237,82,156,199,142,102,50,37,71,214,38,55,199,74,177,121,25,192,170,82,166,20,121,94,158

• Hex string:

  • a4ee9016c1a74ccf9caab905492d698f6992a8fa30c20db6180f06040c4870a845bb4b3a1ce3f4ed529cc78e66322547d62637c74ab17919c0aa52a614795e9e

• R:a4ee9016c1a74ccf9caab905492d698f6992a8fa30c20db6180f06040c4870a8

• S:45bb4b3a1ce3f4ed529cc78e66322547d62637c74ab17919c0aa52a614795e9e

Message:

{
	"1": "IT",
	"4": 1637148824,
	"6": 1621593224,
	"-260": {
		"1": {
			"v": [
				{
					"dn": 2,
					"ma": "ORG-100030215",
					"vp": "1119349007",
					"dt": "2021-04-10",
					"co": "IT",
					"ci": "01ITE7300E1AB2A84C719004F103DCB1F70A#6",
					"mp": "EU/1/20/1528",
					"is": "IT",
					"sd": 2,
					"tg": "840539006"
				}
			],
			"nam": {
				"fnt": "DI<CAPRIO",
				"fn": "Di Caprio",
				"gnt": "MARILU<TERESA",
				"gn": "Marilù Teresa"
			},
			"ver": "1.0.0",
			"dob": "1977-06-16"
		}
	}
}

My test page:

http://jumpjack.altervista.org/greenpass/