Project: certificate-usage · Branch: FHIR-1996_track-ecc-rsa-certificate-usage · Mode:  · Model: claude-haiku-4-5-20251001

Stats: 1 user messages, 14 tool calls, tools used: Glob, Grep, Read, Bash.

Conversation

Turn 1 — User

Search for algorithm mapping code related to certificates, specifically looking for logic that maps 'none', 'RSA', or 'ECC' algorithms and handles curveName. This is likely in certificate parsing or tracking code related to FHIR-1996.

Turn 1 — Assistant

I'll search for algorithm mapping code related to certificates, specifically looking for logic handling 'none', 'RSA', 'ECC' algorithms and curveName.

Tools used:

- Glob: /.ts

Tools used:

- Grep: (RSA|ECC|curveName|algorithm)

Tools used:

- Grep: none.RSA.ECC

Tool results:

  → result (ok): /Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/config/builder/afterSign.ts
/Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/config/builder/build.ts
/Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/config/builder/signWindows.ts
/Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/config/builder/updateProductName.ts
/Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/config/codegen/co
…(truncated, 11629 more chars)

Tool results:

  → result (ok): Found 52 files
src/modules/ehr-exports/main/ehr-exports-decryptor.ts
src/modules/kbv-ti-connect/services/types.ts
src/modules/kbv-ti-connect/services/ti-connect-settings.ts
src/modules/kbv-ti-connect/services/qes-signature/__tests__/qes-signature.test.ts
src/modules/kbv-ti-connect/services/qes-signature/index.ts
src/modules/kbv-ti-connect/services/mock/mockStore.ts
src/modules/kbv-ti-connect/services/configuration-service/__tests__/index.test.ts
src/modules/kbv-ti-connect/services/configuration-
…(truncated, 3081 more chars)

Tool results:

  → result (ok): No files found

Let me search more specifically for certificate algorithm mapping code:

Tools used:

- Grep: RSA.ECC|algorithm.mapping|curveName

Tool results:

  → result (ok): src/modules/kbv-ti-connect/services/qes-signature/index.ts:115:          Crypt: 'RSA_ECC',
src/modules/kbv-ti-connect/services/qes-signature/__tests__/qes-signature.test.ts:382:        Crypt: 'RSA_ECC',
src/modules/kbv-ti-connect/services/types.ts:43:export type CryptTypeSig = CryptType | 'RSA_ECC'
src/modules/kbv-ti-connect/services/configuration-service/index.ts:19:  readonly #authSignAlgorithm: CryptType // RSA-ECC switch
src/modules/kbv-ti-connect/services/configuration-service/index.ts:22: 
…(truncated, 4658 more chars)

Tools used:

- Grep: FHIR-1996|certificate.algorithm|TiCertificate

Tool results:

  → result (ok): Found 1 file
src/modules/kbv-ti-connect/renderer/components/preferences/sections/TIConnect.tsx

Great! I found the key files. Let me examine the algorithm mapping code more closely:

Tools used:

- Read: /Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/src/modules/gematik-crypto/services/utils/jwaMapper.ts

Tool results:

  → result (ok): 1→/
     2→  Maps JWA (JSON Web Algorithm) strings to certificate tracking format
     3→  Used to convert JWSUtils output to Datadog tracking events
     4→ /
     5→export interface CertificateInfo {
     6→  certificateType: 'ECC' | 'RSA'
     7→  curveName?: string
     8→}
     9→
    10→export class JWAMapper {
    11→  /
    12→    Converts JWA algorithm string to certificate type and curve
    13→    @param jwa - JWA string from JWSUtils (e.g., "RS256", "ES256", "BP256R1")
    1
…(truncated, 1851 more chars)

Tools used:

- Read: /Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/src/modules/kbv-ti-connect/main/ti-connect.ts

Tool results:

  → result (ok): 1→import { ipcManager } from '@core/ipc-manager'
     2→import { sendPreferences } from '@core/app/main/helpers/preferences-helper'
     3→import { TrackingEvent } from '@core/monitoring'
     4→
     5→import { CertificateAnalyzer } from '@module/gematik-crypto'
     6→import { TiEnvRepository } from '@module/gematik-ti-environment/services/tiEnvRepository'
     7→import { kbvTiConnectLogger } from '@module/kbv-ti-connect/services/logger'
     8→import tiConnect from '@module/kbv-ti-connect/ser
…(truncated, 9614 more chars)

Tools used:

- Read: /Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/src/modules/gematik-crypto/services/utils/__tests__/jwaMapper.test.ts

Tool results:

  → result (ok): 1→import { describe, expect, it } from 'vitest'
     2→
     3→import { JWAMapper } from '../jwaMapper'
     4→
     5→describe('JWAMapper', () => {
     6→  describe('.mapJWAToCertificateInfo', () => {
     7→    it('identifies RSA algorithms (RS family)', () => {
     8→      expect(JWAMapper.mapJWAToCertificateInfo('RS256')).toEqual({
     9→        certificateType: 'RSA',
    10→      })
    11→      expect(JWAMapper.mapJWAToCertificateInfo('RS384')).toEqual({
    12→        certificateType:
…(truncated, 2204 more chars)

Now let me check the CertificateAnalyzer that's being called:

Tools used:

- Grep: class CertificateAnalyzer|analyzeCertificate

Tools used:

- Bash: find /Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage -name "[Cc]ertificate[Aa]nalyzer" -o -name "[Aa]nalyze" | grep -i certificate | head -20

Tool results:

  → result (ok): Found 3 files
src/modules/kbv-ti-connect/main/__tests__/ti-connect.test.ts
src/modules/kbv-ti-connect/main/ti-connect.ts
src/modules/gematik-crypto/services/crypto-adapter/adapter.ts

Tool results:

  → result (ok): /Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/tools/codeowners/analyze.ts
/Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/.claude/agents/modules/module-wiring-analyzer.md

Tools used:

- Grep: CertificateAnalyzer

Tool results:

  → result (ok): src/modules/kbv-ti-connect/main/ti-connect.ts:5:import { CertificateAnalyzer } from '@module/gematik-crypto'
src/modules/kbv-ti-connect/main/ti-connect.ts:106:    const certificateInfo = await CertificateAnalyzer.analyzeCertificate(cert)
src/modules/kbv-ti-connect/main/__tests__/ti-connect.test.ts:7:import { CertificateAnalyzer } from '@module/gematik-crypto'
src/modules/kbv-ti-connect/main/__tests__/ti-connect.test.ts:44:  CertificateAnalyzer: {
src/modules/kbv-ti-connect/main/__tests__/ti-conn
…(truncated, 253 more chars)

Tools used:

- Read: /Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/src/modules/gematik-crypto/services/crypto-adapter/adapter.ts (150–250)

Tool results:

  → result (ok): 150→      const response = await CustomHttpsFetch.call(endpoint, key, cert)
   151→      return { status: response.status, body: await response.text() }
   152→    }
   153→  }
   154→}
   155→
   156→export class CertificateAnalyzer {
   157→  /
   158→    Analyzes a certificate to extract type (ECC/RSA) and curve information
   159→    Used for tracking certificate usage in Datadog
   160→   
   161→    This combines JWA derivation (from JWSUtils) and mapping to certificate info.
   162→
…(truncated, 870 more chars)

Now let me check the JWSUtils to understand the full algorithm derivation pipeline:

Tools used:

- Read: /Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/src/modules/gematik-crypto/services/node/jose/JWSUtils.ts

Tool results:

  → result (ok): 1→import { Certificate } from 'pkijs'
     2→import  as Asn1 from 'asn1js'
     3→
     4→enum JWAlgorithms {
     5→  HMAC = 'HS', // There is no MAC expected, so keeping here for the compatibility
     6→  'RSASSA-PKCS1-v1_5' = 'RS',
     7→  ECDSA = 'ES',
     8→  'RSASSA-PSS' = 'PS',
     9→}
    10→
    11→type JWSAlgorithms = 'HMAC' | 'RSASSA-PKCS1-v1_5' | 'ECDSA' | 'RSASSA-PSS'
    12→export class JWSUtils {
    13→  static concatenateECDSASignature(signature: string, outputLength: numbe
…(truncated, 5381 more chars)

Perfect! Now let me check the test file to see more complete coverage:

Tools used:

- Read: /Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/src/modules/kbv-ti-connect/main/__tests__/ti-connect.test.ts (500–650)

Tool results:

  → result (ok): 500→
   501→      expect(kbvTiConnectLogger.error).toHaveBeenCalledWith('TiConnectModule', {
   502→        extra: 'mocked-log-string',
   503→      })
   504→      expect(mockExtraLogParser).toHaveBeenCalledWith({
   505→        traceId: incompleteData.traceId,
   506→        functionName: 'onTiConnectDecryptKeyStoreListener',
   507→        operation: 'update',
   508→        direction: 'input',
   509→        params: ['data.tiKeyStorePath', 'data.tiKeyStorePassword'],
   510→      })
   511→ 
…(truncated, 6748 more chars)

Excellent! Now I have a complete picture. Let me create a comprehensive summary of the algorithm mapping code:

Summary: Algorithm Mapping Code for Certificate Tracking (FHIR-1996)

I've found the complete algorithm mapping implementation for tracking ECC/RSA certificate usage in your FHIR-1996 branch. Here are the key components:

1. Main Algorithm Mapper: JWAMapper
File: /Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/src/modules/gematik-crypto/services/utils/jwaMapper.ts

This class maps JWA (JSON Web Algorithm) strings to certificate types with the following logic:

Algorithm Mapping Logic:
- RSA Algorithms: Recognizes RS (RS256, RS384, RS512) and PS* (PS256, PS384, PS512) prefixes → Returns { certificateType: 'RSA' }
- ECC - Brainpool Curve: BP256R1 → Returns { certificateType: 'ECC', curveName: 'brainpoolP256r1' } (German TI standard)
- ECC - NIST Curves: 
  - ES256 → { certificateType: 'ECC', curveName: 'P-256' }
  - ES384 → { certificateType: 'ECC', curveName: 'P-384' }
  - ES512 → { certificateType: 'ECC', curveName: 'P-521' } (note: P-521, not P-512)
- 'none' Algorithm: Returns { certificateType: 'RSA', curveName: 'unknown' } (handled as fallback for unsigned certificates)

2. Certificate Analysis Pipeline
File: /Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/src/modules/gematik-crypto/services/crypto-adapter/adapter.ts

The CertificateAnalyzer class orchestrates the analysis:
1. Calls JWSUtils.deriveJWAFromCertificate(certificate) to extract the JWA string
2. Passes result to JWAMapper.mapJWAToCertificateInfo(jwa) to convert to tracking format

3. JWA Derivation: JWSUtils
File: /Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/src/modules/gematik-crypto/services/node/jose/JWSUtils.ts

The deriveJWAFromCertificate() method:
- Parses base64-encoded certificate using pkijs (pure JavaScript)
- Extracts public key algorithm details (RSA or EC)
- For RSA: Combines algorithm identifier (RS or PS) with hash size (256, 384, 512)
- For ECC: Combines algorithm identifier (ES) with hash size OR detects brainpoolP256r1 via OID 1.3.36.3.3.2.8.1.1.7
- Returns 'none' if parsing fails (fallback for unsigned certificates)

4. Integration Point: TiConnect Module
File: /Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/src/modules/kbv-ti-connect/main/ti-connect.ts

The trackCertificateType() function (lines 104-137):
- Called during keystore decryption
- Uses CertificateAnalyzer.analyzeCertificate() to extract certificate info
- Sends tracking events with:
  - certificateType: 'ECC' or 'RSA'
  - curveName: specific curve (e.g., 'brainpoolP256r1', 'P-256') or undefined for RSA
  - tiEnvironment: TI environment value (RU, PU, etc.)
- Gracefully handles errors (observability-only, doesn't break main flow)

5. Test Coverage
File: /Users/USER/workspace/doctolib/FHIR-1996_track-ecc-rsa-certificate-usage/src/modules/gematik-crypto/services/utils/__tests__/jwaMapper.test.ts

Comprehensive test suite covering:
- RS256, RS384, RS512 (RSA algorithms)
- PS256 (RSA-PSS)
- BP256R1 (brainpoolP256r1 ECC)
- ES256, ES384, ES512 (NIST ECC curves)
- 'none' algorithm (unknown/unsigned)
- Error handling for unknown algorithms

---

Key Design Decision: The 'none' algorithm is mapped to RSA with curveName 'unknown' to maintain backward compatibility while still tracking that a certificate exists but couldn't be properly analyzed.