Class Iso18013AnnexC

Namespace

Tessio.Verifier.Core.Mdoc

Assembly

Tessio.Verifier.Core.Mdoc.dll

The verifier's side of an ISO/IEC 18013-7 Annex C presentation over the W3C Digital Credentials API: builds the request pair the browser call carries, and opens the encrypted response into DeviceResponse bytes plus the session transcripts device authentication is verified over. Verification itself stays in MdocVerifier.

public static class Iso18013AnnexC

Inheritance

object

Iso18013AnnexC

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Methods

BuildSessionTranscript(byte[], string)

The session transcript for a request: what the response's HPKE keys are derived over, and what device authentication is signed over. One construction for both, because a wallet was observed using one.

public static byte[] BuildSessionTranscript(byte[] encryptionInfo, string origin)

Parameters

encryptionInfo byte[]

origin string

Returns

byte[]

CreateRequest(string, string, IReadOnlyList<string>)

Builds the {deviceRequest, encryptionInfo} pair and the response key for one request. The key is fresh per request and must never be reused: a stable advertised key would let colluding verifiers correlate the people presenting to it.

public static Iso18013AnnexCRequest CreateRequest(string docType, string nameSpace, IReadOnlyList<string> elementIdentifiers)

Parameters

docType string

nameSpace string

elementIdentifiers IReadOnlyList<string>

Returns

Iso18013AnnexCRequest

OpenResponse(byte[], byte[], byte[], string)

Decrypts an EncryptedResponse. The HPKE keys are derived with the session transcript as info and no aad. Throws AuthenticationTagMismatchException when the key, the EncryptionInfo bytes or the origin do not match what the wallet sealed to.

public static Iso18013AnnexCResponse OpenResponse(byte[] encryptedResponse, byte[] responseKeyPkcs8, byte[] encryptionInfo, string origin)

Parameters

encryptedResponse byte[]

The wallet's response, decoded from base64url.

responseKeyPkcs8 byte[]

The stored ResponseKeyPkcs8.

encryptionInfo byte[]

The stored EncryptionInfo, byte for byte.

origin string

The origin the browser presented the request from.

Returns

Iso18013AnnexCResponse

Remarks

The transcript is the plain one, whose second element is null. A wallet reached over the Digital Credentials API was observed on 2026-08-27 to derive its keys and sign device authentication over exactly that, and to produce an undecryptable response otherwise. Some implementations instead derive over a variant carrying the EncryptionParameters, which this does NOT use; the observed exchange is what governs here.

SealResponse(byte[], byte[], string)

Produces the EncryptedResponse a wallet would return for a request: seals deviceResponse to the request's recipient key over the session transcript, with a fresh ephemeral sender key. For tests, fixtures and mock wallets; a verifier never seals in production.

public static byte[] SealResponse(byte[] deviceResponse, byte[] encryptionInfo, string origin)

Parameters

deviceResponse byte[]

encryptionInfo byte[]

origin string

Returns

byte[]