Class MdocVerifier

Namespace

Tessio.Verifier.Core.Mdoc

Assembly

Tessio.Verifier.Core.Mdoc.dll

Verifies an mdoc presentation (mso_mdoc, ISO/IEC 18013-5 over OpenID4VP Annex B.2): DeviceResponse decoding, issuerAuth signature via the x5chain Document Signer certificate, MSO validity window, per-item digest checks and IACA trust through ITrustListResolver. Structural failures fail fast; policy failures accumulate into Errors with stable codes.

public sealed class MdocVerifier

Inheritance

object

MdocVerifier

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Device authentication verifies the holder's signature over the OpenID4VP session transcript (Annex B.2.6.1), built from the context's client_id, nonce, encryption key thumbprint and response_uri. Required by default (RequireDeviceAuth). It is checked only for a Document Signer the trust seam accepts: the device key comes from the MSO, so an untrusted one binds nothing and its device key is not used.

An MSO that carries a status element has its revocation checked, through a status list or an identifier list, unless CheckStatus is off.

Constructors

MdocVerifier(ITrustListResolver, MdocVerifierOptions?, TimeProvider?)

Creates a verifier. Kept so code compiled against earlier versions still binds.

public MdocVerifier(ITrustListResolver trustListResolver, MdocVerifierOptions? options, TimeProvider? clock)

Parameters

trustListResolver ITrustListResolver

See the four-parameter constructor.

options MdocVerifierOptions

Policy options; defaults when null.

clock TimeProvider

Time source; system clock when null.

MdocVerifier(ITrustListResolver, MdocVerifierOptions?, TimeProvider?, HttpClient?)

Creates a verifier.

public MdocVerifier(ITrustListResolver trustListResolver, MdocVerifierOptions? options = null, TimeProvider? clock = null, HttpClient? httpClient = null)

Parameters

trustListResolver ITrustListResolver

Trust seam deciding whether the Document Signer chain anchors on a trusted IACA root. The issuer identifier passed to it is the Document Signer certificate subject. It is also asked about an MSO revocation list's anchor, which it must place on the same anchor as the Document Signer, unless the MSO reference names the certificate itself (see CheckStatus).

options MdocVerifierOptions

Policy options; defaults match the SD-JWT verifier.

clock TimeProvider

Time source for the MSO validity window; system clock when null.

httpClient HttpClient

HTTP client for MSO revocation lists, and for the Document Signer certificate an issuerAuth names by x5u when it carries no x5chain and ResolveX5u is on. Every fetch, on any client, has a deadline and a size limit. When null, a shared default also refuses non-public addresses and redirects, and ignores the process proxy. A client supplied here gets none of those three, so it must enforce them itself.

Fields

Format

The OpenID4VP credential format identifier this verifier accepts.

public const string Format = "mso_mdoc"

Field Value

string

Methods

VerifyAsync(PresentedCredential, MdocVerificationContext, CancellationToken)

Verifies one presented mdoc.

public Task<VerificationResult> VerifyAsync(PresentedCredential credential, MdocVerificationContext context, CancellationToken ct = default)

Parameters

credential PresentedCredential

context MdocVerificationContext

ct CancellationToken

Returns

Task<VerificationResult>