Table of Contents

Class MdocVerifier

Namespace
Tessio.Verifier.Core.Mdoc
Assembly
Tessio.Verifier.Core.Mdoc.dll

Verifies an mdoc presentation (mso_mdoc, ISO/IEC 18013-5 over OpenID4VP Annex B.2): DeviceResponse decoding, issuerAuth signature via the x5chain Document Signer certificate, MSO validity window, per-item digest checks and IACA trust through ITrustListResolver. Structural failures fail fast; policy failures accumulate into Errors with stable codes.

public sealed class MdocVerifier
Inheritance
MdocVerifier
Inherited Members

Remarks

Device authentication verifies the holder's signature over the OpenID4VP session transcript (Annex B.2.6.1), built from the context's client_id, nonce, encryption key thumbprint and response_uri. Required by default (RequireDeviceAuth).

Constructors

MdocVerifier(ITrustListResolver, MdocVerifierOptions?, TimeProvider?)

Creates a verifier.

public MdocVerifier(ITrustListResolver trustListResolver, MdocVerifierOptions? options = null, TimeProvider? clock = null)

Parameters

trustListResolver ITrustListResolver

Trust seam deciding whether the Document Signer chain anchors on a trusted IACA root. The issuer identifier passed to it is the Document Signer certificate subject.

options MdocVerifierOptions

Policy options; defaults match the SD-JWT verifier.

clock TimeProvider

Time source for the MSO validity window; system clock when null.

Fields

Format

The OpenID4VP credential format identifier this verifier accepts.

public const string Format = "mso_mdoc"

Field Value

string

Methods

VerifyAsync(PresentedCredential, MdocVerificationContext, CancellationToken)

Verifies one presented mdoc.

public Task<VerificationResult> VerifyAsync(PresentedCredential credential, MdocVerificationContext context, CancellationToken ct = default)

Parameters

credential PresentedCredential
context MdocVerificationContext
ct CancellationToken

Returns

Task<VerificationResult>