Class MdocVerifierOptions
Policy knobs for MdocVerifier.
public sealed class MdocVerifierOptions- Inheritance
-
MdocVerifierOptions
- Inherited Members
Properties
CheckStatus
Whether to enforce the MSO's status element when present: the credential's entry in the MSO
revocation list it references, a status list or an identifier list. Defaults to true, matching
CheckStatus: a revoked credential fails verification, and so
does one whose list cannot be fetched or validated. Turn off only where the list's host is
unreachable by design.
public bool CheckStatus { get; set; }Property Value
Remarks
A list is trusted only through the credential that referenced it: the certificate its MSO reference names, or else the certificate that signed the credential's own Document Signer, which the trust seam must vouch for on the same anchor as the Document Signer. A seam that reports no TrustAnchorThumbprint, or that anchors on the Document Signer itself, cannot vouch for that certificate, so a credential whose MSO reference names no certificate fails with StatusUnresolvable. Anchor on IACA certificates, as for the Document Signer's own trust.
ClockSkew
Tolerated clock skew for the MSO validity window. Defaults to 5 minutes, matching ClockSkew.
public TimeSpan ClockSkew { get; set; }Property Value
RequireDeviceAuth
Whether device authentication (the holder's signature over the session transcript) is required. Defaults to true, matching RequireKeyBinding. When false, a present deviceSignature is still verified.
public bool RequireDeviceAuth { get; set; }Property Value
ResolveX5u
Fetches the Document Signer certificate an issuerAuth names by x5u when it carries no
x5chain. Off by default: such an mdoc then fails with IssuerKeyUnresolvable,
with a message saying x5u resolution is off.
public bool ResolveX5u { get; set; }Property Value
Remarks
The fetch goes to a URL the presented mdoc chooses, and it happens before trust is known, because the
trust seam judges the chain the URL returns. It is HTTPS only and bounded in size and time; the default HTTP
client also refuses internal addresses, which a client passed to MdocVerifier must do itself.
Both the x5u and a SHA-256 x5t naming the certificate must be in the protected header, as CIR
(EU) 2026/1731 Annex I has a PID carry them; otherwise the mdoc is refused. A resource is kept only for an mdoc
that verified in full, keyed by URL and thumbprint, and reused for an hour from when it was fetched. The issuer
whose URL it is learns when its credentials are verified, so turn this on only for a trust source whose issuers
name their certificate this way.
StatusListCacheDuration
How long a validated MSO revocation list may be served from cache before refetching. This is the
ceiling: the list's own ttl shortens it and its exp caps it. Defaults to 5 minutes,
matching StatusListCacheDuration. Set to
Zero to fetch on every verification.
public TimeSpan StatusListCacheDuration { get; set; }Property Value
ZkProofVerifier
Checks the proofs of zero knowledge presentations. Off by default: without one, a response made only of zero knowledge presentations fails with ZkPresentationUnsupported. With one, such a presentation is verified. Its timestamp must then lie within ClockSkew of the verifier's clock, because the proof establishes the credential's validity at that timestamp.
public IZkProofVerifier? ZkProofVerifier { get; set; }Property Value
Remarks
Set CheckStatus to false beside it. A proof discloses no MSO, so its revocation status cannot be checked. While CheckStatus is true every zero knowledge presentation fails with CredentialStatusUnknown. That is stricter than for a plain presentation, which passes when its MSO names no status list: a proof cannot show whether its MSO names one. The age verification profile puts revocation out of scope (Annex A, A.3). To refuse a proof made with a circuit the request did not offer, set ZkRequest when verifying the answer.