Class SdJwtVcVerifier

Namespace

Tessio.Verifier.Core

Assembly

Tessio.Verifier.Core.dll

Verifies SD-JWT VC credentials (dc+sd-jwt): issuer signature (JWT VC Issuer Metadata or X.509 x5c key resolution), selective-disclosure reconstruction, Key Binding, time claims, and issuer trust via ITrustListResolver.

public sealed class SdJwtVcVerifier : ICredentialVerifier

Inheritance

object

SdJwtVcVerifier

Implements

ICredentialVerifier

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Structural violations (malformed credential, failed signature, RFC 9901 MUST-reject rules) yield a single-error invalid result; policy failures (expiry, nonce/audience, trust, vct) are accumulated so callers see every problem at once. All cryptography is delegated to Microsoft.IdentityModel and System.Security.Cryptography — nothing custom.

Constructors

SdJwtVcVerifier(ITrustListResolver, SdJwtVcVerifierOptions?, HttpClient?, TimeProvider?)

Creates a verifier.

public SdJwtVcVerifier(ITrustListResolver trustListResolver, SdJwtVcVerifierOptions? options = null, HttpClient? httpClient = null, TimeProvider? clock = null)

Parameters

trustListResolver ITrustListResolver

Trust seam deciding whether the issuer is trusted.

options SdJwtVcVerifierOptions

Policy options; defaults are HAIP-aligned.

httpClient HttpClient

HTTP client for JWT VC Issuer Metadata resolution; a shared default is used when null.

clock TimeProvider

Time source for exp/nbf evaluation; system clock when null.

Methods

VerifyAsync(PresentedCredential, VerificationContext, CancellationToken)

public Task<VerificationResult> VerifyAsync(PresentedCredential credential, VerificationContext context, CancellationToken ct = default)

Parameters

credential PresentedCredential

context VerificationContext

ct CancellationToken

Returns

Task<VerificationResult>

VerifyAsync(PresentedCredential, VerificationContext, TransactionDataExpectation?, CancellationToken)

Verifies a credential that must additionally acknowledge transaction data: the KB-JWT's transaction_data_hashes must match transactionData exactly.

public Task<VerificationResult> VerifyAsync(PresentedCredential credential, VerificationContext context, TransactionDataExpectation? transactionData, CancellationToken ct = default)

Parameters

credential PresentedCredential

context VerificationContext

transactionData TransactionDataExpectation

ct CancellationToken

Returns

Task<VerificationResult>