Class SdJwtVcVerifier

Namespace

Tessio.Verifier.Core

Assembly

Tessio.Verifier.Core.dll

Verifies SD-JWT VC credentials (dc+sd-jwt): issuer signature (JWT VC Issuer Metadata or X.509 x5c key resolution), selective-disclosure reconstruction, Key Binding, time claims, and issuer trust via ITrustListResolver.

public sealed class SdJwtVcVerifier : ICredentialVerifier

Inheritance

object

SdJwtVcVerifier

Implements

ICredentialVerifier

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Structural violations (malformed credential, failed signature, RFC 9901 MUST-reject rules) yield a single-error invalid result; policy failures (expiry, nonce/audience, trust, vct) are accumulated so callers see every problem at once. For an untrusted issuer the credential's own statements go no further than its issuer signature: its key binding is not checked, so its holder key is never built, and its status list is never requested. On the metadata route trust is decided before the key is fetched, so that credential fails with the trust error alone; on the X.509 route the signature is checked against the chain the credential carries or names, since that chain is what trust is judged on. All cryptography is delegated to Microsoft.IdentityModel and System.Security.Cryptography — nothing custom.

Constructors

SdJwtVcVerifier(ITrustListResolver, SdJwtVcVerifierOptions?, HttpClient?, TimeProvider?)

Creates a verifier.

public SdJwtVcVerifier(ITrustListResolver trustListResolver, SdJwtVcVerifierOptions? options = null, HttpClient? httpClient = null, TimeProvider? clock = null)

Parameters

trustListResolver ITrustListResolver

Trust seam deciding whether the issuer is trusted.

options SdJwtVcVerifierOptions

Policy options; defaults are HAIP-aligned.

httpClient HttpClient

HTTP client for JWT VC Issuer Metadata, issuer key sets, status lists, and the signing certificate an issuer JWT names by x5u when ResolveX5u is on. Every fetch, on any client, has a deadline and a size limit. When null, a shared default also refuses non-public addresses and redirects, and ignores the process proxy. A client supplied here gets none of those three, so it must enforce them itself.

clock TimeProvider

Time source for exp/nbf evaluation; system clock when null.

Methods

VerifyAsync(PresentedCredential, VerificationContext, CancellationToken)

public Task<VerificationResult> VerifyAsync(PresentedCredential credential, VerificationContext context, CancellationToken ct = default)

Parameters

credential PresentedCredential

context VerificationContext

ct CancellationToken

Returns

Task<VerificationResult>

VerifyAsync(PresentedCredential, VerificationContext, TransactionDataExpectation?, CancellationToken)

Verifies a credential that must additionally acknowledge transaction data: the KB-JWT's transaction_data_hashes must match transactionData exactly.

public Task<VerificationResult> VerifyAsync(PresentedCredential credential, VerificationContext context, TransactionDataExpectation? transactionData, CancellationToken ct = default)

Parameters

credential PresentedCredential

context VerificationContext

transactionData TransactionDataExpectation

ct CancellationToken

Returns

Task<VerificationResult>