Skip to main content

verify_session_bundle

aitp_session_bundle::verifier

Function verify_session_bundle 

Source 
pub fn verify_session_bundle(
    bundle: &SessionTrustBundle,
    ctx: &VerifySessionBundleContext<'_>,
) -> Result<BundleOutcome, SessionBundleError>
Expand description

Verify a session bundle.

Order of checks:

  1. version == "aitp/0.1".
  2. expires_at not in the past.
  3. expires_at == min(participants[*].tct.expires_at) invariant.
  4. Verifier’s AID is present in participants[].
  5. Outer bundle signature against coordinator’s key.
  6. Each participant TCT: issuer == coordinator, audience == entry.aid, verify_tct passes.
  7. Per-pair revocation degradation: if any TCT JTI is in the deny list, that participant is dropped from active_aids.