Crate ic_verifiable_credentials 

Modules

issuer_api

Structs

AliasTuple

A pair of identities, that denote the same user. Used in attribute sharing flow to maintain II’s unlinkability of identities.

CredentialParams

VcFlowSigners

Parties that signed credentials contained in a verifiable presentation.

Enums

CredentialVerificationError

PresentationVerificationError

Constants

DID_ICP_PREFIX

II_CREDENTIAL_URL_PREFIX

II_ISSUER_URL

VC_SIGNING_INPUT_DOMAIN

Functions

build_credential_jwt

Builds a verifiable credential with the given parameters and returns the credential as a JWT-string.

build_ii_verifiable_presentation_jwt

Builds from the given parameters a Verifiable Presentation as returned by II to the relying party during a successful VC flow. Specifically, the returned JWT

canister_sig_pk_from_vc_signing_input

Extracts the canister signature public key from the given signing_input, which is the effective byte array that is signed when creating a JWS from a JWT. (essentially, it is a serialized JWT with JWS header, yet without a signature, cf. vc_signing_input()-function above).

did_for_principal

Returns a DID for the given principal.

get_canister_sig_pk_der

Extracts and returns the DER encoded canister sig public key from the given header.

get_canister_sig_pk_raw

Extracts and returns the raw canister sig public key (without DER-prefix) from the given header.

get_verified_id_alias_from_jws

Verifies the given JWS-credential as an id_alias-VC and extracts the alias tuple. Performs both the cryptographic verification of the credential, and the semantic validation of the claims in the VC.

principal_for_did

Returns a principal for the given DID.

validate_claims_match_spec

validate_ii_presentation_and_claims

Validates the provided presentation vp_jwt, both cryptographically and semantically:

vc_jwt_to_jws

Constructs and returns a JWS (a signed JWT) from the given components. Specifically, it constructs a JWS-header with the given canister_sig_pk, and packages credential_jwt, the header, and the signature sig into a JWS. The given signature should be created over the bytes returned by vc_signing_input(). Note: the validity of the signature is not checked.

vc_signing_input

Returns the effective bytes that will be signed when computing a canister signature for the given JWT-credential, verifiable via the specified public key.

vc_signing_input_hash

Computes and returns SHA-256 hash of the given signing_input prefixed with length(VC_SIGNING_INPUT_DOMAIN) · VC_SIGNING_INPUT_DOMAIN (for domain separation), where length(a) is the length of byte-array a, and · denotes concatenation of bytes.

vc_signing_input_to_jws

Constructs and returns a JWS (a signed JWT) from the given components. The given signing_input should be a value returned by vc_signing_input() (which already contains a header with canister signatures public key), and sig should be valid canister signature over signing_input. Note: the validity of the signature is not checked.

verify_credential_jws_with_canister_id

Verifies the specified JWS credential cryptographically and checks that the signature was created by the provided canister. DOES NOT perform semantic validation of the claims in the credential.

verify_ii_presentation_jwt_with_canister_ids

Verifies the specified JWT presentation cryptographically, which should contain exactly two verifiable credentials (in the order specified):