Skip to main content

Module vc

identity_kit

Module vc 

Source
Available on crate feature vc only.
Expand description

Verifiable credentials and presentations secured as JWTs.

The module implements two profiles over the same JOSE layer:

  • VCDM 1.1 JWT profile (§6.3.1 of the Verifiable Credentials Data Model 1.1): Credential and Presentation map to and from a JwtClaims set whose vc or vp claim holds the data model object and whose registered claims (iss, sub, jti, nbf, exp, aud) carry the issuer, subject, id, validity period and audience.
  • VCDM 2.0 with VC-JOSE-COSE: CredentialV2 and PresentationV2 are themselves the JWT payload (typ: vc+jwt or vp+jwt), and a secured credential travels inside a presentation as an EnvelopedVc holding a data:application/vc+jwt,… URL.

Both are plain data with open extension properties; @context is carried, never processed. Jwt is a compact JWS as a string, signed with any Signer through Jwt::sign. The validation module verifies and validates the JWTs: signature through a KeyResolver and a JwsVerifier, binding of the signing key to the issuer or holder, validity period, audience, nonce and status.

Timestamps are chrono::DateTime<Utc> values, serialized as RFC 3339 in UTC (2010-01-01T19:23:24Z), the dateTimeStamp form the data model requires.

§Examples

The JWT claims of VCDM 1.1 Example 31, decoded to a credential and back.

use identity_kit::vc::{Credential, JwtClaims};
use serde_json::json;

let claims: JwtClaims = serde_json::from_value(json!({
  "sub": "did:example:ebfeb1f712ebc6f1c276e12ec21",
  "jti": "http://example.edu/credentials/3732",
  "iss": "https://example.com/keys/foo.jwk",
  "nbf": 1541493724,
  "exp": 1573029723,
  "nonce": "660!6345FSer",
  "vc": {
    "@context": [
      "https://www.w3.org/2018/credentials/v1",
      "https://www.w3.org/2018/credentials/examples/v1"
    ],
    "type": ["VerifiableCredential", "UniversityDegreeCredential"],
    "credentialSubject": {
      "degree": { "type": "BachelorDegree", "name": "Bachelor of Science and Arts" }
    }
  }
}))?;

let credential = Credential::from_jwt_claims(&claims)?;
assert_eq!(credential.id.as_ref().map(|id| id.as_str()), Some("http://example.edu/credentials/3732"));
assert_eq!(credential.issuer.id().as_str(), "https://example.com/keys/foo.jwk");
assert_eq!(credential.issuance_date.to_rfc3339(), "2018-11-06T08:42:04+00:00");
assert_eq!(
    credential.subject().and_then(|s| s.id.as_ref()).map(|id| id.as_str()),
    Some("did:example:ebfeb1f712ebc6f1c276e12ec21")
);

// The mapping is reversible; the custom `nonce` claim is the caller's to add back.
let encoded = credential.to_jwt_claims()?.with_claim("nonce", "660!6345FSer");
assert_eq!(encoded, claims);

Modules§

validation
Validation of credential and presentation JWTs: signature, binding to the issuer or holder, validity period, audience, nonce and status.

Structs§

Credential
A verifiable credential of the Verifiable Credentials Data Model 1.1, as data.
CredentialV2
A verifiable credential of the Verifiable Credentials Data Model 2.0, as data.
EnvelopedVc
An EnvelopedVerifiableCredential (VCDM 2.0 §4.12.1): a secured credential carried in a data: URL, the form a credential takes inside a PresentationV2.
EnvelopedVp
An EnvelopedVerifiablePresentation (VCDM 2.0 §4.12.2): a secured presentation carried in a data: URL.
Jwt
A JSON Web Token (RFC 7519) in compact serialization, kept as the string it is.
JwtClaims
A JWT claims set: the registered claims of RFC 7519 §4.1 as fields, every other claim (vc, vp, nonce, cnf, …) in additional.
Presentation
A verifiable presentation of the Verifiable Credentials Data Model 1.1 whose credentials are JWTs, as data.
PresentationV2
A verifiable presentation of the Verifiable Credentials Data Model 2.0 whose credentials are EnvelopedVc objects, as data.
Subject
A credentialSubject: the optional id of the subject and the claims about it.
TypedObject
An object with a type and usually an id: a credentialStatus, credentialSchema, refreshService, termsOfUse or evidence entry, whose meaning the type defines.

Enums§

CredentialError
Why a credential or presentation is not well-formed, or cannot be mapped to or from the claims of a JWT.
Party
The issuer of a credential or the holder of a presentation: a URI, or an object whose id is that URI and that carries further properties, a name say.

Constants§

CONTEXT_V1
The base context of the Verifiable Credentials Data Model 1.1.
CONTEXT_V2
The base context of the Verifiable Credentials Data Model 2.0.