Module validation 

Available on crate feature vc only.

Validation of credential and presentation JWTs: signature, binding to the issuer or holder, validity period, audience, nonce and status.

The validators take two extension points: a KeyResolver, which turns the kid of a JWT into the public key of its signer and is implemented by the crate’s Resolver, and a JwsVerifier, which checks the signature and is DefaultVerifier unless an application substitutes its own. A StatusCheck is a third, optional one for credentialStatus.

What is checked

For a credential (JwtCredentialValidator):

1. The token is a compact JWS whose header has a kid that is a DID URL of the form did:…#fragment: a path or DID parameters such as versionId are refused, so the signer cannot pick the document version its key is looked up in (ADR 0004). When typ is present it names the profile: JWT for VCDM 1.1, vc+jwt for VCDM 2.0.
2. The payload is a claims set that maps to a Credential (or a CredentialV2), with its registered claims agreeing with the credential.
3. The key kid names is resolved under the assertionMethod relationship and verifies the signature.
4. The issuer is the DID of kid: the key that signed is the issuer’s.
5. nbf, exp and iat, and the credential’s own validity period, hold at the validation time, within the leeway.
6. credentialStatus passes the StatusCheck, per the StatusPolicy.

For a presentation (JwtPresentationValidator): the same for the presentation JWT, with the key resolved under authentication and the holder as the signer, plus the expected audience and nonce; then every credential it carries is validated as above, and its subject is checked against the holder per the SubjectHolderRelationship.

Everything a verifier decides by policy (which issuers to trust, which credential types to accept, what the claims must say) is left to the application, which gets the decoded credential back. decode_credential, decode_credential_v2 and decode_presentation decode without verifying, for a look at a token before deciding how to validate it; extract_issuer and extract_holder read just the signer’s DID.

Structs

CredentialValidationOptions

Options of JwtCredentialValidator.

DecodedCredential

A validated or decoded VCDM 1.1 credential JWT: its header, its claims (custom ones included) and the credential they map to.

DecodedCredentialV2

A validated or decoded VCDM 2.0 credential JWT: its header, its claims and the credential.

DecodedPresentation

A validated or decoded VCDM 1.1 presentation JWT: its header, its claims (custom ones included), the presentation, and its credentials decoded.

JwtCredentialValidator

Validates credential JWTs, see the module documentation for the checks.

JwtPresentationValidator

Validates presentation JWTs and the credential JWTs they carry, see the module documentation for the checks.

KeyResolutionError

Why a key could not be resolved for a KeyResolver.

PresentationValidationError

Why a presentation did not validate: the presentation itself, or some of its credentials.

PresentationValidationOptions

Options of JwtPresentationValidator.

TimeOptions

The validation time and the clock skew allowed around it.

Enums

FailFast

Whether to stop at the first failing credential of a presentation.

StatusError

Why a StatusCheck did not pass.

StatusPolicy

What to do about a credentialStatus entry.

SubjectHolderRelationship

How the subject of a presented credential must relate to the holder presenting it.

ValidationError

Why a credential or presentation JWT did not validate.

Traits

KeyResolver

Finds the public key a JWT was signed with, given the DID URL in its kid.

StatusCheck

Checks the credentialStatus of a credential: fetches the status list, bitmap or registry the entry points to and reports whether the credential is still good.

Functions

decode_credential

Decodes a VCDM 1.1 credential JWT without verifying or validating anything.

decode_credential_v2

Decodes a VCDM 2.0 credential JWT without verifying or validating anything.

decode_presentation

Decodes a VCDM 1.1 presentation JWT and its credentials without verifying or validating anything.

extract_holder

The DID of the holder of a presentation JWT, read without verifying anything: iss, else the holder of the vp claim (VCDM 1.1) or of the payload (VCDM 2.0).

extract_issuer

The DID of the issuer of a credential JWT, read without verifying anything: iss, else the issuer of the vc claim (VCDM 1.1) or of the payload (VCDM 2.0).