Module validation 

Available on crate feature vc only.

Validation of credential and presentation JWTs: signature, binding to the issuer or holder, validity period, audience, nonce and status.

The validators take two extension points: a KeyResolver (from resolver, re-exported here), which turns the KeyReference of a JWT into the public key of its signer, and a JwsVerifier, which checks the signature and is DefaultVerifier unless an application substitutes its own. The crate’s Resolver resolves DID URLs; a CompositeKeyResolver adds keys by value (JwkResolver) or the key sets of HTTPS issuers (JwksResolver, feature jwks). A StatusCheck is a third, optional extension point, for credentialStatus and the status claim, shared with the SD-JWT validators.

What is checked

For a credential (JwtCredentialValidator):

1. The token is a compact JWS whose header names its key (KeyReference::from_jws, with the issuer as iss): a kid that is a DID URL of the form did:…#fragment, a #fragment relative to a DID issuer, a kid into the key set of an HTTPS issuer, or a jwk, x5c or jku header. A path or DID parameters such as versionId in a DID URL are refused, so the signer cannot pick the document version its key is looked up in (ADR 0004). When typ is present it names the profile: JWT for VCDM 1.1, vc+jwt for VCDM 2.0, or one of the values the options add (CredentialValidationOptions::additional_typ).
2. The payload is a claims set that maps to a Credential (or a CredentialV2), with its registered claims agreeing with the credential. A payload with _sd or _sd_alg as a member name anywhere, or an array element {"...": "<digest>"}, is the issuer-signed JWT of an SD-JWT and is refused (ValidationError::SdJwtPayload), typed or not: read as a plain JWT, its digests would be properties and its concealed claims would look absent. The typ check alone does not catch it, since an untyped token is accepted; SdJwtCredentialValidator of sd_jwt_vc validates it.
3. The key the reference names is resolved for KeyRole::Issuer (assertionMethod in a DID document) and verifies the signature.
4. The key belongs to the issuer (KeyReference::binds_to): the issuer is the DID of the DID URL, the did:jwk or thumbprint of a key by value, or the HTTPS issuer of the key set.
5. nbf, exp and iat, and the credential’s own validity period, hold at the validation time, within the leeway.
6. credentialStatus passes the StatusCheck, per the StatusPolicy, and so does a status claim, which the Token Status List defines for any JWT (§6.1), as CredentialStatus::StatusClaim after the credentialStatus entries. With the status-list feature (which sd-jwt implies) a status claim that does not parse, or names no status mechanism, is refused; without it the claim cannot be checked, so it fails under StatusPolicy::Strict and is ignored otherwise.

For a presentation (JwtPresentationValidator): the same for the presentation JWT, with the key resolved for KeyRole::Subject (authentication) and bound to the holder, plus the expected audience and nonce; then every credential it carries is validated as above, and its subject is checked against the holder per the SubjectHolderRelationship. A VCDM 1.1 presentation (typ JWT, validate) carries credential JWTs in its vp claim; a VCDM 2.0 one (typ vp+jwt, validate_v2) is the payload itself and envelopes vc+jwt credentials and, with the sd-jwt feature, vc+sd-jwt ones (validated as SdJwtCredentialValidator::validate_v2 of sd_jwt_vc does, with the key binding the presentation options require); an envelope of another media type fails for that credential alone.

Everything a verifier decides by policy (which issuers to trust, which credential types to accept, what the claims must say) is left to the application, which gets the decoded credential back. decode_credential, decode_credential_v2, decode_presentation and decode_presentation_v2 decode without verifying, for a look at a token before deciding how to validate it, and refuse an SD-JWT payload as the validators do; extract_issuer and extract_holder read just the signer’s DID.

Re-exports

pub use crate::resolver::KeyReference;

pub use crate::resolver::KeyReferenceError;

pub use crate::resolver::KeyResolutionError;

pub use crate::resolver::KeyResolver;

pub use crate::resolver::KeyRole;

Structs

CredentialValidationOptions

Options of JwtCredentialValidator.

DecodedCredential

A validated or decoded VCDM 1.1 credential JWT: its header, its claims (custom ones included) and the credential they map to.

DecodedCredentialV2

A validated or decoded VCDM 2.0 credential JWT: its header, its claims and the credential.

DecodedPresentation

A validated or decoded VCDM 1.1 presentation JWT: its header, its claims (custom ones included), the presentation, and its credentials decoded.

DecodedPresentationV2

A validated or decoded VCDM 2.0 presentation JWT (vp+jwt): its header, its claims, the presentation, and its enveloped credentials unwrapped and decoded.

JwtCredentialValidator

Validates credential JWTs, see the module documentation for the checks.

JwtPresentationValidator

Validates presentation JWTs and the credential JWTs they carry, see the module documentation for the checks.

PresentationValidationError

Why a presentation did not validate: the presentation itself, or some of its credentials.

PresentationValidationOptions

Options of JwtPresentationValidator.

TimeOptions

The validation time and the clock skew allowed around it.

Enums

CredentialStatus

A status entry of a credential, of either credential format, for a StatusCheck.

FailFast

Whether to stop at the first failing credential of a presentation.

PresentedCredentialV2

A credential unwrapped from an EnvelopedVerifiableCredential of a VCDM 2.0 presentation: secured as a JWT (application/vc+jwt) or, with the sd-jwt feature, with SD-JWT (application/vc+sd-jwt).

StatusError

Why a StatusCheck did not pass.

StatusPolicy

What to do about a status entry: a credentialStatus entry, or the status claim of an SD-JWT credential or of a JWT credential.

SubjectHolderRelationship

How the subject of a presented credential must relate to the holder presenting it.

ValidationError

Why a credential or presentation JWT did not validate.

Traits

StatusCheck

Checks the status of a credential: fetches the status list, bitmap or registry an entry points to and reports whether the credential is still good.

Functions

decode_credential

Decodes a VCDM 1.1 credential JWT without verifying or validating anything.

decode_credential_v2

Decodes a VCDM 2.0 credential JWT without verifying or validating anything.

decode_presentation

Decodes a VCDM 1.1 presentation JWT and its credentials without verifying or validating anything.

decode_presentation_v2

Decodes a VCDM 2.0 presentation JWT and unwraps and decodes its credentials without verifying or validating anything. A credential secured with SD-JWT (feature sd-jwt) has its disclosures processed, which checks the digests, but no signature is verified.

extract_holder

The DID of the holder of a presentation JWT, read without verifying anything: iss, else the holder of the vp claim (VCDM 1.1) or of the payload (VCDM 2.0).

extract_issuer

The DID of the issuer of a credential JWT, read without verifying anything: iss, else the issuer of the vc claim (VCDM 1.1) or of the payload (VCDM 2.0).