Struct SdJwtCredentialValidator 

#[non_exhaustive]
pub struct SdJwtCredentialValidator<V>(/* private fields */)
where
    V: JwsVerifier;

A type validating SdJwts.

Implementations

impl<V> SdJwtCredentialValidator<V>

where V: JwsVerifier,

pub fn new<H>(signature_verifier: V, hasher: H) -> SdJwtCredentialValidator<V>

where H: Hasher + 'static,

Creates a new SdJwtCredentialValidator that delegates cryptographic signature verification to the given signature_verifier and SD-JWT decoding to the given hasher.

pub fn validate_credential<DOC, T>( &self, sd_jwt: &SdJwt, trusted_issuers: &[DOC], options: &JwtCredentialValidationOptions, ) -> Result<Credential<T>, SdJwtCredentialValidatorError>

where T: Clone + Serialize + DeserializeOwned, DOC: AsRef<CoreDocument>,

Decodes and validates a Credential issued as an SD-JWT. The credential is constructed by replacing disclosures following the Selective Disclosure for JWTs (SD-JWT) standard.

The following properties are validated according to options:

• the issuer’s signature on the JWS,
• the expiration date,
• the issuance date,
• the semantic structure.

Warning

• The key binding JWT is not validated. If needed, it must be validated separately using SdJwtCredentialValidator::validate_key_binding_jwt.
• The lack of an error returned from this method is in of itself not enough to conclude that the credential can be trusted. This section contains more information on additional checks that should be carried out before and after calling this method.

The state of the issuer’s DID Document

The caller must ensure that issuer represents an up-to-date DID Document.

Properties that are not validated

There are many properties defined in The Verifiable Credentials Data Model that are not validated, such as: proof, credentialStatus, type, credentialSchema, refreshService and more. These should be manually checked after validation, according to your requirements.

Errors

An error is returned whenever a validated condition is not satisfied.

pub fn validate_credential_v2<DOC, T>( &self, sd_jwt: &SdJwt, trusted_issuers: &[DOC], options: &JwtCredentialValidationOptions, ) -> Result<Credential<T>, SdJwtCredentialValidatorError>

where T: Clone + Serialize + DeserializeOwned, DOC: AsRef<CoreDocument>,

Decodes and validates a CredentialV2 issued as an SD-JWT. The credential is constructed by replacing disclosures following the Selective Disclosure for JWTs (SD-JWT) standard.

The following properties are validated according to options:

• the issuer’s signature on the JWS,
• the expiration date,
• the issuance date,
• the semantic structure.

Warning

• The key binding JWT is not validated. If needed, it must be validated separately using SdJwtCredentialValidator::validate_key_binding_jwt.
• The lack of an error returned from this method is in of itself not enough to conclude that the credential can be trusted. This section contains more information on additional checks that should be carried out before and after calling this method.

The state of the issuer’s DID Document

The caller must ensure that issuer represents an up-to-date DID Document.

Properties that are not validated

There are many properties defined in The Verifiable Credentials Data Model v2 that are not validated, such as: proof, credentialStatus, type, credentialSchema, refreshService and more. These should be manually checked after validation, according to your requirements.

Errors

An error is returned whenever a validated condition is not satisfied.

pub fn verify_signature<DOC>( &self, sd_jwt: &SdJwt, trusted_issuers: &[DOC], options: &JwsVerificationOptions, ) -> Result<(), JwtValidationError>

where DOC: AsRef<CoreDocument>,

Decode and verify the JWS signature of an SD-JWT using the DID Document of a trusted issuer.

Warning

The caller must ensure that the DID Documents of the trusted issuers are up-to-date.

Errors

An error is returned whenever:

• The JWS signature is invalid;
• The issuer’s public key could not be determined or is not found within the trusted issuers’ documents;

pub fn validate_key_binding_jwt<DOC>( &self, sd_jwt: &SdJwt, holder_document: &DOC, options: &KeyBindingJwtValidationOptions, ) -> Result<(), KeyBindingJwtError>

where DOC: AsRef<CoreDocument>,

Validates a Key Binding JWT (KB-JWT) according to RFC9901.

The Validation process includes:

• Signature validation using public key materials defined in the holder document.
• sd_hash claim value in the KB-JWT claim.
• Optional nonce, aud, and validity period validation.

Notes

If a KB-JWT is not required by the SD-JWT, this method returns successfully early.