https://github.com/a-sit-plus/vck
Kotlin Multiplatform library implementing W3C VC Data Model, SD-JWT and ISO 18013-5 credentials
https://github.com/a-sit-plus/vck
eudi-wallet iso-18013-5 kotlin kotlin-multiplatform mdl oid4vci oid4vp sd-jwt siopv2 verifiable-credentials wallet
Last synced: 8 days ago
JSON representation
Kotlin Multiplatform library implementing W3C VC Data Model, SD-JWT and ISO 18013-5 credentials
- Host: GitHub
- URL: https://github.com/a-sit-plus/vck
- Owner: a-sit-plus
- License: apache-2.0
- Created: 2023-02-16T14:07:40.000Z (about 2 years ago)
- Default Branch: main
- Last Pushed: 2025-05-05T13:11:36.000Z (9 days ago)
- Last Synced: 2025-05-05T22:05:57.686Z (8 days ago)
- Topics: eudi-wallet, iso-18013-5, kotlin, kotlin-multiplatform, mdl, oid4vci, oid4vp, sd-jwt, siopv2, verifiable-credentials, wallet
- Language: Kotlin
- Homepage: https://a-sit-plus.github.io/vck/
- Size: 4.95 MB
- Stars: 48
- Watchers: 9
- Forks: 3
- Open Issues: 17
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
Awesome Lists containing this project
README
# VC-K – Verifiable Credentials Library for Kotlin Multiplatform
[](https://a-sit-plus.github.io)
[](http://www.apache.org/licenses/LICENSE-2.0)
[](http://kotlinlang.org)
[](http://kotlinlang.org)
[](https://www.oracle.com/java/technologies/downloads/#java17)
[](https://developer.android.com/tools/releases/platforms#11)
[](https://mvnrepository.com/artifact/at.asitplus.wallet/vck)
This library implements verifiable credentials to support several use cases, i.e. issuing of credentials, presentation of credentials and validation thereof. This library may be shared between backend services issuing credentials, wallet apps holding credentials, and verifier apps validating them.
## Architecture
This library was built with [Kotlin Multiplatform](https://kotlinlang.org/docs/multiplatform.html) and [Multiplatform Mobile](https://kotlinlang.org/lp/mobile/) in mind. Its primary targets are JVM, Android and iOS. In order to achieve smooth usage especially under iOS, there have been some notable design decisions:
- Code interfacing with client implementations uses the return type `KmmResult` to transport the `Success` case (i.e. a custom data type) as well as potential errors from native implementations as a `Failure`.
- Native implementations can be plugged in by implementing interfaces, e.g. `PlatformCryptoShim` and `KeyMaterial`, as opposed to callback functions.
- Use of primitive data types for constructor properties instead of e.g. [kotlinx datetime](https://github.com/Kotlin/kotlinx-datetime) types.
- As much code as possible is implemented in the `commonMain` module
Notable features for multiplatform are:
- Use of [Napier](https://github.com/AAkira/Napier) as the logging framework
- Use of [Kotest](https://kotest.io/) for unit tests
- Use of [kotlinx-datetime](https://github.com/Kotlin/kotlinx-datetime) for date and time classes
- Use of [kotlinx-serialization](https://github.com/Kotlin/kotlinx.serialization) for serialization from/to JSON and CBOR
- Implementation of a ZLIB service in Kotlin with native parts, see `ZlibService`
- Implementation of JWS and JWE operations in pure Kotlin (delegating to native crypto), see `JwsService`
- Implementation of COSE operations in pure Kotlin (delegating to native crypto), see `CoseService`
Some parts for increased multiplatform support have been extracted into separate repositories:
- Reimplementation of Kotlin's [Result](https://kotlinlang.org/api/latest/jvm/stdlib/kotlin/-result/) called [KmmResult](https://github.com/a-sit-plus/kmmresult) for easy use from Swift code (since inline classes are [not supported](https://kotlinlang.org/docs/native-objc-interop.html#unsupported)).
- Several crypto datatypes (including an ASN.1 parser and encoder), as well as a mulitplatform crypto library, called [Signum](https://github.com/a-sit-plus/signum).
The main entry point for applications is an instance of `HolderAgent`, `VerifierAgent` or `IssuerAgent`, according to the nomenclature from the [W3C VC Data Model](https://w3c.github.io/vc-data-model/).
Many classes define several constructor parameters, some of them with default values, to enable a simple form of dependency injection. Implementers are advised to specify the parameter names of arguments passed to increase readability and prepare for future extensions.
## Features
Credentials may be represented as plain JWTs in the [W3C VC Data Model](https://w3c.github.io/vc-data-model/), as ISO mDoc credentials according to [ISO/IEC 18013-5:2021](https://www.iso.org/standard/69084.html), or simply as a list of claims and values for [SD-JWT](https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/).
For SD-JWT, we're implementing [SD-JWT VC](https://www.ietf.org/archive/id/draft-ietf-oauth-sd-jwt-vc-08.html), including features like key binding JWT, and JWT VC issuer metadata. Not supported are SD-JWT VC type metadata, document integrity, display metadata and claim metadata. We're also following [SD-JWT](https://www.ietf.org/archive/id/draft-ietf-oauth-selective-disclosure-jwt-15.html), including features like key binding JWT and nested structures.
When using the plain JWT representation, the single credential itself is an instance of `CredentialSubject`. For ISO mDoc claims see `IssuerSignedItems` and related classes like `Document` and `MobileSecurityObject`. For SD-JWT claims see `SelectiveDisclosureItem` and `SdJwtSigned`.
Other libraries implementing credential schemes may call `LibraryInitializer.registerExtensionLibrary()` to register with this library. See our implementation of the [EU PID credential](https://github.com/a-sit-plus/eu-pid-credential) and our implementation of the [Mobile Driving Licence](https://github.com/a-sit-plus/mobile-driving-licence-credential/) for examples. We also maintain a comprehensive list of [all credentials powered by this library](https://github.com/a-sit-plus/credentials-collection).
For the OpenID protocol family, issuing is implemented using [OpenID for Verifiable Credential Issuance](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html), see `WalletService` and `CredentialIssuer`. This library supports several features of the OpenID4VCI draft 15: Pre-authorized code grants, authorization code flow, selecting credentials with authorization details and scopes, pushed authorization requests. Not supported are the deferred credential endpoint and the notification endpoint.
Presentation of credentials is implemented using [Self-Issued OpenID Provider v2](https://openid.net/specs/openid-connect-self-issued-v2-1_0.html), supporting [OpenID for Verifiable Presentations](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html), see `OpenId4VpVerifier` and `OpenId4VpHolder`. This library supports several features of the OpenID4VP draft 23: Same device and cross device flows, response mode `direct_post` and `direct_post.jwt`, request objects by value or reference, presentation definitions and submissions, verifier attestations, signed and/or encrypted responses, client identifier schemes embedded in the client identifier. Not supported are the Digital Credential Query Language, using scopes for referencing presentation definitions, client identifier schemes OpenID Federation and DID.
## Usage
VC-K uses a modular structure to separate concerns. Hence, depending on the use cases you want to cover, you will need different artefacts:
| Artefact | Info |
|:---------------------:|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `vck` | VC-K base functionality. Contains business logic for creating, issuing, presenting, and verifying credentials. |
| `vck-openid` | OpenID protocol implementation, including OpenID4VCI. Contains client and server authentication business logic and the actual issuing protocol. |
| `vck-openid-ktor` | Contains ktor-based OpenID4VCI client and OpenID4VP wallet implementations. **please call `Initializer.initOpenIdModule()` at the start of your project!** |
| `vck-rqes` | RQES implementation; depends on `vck-openid` **Please call `Initializer.initRqesModule()` at the start of your project. This initializer fully overrides `Initializer.initOpenIdModule()` which does not need to be called if `vck-rqes` is used.** |
| `dif-data-classes` | [DIF Presentation Exchange v1.0.0](https://identity.foundation/presentation-exchange/spec/v1.0.0/#presentation-definition) data classes. **Does not depend on any other vck artefact** and can hence be used independently of VC-K! |
| `openid-data-classes` | OpenID data classes. **Only depends on `dif-data-classes`** and can hence be used independently of VC-K! |
| `rqes-data-classes` | RQES data classes. **Only depends on `dif-data-classes` and `openid-data-classes`** and can hence be used independently of VC-K! |
Simply declare the desired dependency to get going. This will usually be one of:
```kotlin
implementation("at.asitplus.wallet:vck:$version")
```
```kotlin
implementation("at.asitplus.wallet:vck-openid:$version")
```
```kotlin
implementation("at.asitplus.wallet:vck-rqes:$version")
```
Everything else (serialization, crypto through Signum, …) will be taken care of.
Therefore, **do not** manually add serialization dependencies! In case you are using this project in a codebase with dependencies on `kotlinx-serialization`, plese use the `vck-versionCatalog` artefact to keep versions in sync.
If you
As discovered in [#226](https://github.com/a-sit-plus/vck/issues/226), using the deprecated `io.spring.dependency-management` will cause issues.
The actual credentials are provided as discrete artefacts and are maintained separately [over here](https://github.com/a-sit-plus/credentials-collection).
It is fine to add credentials **and** VC-K to as project dependencies, e. g., to use a version of VC-K that is more recent than the one a certain credentials depends on.
## Limitations
- Several parts of the W3C VC Data Model have not been fully implemented, i.e. everything around resolving cryptographic key material.
- Anything related to ledgers (e.g. resolving DID documents) is out of scope.
- JSON-LD is not supported for W3C credentials.
- Trust relationships are mostly up to clients using this library.
- The `PlatformCryptoShim` for iOS should not be used in production as it does not implement encryption, decryption, key agreement and message digests correctly. Track the progress for [Signum milestone 1](https://github.com/a-sit-plus/signum/milestone/1) for an update on this issue.
## Dataflow for OID4VCI
We'll present an issuing process according to [OID4VCI](https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0.html), along with [OID4VP](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html), with all terms taken from there.
The credential issuer serves the following metadata:
```json
{
"issuer": "https://wallet.a-sit.at/credential-issuer",
"credential_issuer": "https://wallet.a-sit.at/credential-issuer",
"authorization_servers": [
"https://wallet.a-sit.at/authorization-server"
],
"credential_endpoint": "https://wallet.a-sit.at/credential-issuer/credential",
"batch_credential_issuance": {
"batch_size": 1
},
"credential_configurations_supported": {
"at.a-sit.wallet.atomic-attribute-2023": {
"format": "mso_mdoc",
"scope": "at.a-sit.wallet.atomic-attribute-2023",
"cryptographic_binding_methods_supported": [
"jwk",
"cose_key"
],
"credential_signing_alg_values_supported": [
"ES256"
],
"doctype": "at.a-sit.wallet.atomic-attribute-2023.iso",
"claims": {
"at.a-sit.wallet.atomic-attribute-2023": {
"given_name": {},
"family_name": {},
"date_of_birth": {},
"portrait": {}
}
}
},
"AtomicAttribute2023#jwt_vc_json": {
"format": "jwt_vc_json",
"scope": "AtomicAttribute2023",
"cryptographic_binding_methods_supported": [
"jwk",
"urn:ietf:params:oauth:jwk-thumbprint"
],
"credential_signing_alg_values_supported": [
"ES256"
],
"credential_definition": {
"type": [
"VerifiableCredential",
"AtomicAttribute2023"
],
"credentialSubject": {
"given_name": {},
"family_name": {},
"date_of_birth": {},
"portrait": {}
}
}
},
"AtomicAttribute2023#vc+sd-jwt": {
"format": "vc+sd-jwt",
"scope": "AtomicAttribute2023",
"cryptographic_binding_methods_supported": [
"jwk",
"urn:ietf:params:oauth:jwk-thumbprint"
],
"credential_signing_alg_values_supported": [
"ES256"
],
"vct": "AtomicAttribute2023",
"claims": {
"given_name": {},
"family_name": {},
"date_of_birth": {},
"portrait": {}
}
},
"org.iso.18013.5.1": {
"format": "mso_mdoc",
"scope": "org.iso.18013.5.1",
"cryptographic_binding_methods_supported": [
"jwk",
"cose_key"
],
"credential_signing_alg_values_supported": [
"ES256"
],
"doctype": "org.iso.18013.5.1.mDL",
"claims": {
"org.iso.18013.5.1": {
"family_name": {},
"given_name": {},
"birth_date": {},
"issue_date": {},
"expiry_date": {},
"issuing_country": {},
"issuing_authority": {},
"document_number": {},
"portrait": {},
"driving_privileges": {},
"un_distinguishing_sign": {},
"administrative_number": {},
"sex": {},
"height": {},
"weight": {},
"eye_colour": {},
"hair_colour": {},
"birth_place": {},
"resident_address": {},
"portrait_capture_date": {},
"age_in_years": {},
"age_birth_year": {},
"age_over_18": {},
"issuing_jurisdiction": {},
"nationality": {},
"resident_city": {},
"resident_state": {},
"resident_postal_code": {},
"resident_country": {},
"family_name_national_character": {},
"given_name_national_character": {},
"signature_usual_mark": {}
}
}
}
}
}
```
The credential issuer starts with a credential offer:
```json
{
"credential_issuer": "https://wallet.a-sit.at/credential-issuer",
"credential_configuration_ids": [
"at.a-sit.wallet.atomic-attribute-2023",
"AtomicAttribute2023#jwt_vc_json",
"AtomicAttribute2023#vc+sd-jwt",
"org.iso.18013.5.1"
],
"grants": {
"urn:ietf:params:oauth:grant-type:pre-authorized_code": {
"pre-authorized_code": "fe8cee09-1b9a-4be4-90f4-3c77c44c37a6",
"authorization_server": "https://wallet.a-sit.at/authorization-server"
}
}
}
```
Since the issuer provides a pre-authorized code, the wallet uses this for the token request:
```json
{
"grant_type": "urn:ietf:params:oauth:grant-type:pre-authorized_code",
"redirect_uri": "https://wallet.a-sit.at/app/callback",
"client_id": "https://wallet.a-sit.at/app",
"authorization_details": [
{
"type": "openid_credential",
"credential_configuration_id": "AtomicAttribute2023#vc+sd-jwt",
"locations": [
"https://wallet.a-sit.at/authorization-server"
],
"credential_identifiers": [
"AtomicAttribute2023#vc+sd-jwt"
]
}
],
"pre-authorized_code": "fe8cee09-1b9a-4be4-90f4-3c77c44c37a6"
}
```
The credential issuer answers with an access token:
```json
{
"access_token": "8c41ad84-01ec-4300-9627-d210d1c0800e",
"token_type": "bearer",
"expires_in": 3600,
"c_nonce": "cf0875c8-afec-4890-aba1-b87aa0bfd4ce",
"authorization_details": [
{
"type": "openid_credential",
"credential_configuration_id": "AtomicAttribute2023#vc+sd-jwt",
"locations": [
"https://wallet.a-sit.at/authorization-server"
],
"credential_identifiers": [
"AtomicAttribute2023#vc+sd-jwt"
]
}
]
}
```
The wallet creates a credential request, including a proof-of-possession of its private key:
```json
{
"credential_identifier": "AtomicAttribute2023#vc+sd-jwt",
"proof": {
"proof_type": "jwt",
"jwt": "eyJ0eXAiOiJvcGVuaWQ0dmNpLXByb29mK2p3dCIsImFsZyI6IkVTMjU2IiwiandrIjp7ImNydiI6IlAtMjU2Iiwia2lkIjoiZGlkOmtleTp6RG5hZVlUN3BwWDRGeVM1Z3ZvcXJmQ2lMNmdMYm92bjVKQzRZelh4dUEydXBvcGtmIiwia3R5IjoiRUMiLCJ4IjoiZHlrQXRvMmhVcG85MzllX0IzaHRjQ0hDY1Y4c3Y1TkRfRDhZX0EtdlQtQSIsInkiOiJXc1pIazZ4N090bXI3WE5YNk9GT3lCdkpOYUxYX0RBVTFZemFMWnZNb3NnIn19.eyJpc3MiOiJodHRwczovL3dhbGxldC5hLXNpdC5hdC9hcHAiLCJhdWQiOiJodHRwczovL3dhbGxldC5hLXNpdC5hdC9jcmVkZW50aWFsLWlzc3VlciIsIm5vbmNlIjoiY2YwODc1YzgtYWZlYy00ODkwLWFiYTEtYjg3YWEwYmZkNGNlIiwiaWF0IjoxNzMzODIxNzQ0fQ.vSmPOkdtaAPHfpYocNG1af45SZvEpvhN9kKVKJ2-5TS_0dnn0ap7_91pJq_WlKGxhf5UF1T1j9TKITV8zEpb1Q"
}
}
```
The JWT included decodes to the following:
```json
{
"typ": "openid4vci-proof+jwt",
"alg": "ES256",
"jwk": {
"crv": "P-256",
"kid": "did:key:zDnaeYT7ppX4FyS5gvoqrfCiL6gLbovn5JC4YzXxuA2upopkf",
"kty": "EC",
"x": "dykAto2hUpo939e_B3htcCHCcV8sv5ND_D8Y_A-vT-A",
"y": "WsZHk6x7Otmr7XNX6OFOyBvJNaLX_DAU1YzaLZvMosg"
}
}
```
and
```json
{
"iss": "https://wallet.a-sit.at/app",
"aud": "https://wallet.a-sit.at/credential-issuer",
"nonce": "cf0875c8-afec-4890-aba1-b87aa0bfd4ce",
"iat": 1733821744
}
```
The credential issuer issues the following credential:
```json
{
"format": "vc+sd-jwt",
"credential": "eyJraWQiOiJkaWQ6a2V5OnpEbmFlZHBaWjlwM3ZXQ2VBZlA2OU5EcGVoU2VuNGNTVWFCZDNHQlh6TUs3RnZ3UkIiLCJ0eXAiOiJ2YytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJzdWIiOiJkaWQ6a2V5OnpEbmFlWVQ3cHBYNEZ5UzVndm9xcmZDaUw2Z0xib3ZuNUpDNFl6WHh1QTJ1cG9wa2YiLCJuYmYiOjE3MzM4MjE3NDQsImlzcyI6ImRpZDprZXk6ekRuYWVkcFpaOXAzdldDZUFmUDY5TkRwZWhTZW40Y1NVYUJkM0dCWHpNSzdGdndSQiIsImV4cCI6MTczMzgyMTgwNCwiaWF0IjoxNzMzODIxNzQ0LCJqdGkiOiJ1cm46dXVpZDowYzE4MGQ5Zi0wNzJkLTQyMGUtYmE1ZC00ZDllMGQxY2ViMWUiLCJ2Y3QiOiJBdG9taWNBdHRyaWJ1dGUyMDIzIiwic3RhdHVzIjp7ImlkIjoiaHR0cHM6Ly93YWxsZXQuYS1zaXQuYXQvYmFja2VuZC9jcmVkZW50aWFscy9zdGF0dXMvMSMxIiwidHlwZSI6IlJldm9jYXRpb25MaXN0MjAyMFN0YXR1cyIsInJldm9jYXRpb25MaXN0SW5kZXgiOjEsInJldm9jYXRpb25MaXN0Q3JlZGVudGlhbCI6Imh0dHBzOi8vd2FsbGV0LmEtc2l0LmF0L2JhY2tlbmQvY3JlZGVudGlhbHMvc3RhdHVzLzEifSwiX3NkX2FsZyI6InNoYS0yNTYiLCJjbmYiOnsiandrIjp7ImNydiI6IlAtMjU2Iiwia2lkIjoiZGlkOmtleTp6RG5hZVlUN3BwWDRGeVM1Z3ZvcXJmQ2lMNmdMYm92bjVKQzRZelh4dUEydXBvcGtmIiwia3R5IjoiRUMiLCJ4IjoiZHlrQXRvMmhVcG85MzllX0IzaHRjQ0hDY1Y4c3Y1TkRfRDhZX0EtdlQtQSIsInkiOiJXc1pIazZ4N090bXI3WE5YNk9GT3lCdkpOYUxYX0RBVTFZemFMWnZNb3NnIn19LCJfc2QiOlsiM29aamN4Yy1XTi1idDF0aUJTamx3clJBbUY0OGpSMTNfeFUyandLWU9HTSIsIlNBcEhtRjJUN3lLazYwamxTbkFvbFdhMEZpYnljLWZwdkNWRlBJN0NPNDAiLCJIUFpyaHpTQno1U2ZtbmxCeml5QzNXX3JmRXFobkh3YTNwQ21GYzc3U19zIiwidXl6YXBxcDdNWkZFY1pVX3lqYnJRcW5mcUhUT1pudjM2MG1XRUh3ajM0TSJdfQ.KhdVWwIJAPoxm8vxQ4Fbq9_DC_szV2aLziDFe5Opns0H2bHgT4WAkR4yPf1cs1mJV7DEgJcMqAw1ABXTeaEpvw~WyJwQ0xUeXd0NTRnOFlSWGMwWkZuZlRYU05xSGR3YkpUZm1KM3l0SmJfTmYwIiwiZ2l2ZW5fbmFtZSIsIlN1c2FubmUiXQ~WyJXemdkNmI0QWg4WGdzcExKM1IxNzJrczV1Qi1la3NiajNXRk5RcE52SjBBIiwiZmFtaWx5X25hbWUiLCJNZWllciJd~WyJ4Q3hpcWZUUzNXNkUtbW15UVEwbVFmbVRBYjdPRjV6aW13UVZ1Zi0wN3cwIiwiZGF0ZV9vZl9iaXJ0aCIsIjE5OTAtMDEtMDEiXQ~WyJkQWN0Y05MVlFyVVpnN2tMeGJEYkVRdF9jS09mRVVKZ3EyZjBzVlZiNEQwIiwicG9ydHJhaXQiLCJQR3JvT2dFcnROYU84RnVubm54amJ3Q3dic1NwanZhNDZyd3VqdVA4dGxnQVl2YjhHLXF0RG9oVHl2Qjd1NkVqZENXN0ltYlhVWFJFbzkzWTBZZjUzZyJd~"
}
```
The SD-JWT included decodes to the following:
```json
{
"sub": "did:key:zDnaeYT7ppX4FyS5gvoqrfCiL6gLbovn5JC4YzXxuA2upopkf",
"nbf": 1733821744,
"iss": "did:key:zDnaedpZZ9p3vWCeAfP69NDpehSen4cSUaBd3GBXzMK7FvwRB",
"exp": 1733821804,
"iat": 1733821744,
"jti": "urn:uuid:0c180d9f-072d-420e-ba5d-4d9e0d1ceb1e",
"vct": "AtomicAttribute2023",
"status": {
"id": "https://wallet.a-sit.at/backend/credentials/status/1#1",
"type": "RevocationList2020Status",
"revocationListIndex": 1,
"revocationListCredential": "https://wallet.a-sit.at/backend/credentials/status/1"
},
"_sd_alg": "sha-256",
"cnf": {
"jwk": {
"crv": "P-256",
"kid": "did:key:zDnaeYT7ppX4FyS5gvoqrfCiL6gLbovn5JC4YzXxuA2upopkf",
"kty": "EC",
"x": "dykAto2hUpo939e_B3htcCHCcV8sv5ND_D8Y_A-vT-A",
"y": "WsZHk6x7Otmr7XNX6OFOyBvJNaLX_DAU1YzaLZvMosg"
}
},
"_sd": [
"3oZjcxc-WN-bt1tiBSjlwrRAmF48jR13_xU2jwKYOGM",
"SApHmF2T7yKk60jlSnAolWa0Fibyc-fpvCVFPI7CO40",
"HPZrhzSBz5SfmnlBziyC3W_rfEqhnHwa3pCmFc77S_s",
"uyzapqp7MZFEcZU_yjbrQqnfqHTOZnv360mWEHwj34M"
]
}
```
with the following claims appended:
```json
["pCLTywt54g8YRXc0ZFnfTXSNqHdwbJTfmJ3ytJb_Nf0","given_name","Susanne"]
```
```json
["Wzgd6b4Ah8XgspLJ3R172ks5uB-eksbj3WFNQpNvJ0A","family_name","Meier"]
```
```json
["xCxiqfTS3W6E-mmyQQ0mQfmTAb7OF5zimwQVuf-07w0","date_of_birth","1990-01-01"]
```
## Dataflow for OpenID4VP
We'll present a presentation process according to [OID4VP](https://openid.net/specs/openid-4-verifiable-presentations-1_0.html), with all terms taken from there.
The verifier creates a URL to be displayed to the wallet, containing a reference to the authentication request itself:
```
https://example.com/wallet/9ecf4d9d-e0a7-488c-960f-448299bfc004
?client_id=https%3A%2F%2Fexample.com%2Frp%2F2cb7cb49-305e-4e7a-a235-d3fc2f426db3
&request_uri=https%3A%2F%2Fwww.example.com%2Frequest%2Fd4a5305d-1ade-40c0-8db4-d8ec458b0750
```
The authentication request is signed as a JWS and contains the following header and payload:
```json
{
"kid": "did:key:zDnaeY1pcEbr4eV4oDgYbbHKERhUdRsh6UJ7114rvkmBve9ps",
"typ": "oauth-authz-req+jwt",
"alg": "ES256",
"jwk": {
"crv": "P-256",
"kid": "did:key:zDnaeY1pcEbr4eV4oDgYbbHKERhUdRsh6UJ7114rvkmBve9ps",
"kty": "EC",
"x": "cK4D5_nqSbOut9t80PpEn1evjm39TxvlyAWZTGH72dA",
"y": "L91dVJYKkfhIe6VTXxtoIxqYNKyuSKeiTTZ5Rde4owI"
}
}
```
```json
{
"response_type": "vp_token",
"client_id": "https://example.com/rp/f924b863-10e0-4740-8bea-7026742c734c",
"scope": "openid profile AtomicAttribute2023 AtomicAttribute2023 at.a-sit.wallet.atomic-attribute-2023",
"state": "2add0b20-feaf-43e2-a368-92748e7b0860",
"nonce": "776acc4f-1606-4112-b799-69c74064499e",
"client_metadata": {
"redirect_uris": [
"https://example.com/rp/f924b863-10e0-4740-8bea-7026742c734c"
],
"jwks": {
"keys": [
{
"crv": "P-256",
"kty": "EC",
"x": "cK4D5_nqSbOut9t80PpEn1evjm39TxvlyAWZTGH72dA",
"y": "L91dVJYKkfhIe6VTXxtoIxqYNKyuSKeiTTZ5Rde4owI"
}
]
},
"subject_syntax_types_supported": [
"urn:ietf:params:oauth:jwk-thumbprint",
"did:key",
"jwk"
],
"vp_formats": {
"jwt_vp": {
"alg": [
"ES256"
]
},
"vc+sd-jwt": {
"alg": [
"ES256"
]
},
"mso_mdoc": {
"alg": [
"ES256"
]
}
}
},
"id_token_type": "subject_signed_id_token",
"presentation_definition": {
"id": "cc94b105-48c1-41a4-b6c1-40043ed65a96",
"input_descriptors": [
{
"type": "at.asitplus.dif.DifInputDescriptor",
"id": "a8cb5330-b9da-4ed7-9f5c-d9a388834257",
"format": {
"vc+sd-jwt": {
"alg": [
"ES256"
]
}
},
"constraints": {
"fields": [
{
"optional": false,
"path": [
"$[\"given_name\"]"
]
},
{
"optional": false,
"path": [
"$[\"family_name\"]"
]
},
{
"path": [
"$.vct"
],
"filter": {
"type": "string",
"pattern": "AtomicAttribute2023"
}
}
]
}
}
]
},
"client_id_scheme": "redirect_uri",
"response_mode": "direct_post",
"response_uri": "https://example.com/rp/response/830f5637-4885-43fe-a2c3-f155a8a073ac",
"aud": "https://self-issued.me/v2",
"iss": "https://self-issued.me/v2"
}
}
```
The wallet sends back the response as a POST to `https://example.com/rp/response/830f5637-4885-43fe-a2c3-f155a8a073ac` with the parameters `presentation_submission`, `vp_token` and `state` set.
The value for the presentation submission is:
```json
{
"id": "6d30b07d-d589-4bef-85e0-4feef73e012b",
"definition_id": "cc94b105-48c1-41a4-b6c1-40043ed65a96",
"descriptor_map": [
{
"id": "a8cb5330-b9da-4ed7-9f5c-d9a388834257",
"format": "vc+sd-jwt",
"path": "$"
}
]
}
```
The value for the VP token is an SD-JWT, with header and payload:
```json
{
"kid": "did:key:zDnaemxTpFAmVZVdKvraBmLd2aDUqrmYRKJcDQnD8Zg7B2rKu",
"typ": "vc+sd-jwt",
"alg": "ES256"
}
```
```json
{
"sub": "did:key:zDnaeqVE5wWY9jD862tRpMu4DFpR4vfzBQihTCwZ8bZRP3Jdn",
"nbf": 1733823057,
"iss": "did:key:zDnaemxTpFAmVZVdKvraBmLd2aDUqrmYRKJcDQnD8Zg7B2rKu",
"exp": 1733823117,
"iat": 1733823057,
"jti": "urn:uuid:4b51b38b-9604-4e7e-8775-2b794184b5df",
"vct": "AtomicAttribute2023",
"status": {
"id": "https://wallet.a-sit.at/backend/credentials/status/1#1",
"type": "RevocationList2020Status",
"revocationListIndex": 1,
"revocationListCredential": "https://wallet.a-sit.at/backend/credentials/status/1"
},
"_sd_alg": "sha-256",
"cnf": {
"jwk": {
"crv": "P-256",
"kty": "EC",
"x": "dEnr0EF1Bh7G4r_dFSuCrAvyqaeMXd9D6WVu-yDBhmk",
"y": "j3y-WVyrs5XIePFQ_PVQjDuQxp4TGV1F4EyrJlz8LMc"
}
},
"_sd": [
"VOfQfO9t-aUWwtcU498-SMJ0rzZpZdHObmzHuYZ7Eeg",
"1ehcufQBrCsqdSIR6ZH7X5JDt63Ygk7NJYM66gjzeAw",
"wyuZnInA1l1Tqsz44D8MUOfB7gWhJZkja_bMoyuoX9Q",
"L5Hnmjie5TH4MvTCDIiQkX47YsKszi4AP75iuku8AY8"
]
}
```
With the following claims appended:
```json
["1jvI5VgkgvP8zTr7wCCjKoFhAuyM5YdTP8EQUSrGSwk","given_name","Susanne"]
```
```json
["RPEnzDNDIVcCBK0GsLgbM7JAU-zjE5xozTHnAZxcCdY","family_name","Meier"]
```
As well as a key binding (the JWT is decoded):
```json
{
"typ": "kb+jwt",
"alg": "ES256",
"jwk": {
"crv": "P-256",
"kid": "did:key:zDnaeqVE5wWY9jD862tRpMu4DFpR4vfzBQihTCwZ8bZRP3Jdn",
"kty": "EC",
"x": "dEnr0EF1Bh7G4r_dFSuCrAvyqaeMXd9D6WVu-yDBhmk",
"y": "j3y-WVyrs5XIePFQ_PVQjDuQxp4TGV1F4EyrJlz8LMc"
}
}
```
```json
{
"iat": 1733823057,
"aud": "https://example.com/rp/f924b863-10e0-4740-8bea-7026742c734c",
"nonce": "776acc4f-1606-4112-b799-69c74064499e",
"sd_hash": "ruXlGvBJ1rR0OHCyCPEuRkuxlQ6CcCe6KEdH-tw8DPU"
}
```
## Contributing
External contributions are greatly appreciated! Be sure to observe the contribution guidelines (see [CONTRIBUTING.md](CONTRIBUTING.md)).
In particular, external contributions to this project are subject to the A-SIT Plus Contributor License Agreement (see also [CONTRIBUTING.md](CONTRIBUTING.md)).
## Contributing
External contributions are greatly appreciated! Be sure to observe the contribution guidelines (see [CONTRIBUTING.md](CONTRIBUTING.md)).
In particular, external contributions to this project are subject to the A-SIT Plus Contributor License Agreement (see also [CONTRIBUTING.md](CONTRIBUTING.md)).
---
| 
| This project has received funding from the European Union’s Horizon 2020 research and innovation programme under grant agreement No 959072. |
|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|:--------------------------------------------------------------------------------------------------------------------------------------------|
---
| 
Co‑Funded by the
European Union | This project has received funding from the European Union’s Digital Europe Programme (DIGITAL), Project 101102655 — POTENTIAL. |
|:------------------------------------------------------------------------------:|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
---
The Apache License does not apply to the logos, (including the A-SIT logo) and the project/module name(s), as these are the sole property of
A-SIT/A-SIT Plus GmbH and may not be used in derivative works without explicit permission!