vck-openid/at.asitplus.wallet.lib.oidvci/ProofValidator

ProofValidator

class ProofValidator @JvmOverloads constructor(publicContext: String = "https://wallet.a-sit.at/credential-issuer", verifyJwsObject: VerifyJwsObjectFun = VerifyJwsObject(), verifyJwsSignatureWithKey: VerifyJwsSignatureWithKeyFun = VerifyJwsSignatureWithKey(), supportedAlgorithms: Collection<JwsAlgorithm.Signature> = SimpleAuthorizationService.DEFAULT_WALLET_ATTESTATION_ALGORITHMS, clock: Clock = Clock.System, timeLeeway: Duration = 5.minutes, requireKeyAttestation: Boolean = false, clientNonceService: NonceService = DefaultNonceService(), keyAttestationValidator: KeyAttestationValidator = KeyAttestationValidator())(source)

Validates the proofs of possession in credential requests of OID4VCI, see validateProofs.

Implemented from OpenID for Verifiable Credential Issuance 1.0 from 2025-09-16.

Constructors

ProofValidator

@JvmOverloads

constructor(publicContext: String = "https://wallet.a-sit.at/credential-issuer", verifyJwsObject: VerifyJwsObjectFun = VerifyJwsObject(), verifyJwsSignatureWithKey: VerifyJwsSignatureWithKeyFun = VerifyJwsSignatureWithKey(), supportedAlgorithms: Collection<JwsAlgorithm.Signature> = SimpleAuthorizationService.DEFAULT_WALLET_ATTESTATION_ALGORITHMS, clock: Clock = Clock.System, timeLeeway: Duration = 5.minutes, requireKeyAttestation: Boolean = false, clientNonceService: NonceService = DefaultNonceService(), keyAttestationValidator: KeyAttestationValidator = KeyAttestationValidator())

Functions

nonce

suspend fun nonce(): ClientNonceResponse

Provides a fresh nonce to the clients, for incorporating them into the credential proofs.

validateProofExtractSubjectPublicKeys

suspend fun validateProofExtractSubjectPublicKeys(params: CredentialRequestParameters): Collection<CryptoPublicKey>

Validates the proofs in params with validateProofs under the checks they have always been validated with, and returns the keys to bind credentials to, failing with the first rejection of a proof.

validateProofs

suspend fun validateProofs(params: CredentialRequestParameters, policy: ValidationPolicy): ProofsValidation

Validates every proof of possession in params under policy, see JwtProofChecks and KeyAttestationChecks: a jwt proof (OpenID4VCI 1.0, F.1, F.4), with its key attestation as a child, or an attestation proof (F.3). The nonces of all proofs are consumed only if every proof is accepted, so they are not usable again. The clock is read once, all checks use that time.

validProofTypes

fun validProofTypes(): Map<String, CredentialRequestProofSupported>

Valid proof types for SupportedCredentialFormat.supportedProofTypes.