EU Digital Identity Wallet (EUDIW) Deep Dive

SdJwt.Net.Eudiw/
   Arf/
      ArfCredentialType.cs       # Credential type enumeration
      ArfProfileValidator.cs     # ARF compliance validation
      ArfValidationResult.cs     # Validation result model
   Credentials/
      PidCredentialHandler.cs    # PID processing and validation
      QeaaHandler.cs             # Qualified attestation handling
   RelyingParty/
      RpRegistration.cs          # RP registration model
      RpRegistrationValidator.cs # RP validation logic
   TrustFramework/
      EuTrustListResolver.cs     # EU Trust List integration
      TrustedServiceProvider.cs  # TSP model
      TrustServiceType.cs        # TSP type enumeration
      TrustValidationResult.cs   # Trust validation result
   EudiwConstants.cs             # Constants and definitions

using SdJwt.Net.Eudiw.Arf;

var validator = new ArfProfileValidator();

// Validate cryptographic algorithm
bool isValidAlg = validator.ValidateAlgorithm("ES256"); // true
bool isInvalidAlg = validator.ValidateAlgorithm("RS256"); // false (not ARF-compliant)

// Validate credential type
var result = validator.ValidateCredentialType("eu.europa.ec.eudi.pid.1");
if (result.IsValid)
{
    Console.WriteLine($"Credential type: {result.CredentialType}"); // Pid
}

// Validate EU member state
bool isEu = validator.ValidateMemberState("DE"); // true
bool isNotEu = validator.ValidateMemberState("US"); // false

using SdJwt.Net.Eudiw.Credentials;

var handler = new PidCredentialHandler();

var claims = new Dictionary<string, object>
{
    // Mandatory PID claims
    ["family_name"] = "Mustermann",
    ["given_name"] = "Erika",
    ["birth_date"] = "1964-08-12",
    ["issuance_date"] = "2024-01-01",
    ["expiry_date"] = "2029-01-01",
    ["issuing_authority"] = "Bundesdruckerei",
    ["issuing_country"] = "DE",

    // Optional PID claims
    ["birth_place"] = "Berlin",
    ["nationality"] = "DE",
    ["age_over_18"] = true
};

// Validate claims
var validation = handler.Validate(claims);
if (validation.IsValid)
{
    // Convert to typed model
    var credential = handler.ToPidCredential(claims);
    Console.WriteLine($"{credential.GivenName} {credential.FamilyName}");
    Console.WriteLine($"Issued by: {credential.IssuingAuthority}");
}
else
{
    foreach (var error in validation.Errors)
    {
        Console.WriteLine($"Validation error: {error}");
    }
}

using SdJwt.Net.Eudiw.Credentials;

var handler = new QeaaHandler();

// University diploma as QEAA
var diplomaClaims = new Dictionary<string, object>
{
    ["degree_type"] = "Masters",
    ["field_of_study"] = "Computer Science",
    ["issuing_institution"] = "Technical University of Munich",
    ["graduation_date"] = "2023-07-15",
    ["issuing_country"] = "DE"
};

var validation = handler.Validate(diplomaClaims, QeaaType.EducationalCredential);

using SdJwt.Net.Eudiw.RelyingParty;

var validator = new RpRegistrationValidator();

var registration = new RpRegistration
{
    ClientId = "https://bank.example.de",
    OrganizationName = "Example Bank AG",
    RedirectUris = new[] { "https://bank.example.de/callback" },
    ResponseTypes = new[] { "vp_token" },
    TrustFramework = "eu.eudiw.trust",
    Contacts = new[] { "security@bank.example.de" }
};

var result = validator.Validate(registration);
if (result.IsValid)
{
    Console.WriteLine("RP registration is valid for EUDIW ecosystem");
}
else
{
    foreach (var error in result.Errors)
    {
        Console.WriteLine($"Registration error: {error}");
    }
}

using SdJwt.Net.Eudiw.TrustFramework;

var resolver = new EuTrustListResolver();

// Resolve Trust Service Provider
var tsp = await resolver.ResolveAsync(
    issuerIdentifier: "https://pid.bundesdruckerei.de",
    memberState: "DE"
);

if (tsp != null)
{
    Console.WriteLine($"TSP: {tsp.Name}");
    Console.WriteLine($"Service Type: {tsp.ServiceType}");
    Console.WriteLine($"Status: {tsp.Status}");

    // Validate trust chain
    var trustResult = await resolver.ValidateTrustChainAsync(tsp);
    if (trustResult.IsValid)
    {
        Console.WriteLine("Issuer is trusted under EU Trust Lists");
    }
}

// DocType for mdoc format
const string PidDocType = "eu.europa.ec.eudi.pid.1";

// Namespace for PID claims
const string PidNamespace = "eu.europa.ec.eudi.pid.1";

// DocType for mDL
const string MdlDocType = "org.iso.18013.5.1.mDL";

// EUDIW-specific mDL claims
var mDlClaims = new Dictionary<string, object>
{
    ["family_name"] = "Mustermann",
    ["given_name"] = "Erika",
    ["birth_date"] = "1964-08-12",
    ["document_number"] = "D1234567890",
    ["driving_privileges"] = new[] { "B", "C1" },
    ["issue_date"] = "2024-01-01",
    ["expiry_date"] = "2034-01-01",
    ["issuing_country"] = "DE",
    ["issuing_authority"] = "Kraftfahrt-Bundesamt"
};

// VCT prefix for QEAA
const string QeaaVctPrefix = "eu.europa.ec.eudi.qeaa";

// Example: Professional license as QEAA
var lawyerLicense = new Dictionary<string, object>
{
    ["vct"] = "eu.europa.ec.eudi.qeaa.professional.lawyer.de",
    ["bar_association"] = "Rechtsanwaltskammer Berlin",
    ["license_number"] = "RAK-B-12345",
    ["admission_date"] = "2010-05-15",
    ["specializations"] = new[] { "Corporate Law", "M&A" }
};

// VCT prefix for EAA
const string EaaVctPrefix = "eu.europa.ec.eudi.eaa";

// Example: Gym membership as EAA
var gymMembership = new Dictionary<string, object>
{
    ["vct"] = "eu.europa.ec.eudi.eaa.membership.gym",
    ["membership_id"] = "GYM-2024-001",
    ["valid_from"] = "2024-01-01",
    ["valid_until"] = "2024-12-31",
    ["membership_type"] = "Premium"
};

using SdJwt.Net.Eudiw.Arf;

var validator = new ArfProfileValidator();

// These pass ARF validation
validator.ValidateAlgorithm("ES256"); // true
validator.ValidateAlgorithm("ES384"); // true
validator.ValidateAlgorithm("ES512"); // true

// These fail ARF validation
validator.ValidateAlgorithm("RS256"); // false
validator.ValidateAlgorithm("HS256"); // false
validator.ValidateAlgorithm("EdDSA"); // false (not in ARF yet)

using SdJwt.Net.Eudiw;

// Access all member states
var allStates = EudiwConstants.MemberStates.All;
Console.WriteLine($"Supported states: {string.Join(", ", allStates)}");

LOTL (List of Trusted Lists)
   /--- Member State Trust Lists ---\
   |                                |
   v                                v
 DE Trust List              FR Trust List
   |                          |
   v                          v
TSP 1 (Bundesdruckerei)    TSP 1 (ANTS)
TSP 2 (D-Trust)            TSP 2 (Docaposte)
   ...                        ...

using SdJwt.Net.Eudiw.TrustFramework;

public class EuTrustService
{
    private readonly EuTrustListResolver _resolver;

    public async Task<TrustValidationResult> ValidateIssuerAsync(
        string issuerIdentifier,
        ArfCredentialType expectedType)
    {
        // Resolve TSP from Trust Lists
        var tsp = await _resolver.ResolveAsync(issuerIdentifier);

        if (tsp == null)
        {
            return TrustValidationResult.Failed("Issuer not found in EU Trust Lists");
        }

        // Validate TSP is authorized for credential type
        var authorizedTypes = GetAuthorizedTypes(tsp.ServiceType);
        if (!authorizedTypes.Contains(expectedType))
        {
            return TrustValidationResult.Failed(
                $"TSP not authorized to issue {expectedType} credentials");
        }

        // Validate TSP status
        if (tsp.Status != TspStatus.Granted)
        {
            return TrustValidationResult.Failed($"TSP status: {tsp.Status}");
        }

        // Validate certificate chain
        return await _resolver.ValidateTrustChainAsync(tsp);
    }
}

using SdJwt.Net.Eudiw.Arf;
using SdJwt.Net.Oid4Vp.Verifier;

public class EudiwVerifier
{
    private readonly ArfProfileValidator _arfValidator;
    private readonly VpTokenValidator _vpValidator;

    public async Task<VerificationResult> VerifyEudiwCredential(
        string vpToken,
        string expectedCredentialType)
    {
        // First validate VP token
        var vpResult = await _vpValidator.ValidateAsync(vpToken);
        if (!vpResult.IsValid)
        {
            return VerificationResult.Failed(vpResult.ErrorMessage);
        }

        // Validate ARF algorithm compliance
        if (!_arfValidator.ValidateAlgorithm(vpResult.Algorithm))
        {
            return VerificationResult.Failed("Algorithm not ARF-compliant");
        }

        // Validate credential type
        var typeResult = _arfValidator.ValidateCredentialType(vpResult.CredentialType);
        if (!typeResult.IsValid)
        {
            return VerificationResult.Failed(typeResult.ErrorMessage);
        }

        // Validate issuing country is EU member state
        if (!_arfValidator.ValidateMemberState(vpResult.IssuingCountry))
        {
            return VerificationResult.Failed("Issuer not from EU member state");
        }

        return VerificationResult.Success(vpResult.Credentials);
    }
}

using SdJwt.Net.Eudiw.Arf;
using SdJwt.Net.Mdoc.Verifier;

public class EudiwMdocVerifier
{
    private readonly ArfProfileValidator _arfValidator;
    private readonly MdocVerifier _mdocVerifier;

    public async Task<VerificationResult> VerifyPidAsync(byte[] mdocBytes)
    {
        // Verify mdoc signature
        var mdocResult = await _mdocVerifier.VerifyAsync(mdocBytes);
        if (!mdocResult.IsValid)
        {
            return VerificationResult.Failed(mdocResult.ErrorMessage);
        }

        // Validate DocType is PID
        var typeResult = _arfValidator.ValidateCredentialType(mdocResult.DocType);
        if (!typeResult.IsValid || typeResult.CredentialType != ArfCredentialType.Pid)
        {
            return VerificationResult.Failed("Credential is not a valid PID");
        }

        // Validate PID claims
        var pidResult = _arfValidator.ValidatePidClaims(mdocResult.Claims);
        if (!pidResult.IsValid)
        {
            return VerificationResult.Failed(pidResult.ErrorMessage);
        }

        return VerificationResult.Success(mdocResult.Claims);
    }
}

using SdJwt.Net.Eudiw.Arf;
using SdJwt.Net.HAIP;

public class EudiwHaipValidator
{
    private readonly ArfProfileValidator _arfValidator;
    private readonly HaipCryptoValidator _haipValidator;

    public ValidationResult ValidateSecurityLevel(
        string algorithm,
        string credentialType)
    {
        // ARF validation
        if (!_arfValidator.ValidateAlgorithm(algorithm))
        {
            return ValidationResult.Failed("Algorithm not ARF-compliant");
        }

        // HAIP validation
        var haipResult = _haipValidator.ValidateAlgorithm(
            algorithm,
            HaipSecurityLevel.Level2);

        if (!haipResult.IsValid)
        {
            return ValidationResult.Failed("Algorithm does not meet HAIP Level 2");
        }

        // For PID, require Level 2+
        var typeResult = _arfValidator.ValidateCredentialType(credentialType);
        if (typeResult.CredentialType == ArfCredentialType.Pid)
        {
            var pidHaipResult = _haipValidator.ValidateAlgorithm(
                algorithm,
                HaipSecurityLevel.Level3);

            if (!pidHaipResult.IsValid)
            {
                // Level 2 is acceptable for now, warn about future requirement
                return ValidationResult.Warning(
                    "Level 2 accepted; Level 3 recommended for PID");
            }
        }

        return ValidationResult.Success();
    }
}

using SdJwt.Net.Eudiw;
using SdJwt.Net.Wallet.Core;
using SdJwt.Net.Wallet.Storage;

// Create EUDI wallet with default settings (ARF enforcement enabled)
var store = new InMemoryCredentialStore();
var keyManager = new SoftwareKeyManager();

var wallet = new EudiWallet(store, keyManager);

// EUDI wallets enforce ARF compliance by default
Console.WriteLine(wallet.IsArfEnforced); // true
Console.WriteLine(wallet.MinimumHaipLevel); // 2 (Very High)

var options = new EudiWalletOptions
{
    WalletId = "my-eudi-wallet",
    DisplayName = "My EUDI Wallet",
    EnforceArfCompliance = true,
    MinimumHaipLevel = 2,  // HAIP Level 2 (Very High) minimum
    ValidateIssuerTrust = true,
    SupportedCredentialTypes = new[]
    {
        EudiwConstants.Pid.DocType,
        EudiwConstants.Mdl.DocType,
        "eu.europa.ec.eudi.loyalty.1"
    }
};

var wallet = new EudiWallet(store, keyManager, eudiOptions: options);

// Validate algorithms against ARF/HAIP requirements
wallet.ValidateAlgorithm("ES256"); // true - EUDIW compliant
wallet.ValidateAlgorithm("ES384"); // true - EUDIW compliant
wallet.ValidateAlgorithm("RS256"); // false - not ARF compliant

// Validate credential types
var pidResult = wallet.ValidateCredentialType(EudiwConstants.Pid.DocType);
pidResult.IsValid; // true
pidResult.CredentialType; // ArfCredentialType.Pid

var mdlResult = wallet.ValidateCredentialType(EudiwConstants.Mdl.DocType);
mdlResult.IsValid; // true
mdlResult.CredentialType; // ArfCredentialType.Mdl

var claims = new Dictionary<string, object>
{
    ["family_name"] = "Mustermann",
    ["given_name"] = "Erika",
    ["birth_date"] = "1964-08-12",
    ["issuance_date"] = "2024-01-01",
    ["expiry_date"] = "2029-01-01",
    ["issuing_authority"] = "Bundesdruckerei",
    ["issuing_country"] = "DE"
};

var result = wallet.ValidatePidClaims(claims);
if (result.IsValid)
{
    var pid = wallet.ExtractPidCredential(claims);
    Console.WriteLine($"{pid.GivenName} {pid.FamilyName}");
}

// Validate issuer against EU Trust List
var trustResult = await wallet.ValidateIssuerTrustAsync(
    "https://pid-provider.bundesdruckerei.de");

if (trustResult.IsTrusted)
{
    Console.WriteLine($"Member State: {trustResult.MemberState}"); // "DE"
    Console.WriteLine($"Service Type: {trustResult.ServiceType}");
}

// Check EU member states
wallet.ValidateMemberState("DE"); // true
wallet.ValidateMemberState("FR"); // true
wallet.ValidateMemberState("US"); // false

// Get all supported member states
var memberStates = wallet.GetSupportedMemberStates();
// Returns all 27 EU member state codes

// Find PID credentials
var pidCredentials = await wallet.FindPidCredentialsAsync();

// Find mDL credentials
var mdlCredentials = await wallet.FindMdlCredentialsAsync();

// Credentials are validated against ARF when stored
try
{
    var stored = await wallet.StoreCredentialAsync(parsedCredential);
}
catch (ArfComplianceException ex)
{
    Console.WriteLine($"ARF violations: {string.Join(", ", ex.Violations)}");
}
catch (EudiTrustException ex)
{
    Console.WriteLine($"Trust validation failed: {ex.Message}");
}