OID4VCI Deep Dive

{
  "credential_issuer": "https://university.example.edu",
  "credential_configuration_ids": ["UniversityDegree_SDJWT"],
  "grants": {
    "urn:ietf:params:oauth:grant-type:pre-authorized_code": {
      "pre-authorized_code": "SplxlOBeZQQYbYS6WxSbIA",
      "tx_code": {
        "input_mode": "numeric",
        "length": 6,
        "description": "Enter the PIN sent to your email"
      }
    }
  }
}

{
  "typ": "openid4vci-proof+jwt",
  "alg": "ES256",
  "jwk": {
    "kty": "EC",
    "crv": "P-256",
    "x": "...",
    "y": "..."
  }
}

{
  "iss": "did:example:holder123",
  "aud": "https://university.example.edu",
  "nonce": "tZignsnFbp",
  "iat": 1701234567
}

using SdJwt.Net.Oid4Vci.Models;
using Microsoft.IdentityModel.Tokens;
using System.IdentityModel.Tokens.Jwt;

// 1. Parse the credential offer
var offer = JsonSerializer.Deserialize<CredentialOffer>(offerJson);

// 2. Exchange pre-authorized code for access token
var tokenResponse = await ExchangePreAuthCodeAsync(
    offer.CredentialIssuer,
    preAuthorizedCode: offer.GetPreAuthorizedCodeGrant()?.PreAuthorizedCode,
    txCode: userEnteredPin
);

// 3. Create proof JWT
var proofJwt = CreateProofJwt(
    holderPrivateKey,
    audience: offer.CredentialIssuer,
    nonce: tokenResponse.CNonce
);

// 4. Build credential request
var request = new CredentialRequest
{
    Format = Oid4VciConstants.SdJwtVcFormat,  // "dc+sd-jwt"
    Vct = "https://credentials.university.example.edu/degree",
    Proof = new CredentialProof
    {
        ProofType = Oid4VciConstants.ProofTypes.Jwt,
        Jwt = proofJwt
    }
};

// 5. Send request
var credential = await RequestCredentialAsync(
    credentialEndpoint: $"{offer.CredentialIssuer}/credential",
    accessToken: tokenResponse.AccessToken,
    request: request
);

private string CreateProofJwt(
    SecurityKey holderKey,
    string audience,
    string nonce)
{
    var holderJwk = JsonWebKeyConverter.ConvertFromSecurityKey(holderKey);

    var header = new JwtHeader(
        new SigningCredentials(holderKey, SecurityAlgorithms.EcdsaSha256))
    {
        ["typ"] = "openid4vci-proof+jwt",
        ["jwk"] = new Dictionary<string, object>
        {
            ["kty"] = holderJwk.Kty,
            ["crv"] = holderJwk.Crv,
            ["x"] = holderJwk.X,
            ["y"] = holderJwk.Y
        }
    };

    var payload = new JwtPayload
    {
        { "aud", audience },
        { "nonce", nonce },
        { "iat", DateTimeOffset.UtcNow.ToUnixTimeSeconds() }
    };

    var token = new JwtSecurityToken(header, payload);
    return new JwtSecurityTokenHandler().WriteToken(token);
}

using SdJwt.Net.Oid4Vci.Issuer;
using SdJwt.Net.Vc.Issuer;
using SdJwt.Net.Vc.Models;

// 1. Validate the proof JWT
var proofValidator = new CNonceValidator(
    validNonces: nonceStore,
    expectedAudience: "https://university.example.edu"
);

var proofResult = await proofValidator.ValidateAsync(
    request.Proof.Jwt,
    freshnessWindow: TimeSpan.FromMinutes(5)
);

if (!proofResult.IsValid)
{
    return BadRequest(new { error = "invalid_proof" });
}

// 2. Extract holder's public key from proof
var holderPublicKey = proofResult.HolderKey;

// 3. Build the credential payload
var payload = new SdJwtVcPayload
{
    Issuer = "https://university.example.edu",
    Subject = "did:example:student123",
    IssuedAt = DateTimeOffset.UtcNow.ToUnixTimeSeconds(),
    ExpiresAt = DateTimeOffset.UtcNow.AddYears(10).ToUnixTimeSeconds(),
    AdditionalData = new Dictionary<string, object>
    {
        ["student_name"] = "Alice Smith",
        ["degree"] = "Bachelor of Science",
        ["major"] = "Computer Science",
        ["graduation_date"] = "2024-05-15",
        ["gpa"] = 3.85
    }
};

// 4. Issue with selective disclosure options
var vcIssuer = new SdJwtVcIssuer(issuerSigningKey, SecurityAlgorithms.EcdsaSha256);

var options = new SdIssuanceOptions
{
    DisclosureStructure = new
    {
        student_name = true,    // Selectively disclosable
        degree = false,         // Always visible
        major = true,           // Selectively disclosable
        graduation_date = false,// Always visible
        gpa = true              // Selectively disclosable
    }
};

var result = vcIssuer.Issue(
    vct: "https://credentials.university.example.edu/degree",
    payload: payload,
    options: options,
    holderPublicKey: holderPublicKey
);

// 5. Return credential response
return Ok(new CredentialResponse
{
    Format = Oid4VciConstants.SdJwtVcFormat,
    Credential = result.Issuance,
    CNonce = GenerateNewNonce(),
    CNonceExpiresIn = 300
});

{
  "acceptance_token": "eyJhbG....",
  "c_nonce": "fGFF7UkhLA"
}

// Poll for credential
var deferredResponse = await PollDeferredCredentialAsync(
    deferredEndpoint: $"{issuer}/deferred-credential",
    accessToken: tokenResponse.AccessToken,
    acceptanceToken: initialResponse.AcceptanceToken
);

if (deferredResponse.Credential != null)
{
    // Credential is ready
    await StoreCredential(deferredResponse.Credential);
}
else
{
    // Still processing - retry later
    await Task.Delay(TimeSpan.FromSeconds(deferredResponse.Interval ?? 5));
}

// Track nonce usage
if (await nonceStore.IsUsedAsync(proof.Nonce))
{
    return BadRequest(new { error = "invalid_proof", error_description = "nonce already used" });
}
await nonceStore.MarkUsedAsync(proof.Nonce);

// WRONG
if (proof.Nonce == expectedNonce) { /* proceed */ }

// RIGHT
if (proof.Nonce == expectedNonce && proof.Aud == "https://my-issuer.example.com") { /* proceed */ }

// Validate tx_code if required
var grant = offer.GetPreAuthorizedCodeGrant();
if (grant?.TransactionCode != null)
{
    if (string.IsNullOrEmpty(userProvidedTxCode))
    {
        return BadRequest("Transaction code required");
    }
    if (!ValidateTxCode(userProvidedTxCode, grant.TransactionCode))
    {
        return BadRequest("Invalid transaction code");
    }
}

// WRONG
var request = new CredentialRequest
{
    CredentialDefinition = new { ... },
    CredentialIdentifier = "UniversityDegree_SDJWT"  // Cannot have both!
};

// RIGHT - use one or the other
var request = new CredentialRequest
{
    CredentialIdentifier = "UniversityDegree_SDJWT"
};