Issuer - Wallet - Verifier: Full Credential Lifecycle¶

using System.Security.Cryptography;
using System.Text.Json;
using Microsoft.IdentityModel.Tokens;
using SdJwt.Net.Issuer;
using SdJwt.Net.Vc.Issuer;
using SdJwt.Net.Vc.Models;

// Issuer key pair (ES256 recommended for production)
var issuerKey = ECDsa.Create(ECCurve.NamedCurves.nistP256);
var issuerSigningKey = new ECDsaSecurityKey(issuerKey);

// Holder key pair (for key binding)
var holderKey = ECDsa.Create(ECCurve.NamedCurves.nistP256);
var holderPublicJwk = JsonWebKeyConverter.ConvertFromECDsaSecurityKey(
    new ECDsaSecurityKey(holderKey));

// Build credential claims
var claims = new Dictionary<string, object>
{
    ["vct"] = "https://credentials.example.com/identity_credential",
    ["iss"] = "https://issuer.example.com",
    ["iat"] = DateTimeOffset.UtcNow.ToUnixTimeSeconds(),
    ["given_name"] = "Alice",
    ["family_name"] = "Smith",
    ["birthdate"] = "1990-01-15",
    ["address"] = new Dictionary<string, object>
    {
        ["street_address"] = "123 Main St",
        ["locality"] = "Anytown",
        ["country"] = "US"
    },
    ["cnf"] = new Dictionary<string, object>
    {
        ["jwk"] = JsonSerializer.Deserialize<Dictionary<string, object>>(
            JsonSerializer.Serialize(holderPublicJwk))!
    }
};

// Selectively disclosable fields
var sdPaths = new[]
{
    "given_name",
    "family_name",
    "birthdate",
    "address.street_address",
    "address.locality",
    "address.country"
};

var vcIssuer = new SdJwtVcIssuer();
var issued = vcIssuer.Issue(
    claims,
    issuerSigningKey,
    SecurityAlgorithms.EcdsaSha256,
    new SdIssuanceOptions { SdPaths = sdPaths });

Console.WriteLine("Issued SD-JWT VC:");
Console.WriteLine(issued.SdJwt);
// Output: <issuer-jwt>~<disclosure1>~<disclosure2>~...

using SdJwt.Net.Holder;

var holder = new SdJwtHolder();

// Wallet selects only the claims the verifier needs
var presentation = holder.Present(
    issued.SdJwt,
    disclosureSelection: new[] { "given_name", "birthdate" },
    new SdJwtHolderOptions
    {
        HolderKey = new ECDsaSecurityKey(holderKey),
        Algorithm = SecurityAlgorithms.EcdsaSha256,
        Audience = "https://verifier.example.com",
        Nonce = "verifier-nonce-123"
    });

Console.WriteLine("Presentation (with KB-JWT):");
Console.WriteLine(presentation.Presentation);
// Output: <issuer-jwt>~<given_name-disclosure>~<birthdate-disclosure>~<kb-jwt>

using SdJwt.Net.PresentationExchange.Models;
using SdJwt.Net.Oid4Vp.Verifier;

var presentationDefinition = new PresentationDefinition
{
    Id = "identity-verification",
    InputDescriptors = new[]
    {
        new SdJwt.Net.PresentationExchange.Models.InputDescriptor
        {
            Id = "identity_credential",
            Constraints = new SdJwt.Net.PresentationExchange.Models.Constraints
            {
                Fields = new[]
                {
                    new SdJwt.Net.PresentationExchange.Models.Field
                    {
                        Path = new[] { "$.vct" },
                        Filter = new FieldFilter
                        {
                            Type = "string",
                            Const = "https://credentials.example.com/identity_credential"
                        }
                    },
                    new SdJwt.Net.PresentationExchange.Models.Field
                    {
                        Path = new[] { "$.given_name" }
                    },
                    new SdJwt.Net.PresentationExchange.Models.Field
                    {
                        Path = new[] { "$.birthdate" }
                    }
                }
            }
        }
    }
};

using SdJwt.Net.Oid4Vp.Verifier;

var vpValidator = new VpTokenValidator();

var result = await vpValidator.ValidateAsync(
    presentation.Presentation,
    new VpTokenValidationOptions
    {
        Audience = "https://verifier.example.com",
        Nonce = "verifier-nonce-123",
        IssuerSigningKey = new ECDsaSecurityKey(
            ECDsa.Create(issuerKey.ExportParameters(false))),
        PresentationDefinition = presentationDefinition
    });

Console.WriteLine($"Valid: {result.IsValid}");
// Output: Valid: True

if (result.IsValid)
{
    Console.WriteLine("Disclosed claims verified successfully.");
    // Access verified claims from the result
}