JWT proof carries exactly one of kid, jwk or x5c
OID4VCI 1.0 §Appendix F.1MUSTRoles: issuer, wallet
Requirement as recorded in the ProtocolSoup registry
A JWT proof carries exactly one of kid, jwk, or x5c in its JOSE header; anonymous pre-authorized clients omit iss and do not use payload cnf for the proof key.
Read §Appendix F.1 in OID4VCI 1.0Self-test verdict
PassCommit 97df6a8Evaluated
This is ProtocolSoup's result against its own implementation at the commit shown. It is not a certification of ProtocolSoup or of any other product.
Tests
- TestCreateCredentialProofJWTUsesFinalAnonymousProofShape
./cmd/walletharness
Pass - TestHarnessCreateMdocDeviceProof
./cmd/walletharness
Pass - TestProofJWKRejectsAllPrivateMaterial
./internal/protocols/oid4vci
Pass - TestProofJOSEHeaderRequiresExactlyOneSupportedKeyReference
./internal/protocols/oid4vci
Pass - TestProofAlgorithmMustBeAdvertisedForConfiguration
./internal/protocols/oid4vci
Pass