SD-JWT rejected when a disclosure is not referenced by digest

Requirement as recorded in the ProtocolSoup registry

If any Disclosure was not referenced by digest value in the Issuer-signed JWT, the SD-JWT MUST be rejected.

Self-test verdict

Tests

• TestDecodeAndVerifyDisclosuresRejectsUncommittedDisclosure

  ./internal/vc

  Pass
• TestDirectPostPolicyRejectsUncommittedSDJWTDisclosure

  ./internal/protocols/oid4vp

  Pass

Implementation

• backend/internal/vc/sdjwt.go
• backend/internal/protocols/oid4vp/handlers.go

Related requirements