sd jwt ts

Caution

This repository is deprecated. Please use OWF Labs: sd–jwt–ts

Selective Disclosure JWT (SD-JWT) Draft 06 & Selective Disclosure JWT VC 01

Compliant with

• sd-jwt
  06
• sd-jwt-vc
  01

Design decisions

Bring your own crypto

This library does not provide any of the cryptographic primitives required for
encryption, decryption, signing, verification and hashing. It is expected that
the user of this library provides this. The main reason for this is that most
libraries have their own library and KMS. Providing private keys to this
library adds another layer of insecurity which should be avoided. Hashing has
not been added for platform compatibility between node,js, browser and React
Native. In the future a platform-independent sha2-256 may be provided.

Specification backwards compatibility

Since these specifications are in early drafts, no time will be spend in
supporting earlier versions of the specifications. This library may work for
older versions, e.g. the addition of selectively disclosable items in an array
does not break previous implementations. Once a non-draft specification is
released it will stay up-to-date with that version.

Dependencies

This library only has one dependency on buffer which makes sure this library
works in Node.js, the browser and React Native. Buffer is used internally for
base64-url-no-pad encoding.

Usage

I\’d highly recommend to check out the examples folder to see how
this library can be leveraged.

Issuance API

The issuance API takes an object called a disclosureFrame. This
disclosureFrame is a Boolean Map of the payload which allows you to specify
which attributes of the payload may be selectively disclosed. If an attribute is not provided in the disclosureFrame, it will be included in the clear-text payload. For example:

// The payload
{
    \"iss\": \"https://ex*ample.o**rg/issuer\",
    \"is_age_over_21\": true,
    \"is_age_over_24\": true,
    \"is_age_over_65\": false,
    \"date_of_birth\": \"1990-01-01\",
    \"address\": {
        \"street\": \"some street\",
        \"house_number\": 200,
        \"zipcode\": \"2344GH\"
    }
}

// The disclosure frame
{
    \"is_age_over_21\": true,
    \"is_age_over_24\": true,
    \"is_age_over_65\": true,
    \"date_of_birth\": true,
    \"address\": {
        \"street\": true,
        \"house_number\": true,
        \"zipcode\": true
    }
}

// or to only disclose the address as a group
{
    \"is_age_over_21\": true,
    \"is_age_over_24\": true,
    \"is_age_over_65\": true,
    \"date_of_birth\": true,
    \"address\": true
}

Presentation and verification API

Since there is officially standardized way to request and present a
presentation, High Assurance Interoperability
Profile
may be used, the API is defined in a way which works in a primitive manner for
now. For example, to present you can provide a list of indices of the
disclosures which will be included. Examples of this can be found in the
examples folder. For verification a list of keys or required
claims can be provided. It does not matter whether these are selectively
disclosable claims, or if they are included inside the payload.