Skip to content

7.0.0

Choose a tag to compare

View all tags
@nodh nodh released this 31 Jul 10:23
· 20 commits to main since this release
7.0.0
c56fb2d

This release reworks loading credential schemes into VC-K. Previously, libraries like ehic need to be included in client apps and registered with VC-K on startup. Now credentials-collection hosts a list of type metadata documents, that might be loaded from client apps and provided to the VC-K classes. Common types like EU PID and Mobile Driving Licences are included directly in the core of VC-K. See the description in the README or the implementation of the Relying Party or of Valera. No need to call Initializer.initWithVCK() anymore. Be sure to remove your dependencies on mdl, eupid and eupid-sdjwt.

  • Credential definitions:
    • Move CredentialScheme out of ConstantIndex
    • Provide type alias for CredentialRepresentation
    • Introduce typed sub-interfaces of CredentialScheme: VcJwtCredentialScheme, SdJwtCredentialScheme and IsoMdocCredentialScheme
    • That implies changes to CredentialToBeIssued, IssuedCredential, StoreCredentialInput and methods in SubjectCredentialStore
    • In CredentialScheme deprecate claimNames (list of strings), to be replaced with claimDescriptions (set of typed descriptions)
    • In CredentialScheme deprecate schemaUri, clients should use the identifiers for each credential representation instead
    • In StoreEntry deprecate property scheme and add suspending function resolveScheme() to replace it
    • Add UnknownCredentialScheme so that the scheme property in several methods and classes is not null
    • Import data classes and data element strings from credentials into this library for EU PID, EU PID in SD-JWT and Mobile Driving Licence
    • Document usage of remote metadata retrieval
    • Make JSON and ISO CBOR serializer registration safe for concurrent extension-library initialization
  • OpenID for Verifiable Presentations:
    • Compare signed DC API expected_origins values to the provided origin as exact strings and add a configurable holder-side origin-scheme allowlist
    • Support non-web Android Digital Credentials API origins starting with android:apk-key-hash:<hash> for OpenID4VP; ISO18013-7 mdoc presentations require authority-based origins and reject opaque Android application origins
    • Fix SD-JWT presentation validation for Digital Credentials API responses by checking the key binding JWT audience against the request origin (origin:<origin>) instead of the verifier client identifier
    • Fix DCQL matching for credential queries without claims: selectively disclosable credentials now return an explicit mandatory-claims-only result, while non-selectively disclosable credentials still return all claims
    • Fix disclosure of SD-JWT claims from foreign issuers: match disclosure digests against the originally serialized disclosures instead of re-serializing them, since digests are computed over the exact bytes (RFC 9901, section 4.2.3), e.g. failing for disclosures serialized with whitespace
    • Extend DCQLCredentialQueryMatchingResult by case AllMandatoryClaimsMatchingResult
    • Consolidate interface of OpenId4VpVerifier: All clients should use createAuthnRequest(), so we deprecate methods submitAuthnRequest() or createAuthnRequestAsSignedRequestObject()
    • Extract DcApiVerifier as a pendant to OpenId4VpVerifier which handles DCAPI requests only, deprecating Iso180137AnnexCVerifier
    • Move CreationOptions and CreatedRequest to upper level (at.asitplus.wallet.lib.openid) instead of nesting in OpenId4VpVerifier
  • Digital Credentials API:
    • Add DcApiHolder as the unified wallet-side entry point for OpenID4VP and ISO/IEC 18013-7 Annex C requests received through the Digital Credentials API
    • Add platform response codecs for Android JSON and iOS ISO/IEC 18013-7 Annex C bytes without introducing platform dependencies
    • Add request-option conversion helpers that combine a selected DC API protocol with trusted platform metadata into RequestParametersFrom.DcApiRequest
    • Add the iOS-specific IosDcApiMdocPreRequestSummary model for pre-request credential matching and consistency checks against the full Annex C request
    • BREAKING: Remove the origin property from Digital Credentials API response models
  • Verifier:
    • Add NonceChallengeVerifier, a thin Verifier wrapper that creates presentation challenges from a NonceService and verifies SD-JWT/VC-JWT presentations against the embedded challenge
    • Move OpenID4VP request nonce handling out of VerifierAgent and consume nonces after successful response validation to prevent replay
    • Deprecate abstract base class AbstractMdocVerifier
    • Extract MdocDeviceSignatureVerifier from AbstractMdocVerifier
    • Extract VpTokenValidator from common code in OpenId4VpVerifier and DcApiVerifier
  • OpenID for Verifiable Credential Issuance:
    • Wallet does not send any proofs when the issuer doesn't support any proof types
    • Update Wallet Instance Attestation and Key Attestation to EUDI Wallet TS3 1.5.2 from 2026-05-26
    • In IssuerAgent introduce constructor parameter statusListAgent to decouple creation of status elements from issuing credentials
    • Rework IssuerCredentialStore by moving some functionality to ReferencedTokenStore
    • Status claims for identifier lists from ISO 18013-5 contain the certificate of the status list issuer
  • JVM interoperability:
    • Add @JvmOverloads to public API constructors with default parameters across the published modules
    • Provide methods to use non-negative Long values for status list indices and accompanying API
    • Preserve RFC 3986 port and IPvFuture syntax without artificial ULong limits
  • Refactorings:
    • OpenId4VpHolder.getMatchingCredentials() returns KmmResult instead of Result
    • In SdJwtInputValidationResult transport error during integrity validation in integrityValidationResult instead of isIntegrityGood
    • vck-openid-ktor HTTP clients throw HttpErrorResponseException for non-success responses, preserving OAuth errors, RFC 9457 problem details, and the raw response body
  • Trust Evaluation:
    • Add LoTEFilterService for extracting trust list certificates from LoTE based on ServiceTypeIdentifier
    • Add signature and time validity checks of certificate against the trust list
    • Add JAdES B-B validation (Used when fetching LoTE)
    • Add issuer property in StoreEntry, for evaluation of trust against trust list
  • Deprecations:
    • Remove code deprecated in 6.0.0, e.g. various DCAPIWallet* and related classes, vckJsonSerializer
    • In OpenId4VpWallet deprecate sendAuthnErrorResponse() with parameter of type RequestParametersFrom, use parameter of type AuthorizationResponsePreparationState instead
  • Dependencies:
Assets 2
Loading