veramo
veramo copied to clipboard
[proposal] Selective verification properties for verifyCredential/Presentation
The boolean output of these methods may not be sufficient to convey the various ways in which credentials may be seen as invalid. Also, some verifications may not be required in all cases (for example, checking if a credential was valid in the past).
Credentials are legitimately invalid if:
- formatted incorrectly
- expired or not valid yet
- signature invalid (according to the respective algorithm)
- signature does not match any of the issuer keys
- credentialStatus check resulted in revoked
Presentations, additionally must pass domain and challenge checks.
For these legitimate cases, the verification result must be false
, but the returning output could contain additional information for the failure.
Credentials or presentations cannot have a definitive verification status if:
- Signature suite not installed.
-
DID
method not installed on resolver - issuer
DID
/kid
resolution failed - credentialStatus method not installed
- credentialStatus check failed
- @context processing error for LD credentials
It is arguably OK to throw exceptions in these situations, but the error messages should guide developers.