SdJwt.Net.Eudiw 1.0.6

SdJwt.Net.Eudiw

EUDIW / ARF reference helpers for the SD-JWT .NET ecosystem.

Overview

This package provides reference models, configuration, and validation helpers for EUDIW-style ecosystems under eIDAS 2.0 / ARF concepts:

• ARF-Oriented Validation: Architecture Reference Framework helper checks
• EU Trust Lists: LOTL integration and issuer trust validation
• PID Handling: Person Identification Data credential processing
• QEAA/EAA: Qualified and non-qualified attestation support
• RP Registration: Relying Party registration validation

SdJwt.Net.Eudiw is not a certified EU Digital Identity Wallet, not a trust service provider, and not a replacement for national onboarding, conformity assessment, relying-party registration, or EU trust-list governance.

Installation

dotnet add package SdJwt.Net.Eudiw

Quick Start

Validate ARF-Oriented Policy

using SdJwt.Net.Eudiw.Arf;

var validator = new ArfProfileValidator();

// Validate algorithm against the configured ARF-oriented policy
bool isValid = validator.ValidateAlgorithm("ES256"); // true

// Validate credential type
var result = validator.ValidateCredentialType("eu.europa.ec.eudi.pid.1");
if (result.IsValid)
{
    Console.WriteLine($"Credential type: {result.CredentialType}"); // Pid
}

Process PID Credentials

using SdJwt.Net.Eudiw.Credentials;

var handler = new PidCredentialHandler();

var claims = new Dictionary<string, object>
{
    ["family_name"] = "Mustermann",
    ["given_name"] = "Erika",
    ["birth_date"] = "1964-08-12",
    ["issuance_date"] = "2024-01-01",
    ["expiry_date"] = "2029-01-01",
    ["issuing_authority"] = "Bundesdruckerei",
    ["issuing_country"] = "DE"
};

var validation = handler.Validate(claims);
if (validation.IsValid)
{
    var credential = handler.ToPidCredential(claims);
    Console.WriteLine($"{credential.GivenName} {credential.FamilyName}");
}

Validate EU Member State

using SdJwt.Net.Eudiw.Arf;

var validator = new ArfProfileValidator();

// Check if issuing country is EU member state
bool isEu = validator.ValidateMemberState("DE"); // true
bool isNotEu = validator.ValidateMemberState("US"); // false

Validate RP Registration

using SdJwt.Net.Eudiw.RelyingParty;

var validator = new RpRegistrationValidator();

var registration = new RpRegistration
{
    ClientId = "https://rp.example.com",
    OrganizationName = "Example Corp",
    RedirectUris = new[] { "https://rp.example.com/callback" },
    ResponseTypes = new[] { "vp_token" },
    TrustFramework = "eu.eudiw.trust"
};

var result = validator.Validate(registration);
if (result.IsValid)
{
    Console.WriteLine("RP registration is valid");
}

EudiWallet (Holder Application)

For building wallet applications, use the EudiWallet reference wrapper to apply ARF-oriented validation policies over the generic wallet infrastructure:

using SdJwt.Net.Eudiw;
using SdJwt.Net.Wallet.Core;
using SdJwt.Net.Wallet.Storage;

// Create a reference EUDIW-style wallet wrapper
var store = new InMemoryCredentialStore();
IKeyManager keyManager = /* your IKeyManager implementation */;

var options = new EudiWalletOptions
{
    WalletId = "citizen-wallet-001",
    EnforceArfCompliance = true,
    MinimumHaipLevel = 2,
    ValidateIssuerTrust = true,
    SupportedCredentialTypes = new[]
    {
        EudiwConstants.Pid.DocType,
        EudiwConstants.Mdl.DocType
    }
};

var wallet = new EudiWallet(store, keyManager, eudiOptions: options);

// Validate algorithms against the configured ARF-oriented policy
wallet.ValidateAlgorithm("ES256"); // true (allowed by this policy)
wallet.ValidateAlgorithm("RS256"); // false (not in ARF)

// Validate member states
wallet.ValidateMemberState("DE"); // true
wallet.ValidateMemberState("US"); // false

// Store credential with ARF validation
try
{
    var stored = await wallet.StoreCredentialAsync(credential);
}
catch (ArfComplianceException ex)
{
    // Algorithm or format is not allowed by the configured ARF-oriented policy
}

// Find PID/mDL credentials
var pidCredentials = await wallet.FindPidCredentialsAsync();
var mdlCredentials = await wallet.FindMdlCredentialsAsync();

// Create presentation with ARF enforcement
var presentation = await wallet.CreatePresentationAsync(
    credentialId, disclosurePaths, audience, nonce);

Credential Types

ARF Algorithm Support

The package enforces ARF-mandated cryptographic algorithms:

EU Member States

Full support for all 27 EU member states:

AT, BE, BG, CY, CZ, DE, DK, EE, ES, FI, FR, GR, HR, HU, IE, IT, LT, LU, LV, MT, NL, PL, PT, RO, SE, SI, SK

Related Packages

• SdJwt.Net - Core SD-JWT implementation
• SdJwt.Net.Wallet - Generic wallet infrastructure (base for EudiWallet)
• SdJwt.Net.Mdoc - ISO 18013-5 mdoc support
• SdJwt.Net.HAIP - High Assurance Interoperability Profile
• SdJwt.Net.Oid4Vp - OpenID4VP presentation protocol

License

Apache 2.0 - See LICENSE