Tessio.Verifier.Core 0.1.3

Tessio.Verifier

The .NET / ASP.NET Core verifier for the EU Digital Identity (EUDI) Wallet.

Verify credentials presented by EUDI Wallets directly from your .NET backend, over OpenID4VP 1.0 with SD-JWT VC credentials. Native to ASP.NET Core and Azure, with a built-in demo mode so you can run a full verification flow today, before any production wallet ships.

Relying-party (verifier) side only. This library never acts as a wallet or an issuer.

Status: the full pipeline runs on main. The quickstart below works end to end, and Mock mode now exercises the real protocol path: a built-in mock wallet issues a signed SD-JWT VC, the OpenID4VP layer parses the response and the verification core checks signature, disclosures, key binding and trust. The core passes the RFC 9901 spec vectors. What remains for v0.1 is conformance fixtures for Test mode and live-wallet hardening. Version 0.1.3 is on NuGet now. Follow releases for progress.

Why this exists

The EUDI Wallet arrives under Regulation (EU) 2024/1183: member states must make wallets available by December 2026, and regulated relying parties must accept them by December 2027. The open-source verifier tooling today is Kotlin (walt.id), Rust (SpruceID), and TypeScript (OpenEUDI). If you run on .NET, there hasn't been a native option. This is it.

What you get (v0.1)

• OpenID4VP 1.0 verifier flow (cross-device / QR), DCQL queries, JAR-signed requests (RFC 9101)
• SD-JWT VC verification: issuer signature (JWT VC Issuer Metadata and X.509), selective disclosure, key binding (KB-JWT)
• DEMO / MOCK / TEST modes so you can build before wallets exist
• Idiomatic ASP.NET Core integration (DI + minimal APIs) and a runnable sample
• A pluggable trust seam (ITrustListResolver) for production trust lists

Install

dotnet add package Tessio.Verifier.AspNetCore

Quickstart — 5 minutes, DEMO mode

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddTessioVerifier(options =>
{
    options.Mode = VerifierMode.Demo;          // auto-completes locally, no real wallet needed
    options.RequestedClaims = ["age_over_18"]; // selective disclosure: ask only for what you need
});

var app = builder.Build();

app.MapTessioVerifier();   // request-init, wallet-callback, and result-stream (SSE) endpoints

app.MapGet("/", () => Results.Content(
    """<a href="/verify/start">Start a verification</a>""", "text/html"));

app.Run();

Run it, open the page, start a verification, and DEMO mode returns a verified age_over_18 claim over Server-Sent Events.

Modes

• Demo: auto-completes in seconds, for showcases and first-run experience. Available now.
• Mock: a built-in mock wallet posts real signed credentials through the full verification pipeline. Available now.
• Test: full protocol runs against conformance fixtures. Currently behaves like Mock; fixtures land next.

Packages

Going to production

Live verification against real wallets also requires a registered Relying Party and a WRPAC (Wallet Relying Party Access Certificate) from a Qualified Trust Service Provider, plus maintained EU trust lists. This library handles the protocol and credential verification. The trust and compliance layer is provided separately (see docs/production.md). Relying parties do not need their own HSM/QSCD, since the QTSP holds those.

Standards

• OpenID4VP 1.0 — https://openid.net/specs/openid-4-verifiable-presentations-1_0.html
• SD-JWT VC — https://datatracker.ietf.org/doc/html/draft-ietf-oauth-sd-jwt-vc
• EUDI Architecture & Reference Framework — https://github.com/eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework
• WRPAC profile — ETSI TS 119 475

Repository

• Source: https://github.com/tripledownab/tessio-verifier
• Issues: https://github.com/tripledownab/tessio-verifier/issues
• Releases: https://github.com/tripledownab/tessio-verifier/releases

License

Apache-2.0