SD-JWT .NET Ecosystem

Standards-aligned .NET libraries, protocol components, and trust infrastructure for Selective Disclosure JSON Web Tokens (SD-JWTs), verifiable credentials, and regulated digital identity workflows.

This project provides reusable building blocks for issuers, verifiers, wallet frameworks, enterprise APIs, and trust systems. It is not a full wallet application or end-user mobile app. Instead, it provides the standards and protocol infrastructure that wallet frameworks, identity platforms, and enterprise systems can build on.

For package maturity classifications, see MATURITY.md.

Quick Start

# Core SD-JWT functionality
dotnet add package SdJwt.Net

# Verifiable Credentials
dotnet add package SdJwt.Net.Vc

# Try the samples
git clone https://github.com/openwallet-foundation-labs/sd-jwt-dotnet.git
cd sd-jwt-dotnet/samples/SdJwt.Net.Samples
dotnet run

Package Ecosystem

Core

Verifiable Credential Stack

OpenID Identity Protocols

Advanced Trust & Security

ISO Credential Formats

Reference Infrastructure

Not a standalone wallet product. Provides wallet infrastructure primitives and an EUDIW compliance reference that wallet frameworks can build on.

Agent Trust Kits

Key Features

Enterprise Security

• RFC 9901 Compliant: Full implementation with security hardening
• HAIP Support: High Assurance Interoperability Profile for government and enterprise
• Algorithm Enforcement: Blocks weak algorithms (MD5, SHA-1), enforces SHA-2 family
• Attack Prevention: Protection against timing attacks, replay attacks, signature tampering
• Verify-First Design: All tokens and claims are cryptographically verified before use

High Performance

• Multi-Target: .NET 8, 9, 10 and .NET Standard 2.1
• Platform-Aware Crypto: Uses SHA256.HashData() on .NET 6+ where available
• Batch Throughput: Designed for high-volume issuance and verification
• Low Allocation: Reduced allocations for high-volume scenarios

Standards Compliant

• IETF Standards: RFC 9901 and SD-JWT VC draft-15
• OpenID Foundation: OpenID4VCI, OpenID4VP, Federation, HAIP
• W3C: Verifiable Credentials data model compatibility
• DIF: Presentation Exchange v2.1.1
• HAIP: High assurance security profiles (Levels 1-3)

Developer Experience

• Samples: 19 tutorials organized by skill level (beginner to advanced)
• Fluent APIs: Chainable builder interfaces
• Documentation: Guides, deep dives, and security reference
• Tested: 2,600+ tests across 20 packages

Ecosystem Architecture

The SD-JWT .NET Ecosystem is organized into four logical layers:

+-----------------------------------------------------------------+
| Enterprise Applications                                         |
| ASP.NET Core APIs, identity platforms, wallet frameworks,       |
| regulated workflows, AI agent systems                           |
+-------------------------------+---------------------------------+
                                |
+-------------------------------v---------------------------------+
| Reference Infrastructure                                        |
| Wallet primitives, EUDIW compliance, issuer reference server    |
+-------------------------------+---------------------------------+
                                |
+-------------------------------v---------------------------------+
| Protocol Components                                             |
| OID4VCI, OID4VP, Presentation Exchange, OpenID Federation, HAIP |
+-------------------------------+---------------------------------+
                                |
+-------------------------------v---------------------------------+
| Standard Libraries                                              |
| SD-JWT (RFC 9901), SD-JWT VC, Status List, mdoc (ISO 18013-5)  |
+-----------------------------------------------------------------+

See MATURITY.md for the maturity classification of each package.

Use Cases

Government & Civic (HAIP Level 3 - Sovereign)

// Digital identity for citizens accessing government services
var citizenCredential = await governmentIssuer.IssueDigitalIdAsync(citizen);
var ageProof = citizen.CreateAgeVerificationPresentation(minimumAge: 18);
await servicePortal.VerifyAndGrantAccessAsync(ageProof);

Education & Credentials

// University issues degree, student presents to employer
var degree = await university.IssueDegreeCredentialAsync(graduate);
var jobPresentation = graduate.CreateProfessionalPresentation(
    disclosure => disclosure.ClaimName is "degree" or "gpa" or "honors");
await employer.VerifyQualificationsAsync(jobPresentation);

Healthcare & Privacy

// Patient shares medical data with specialist
var medicalRecord = await hospital.IssueMedicalCredentialAsync(patient);
var specialistPresentation = patient.CreateSelectiveMedicalPresentation(
    shareConditions: ["allergies", "current_medications"],
    protectInfo: ["full_history", "mental_health"]);
await specialist.ProcessPatientDataAsync(specialistPresentation);

Financial Services (HAIP Level 2 - Very High)

// Privacy-preserving loan application with HAIP compliance
var employmentCredential = await employer.IssueEmploymentVerificationAsync(applicant);
var incomePresentation = applicant.CreateIncomeVerificationPresentation(
    disclose: ["employment_status", "salary_range"],
    protect: ["exact_salary", "performance_reviews"]);
await bank.ProcessLoanApplicationAsync(incomePresentation);

Mobile Driving License (ISO 18013-5 mdoc)

// DMV issues mDL, citizen presents at TSA checkpoint
using SdJwt.Net.Mdoc.Issuer;
using SdJwt.Net.Mdoc.Namespaces;

var mdl = await new MdocIssuerBuilder()
    .WithDocType("org.iso.18013.5.1.mDL")
    .WithIssuerKey(dmvSigningKey)
    .WithDeviceKey(citizenDeviceKey)
    .AddMdlElement(MdlDataElement.FamilyName, "Johnson")
    .AddMdlElement(MdlDataElement.GivenName, "Alice")
    .AddMdlElement(MdlDataElement.AgeOver21, true)
    .BuildAsync(cryptoProvider);

// Citizen presents only age verification (not birthdate)
await checkpoint.VerifyAgeOnlyAsync(mdl, selectElements: ["age_over_21"]);

Architecture Overview

graph TB
    subgraph ApplicationLayer[Application Layer]
        WalletApp[Wallet Application]
        IssuerApp[Issuer Service]
        VerifierApp[Verifier Service]
        GovApp[Government Portal]
        AgentRuntime[Agent Runtime]
    end

    subgraph ProtocolLayer[Protocol Layer]
        OID4VCI[SdJwt.Net.Oid4Vci: Credential Issuance]
        OID4VP[SdJwt.Net.Oid4Vp: Presentations]
        PEx[SdJwt.Net.PresentationExchange: DIF PE v2.1.1]
        OidFed[SdJwt.Net.OidFederation: Trust Chains]
    end

    subgraph WalletLayer[Wallet Layer]
        Wallet[SdJwt.Net.Wallet: Plugin Architecture]
        Eudiw[SdJwt.Net.Eudiw: eIDAS 2.0]
    end

    subgraph AgentTrustLayer[Agent Trust Layer]
        ATCore[AgentTrust.Core]
        ATPolicy[AgentTrust.Policy]
        ATAsp[AgentTrust.AspNetCore]
        ATMaf[AgentTrust.Maf]
        ATMcp[AgentTrust.Mcp]
        ATA2A[AgentTrust.A2A]
    end

    subgraph ComplianceLayer[Compliance Layer]
        HAIP[SdJwt.Net.HAIP: Level 1 / 2 / 3]
    end

    subgraph CoreLayer[Core Layer]
        Core[SdJwt.Net: RFC 9901]
        Vc[SdJwt.Net.Vc: W3C VC]
        Status[SdJwt.Net.StatusList: Revocation]
        Mdoc[SdJwt.Net.Mdoc: ISO 18013-5]
    end

    WalletApp --> Wallet
    WalletApp --> OID4VP
    WalletApp --> OID4VCI
    IssuerApp --> OID4VCI
    VerifierApp --> OID4VP
    VerifierApp --> PEx
    GovApp --> HAIP
    AgentRuntime --> ATMaf

    OID4VCI --> HAIP
    OID4VP --> HAIP
    PEx --> HAIP
    OidFed --> HAIP

    Wallet --> Core
    Wallet --> Mdoc
    Eudiw --> Mdoc
    Eudiw --> Vc

    ATCore --> Core
    ATPolicy --> ATCore
    ATAsp --> ATCore
    ATMaf --> ATCore
    ATMcp --> ATCore
    ATA2A --> ATCore

    HAIP --> Core
    HAIP --> Vc
    HAIP --> Status
    HAIP --> Mdoc
    OidFed --> Core
    OID4VP --> Mdoc

    style HAIP fill:#d62828,color:#fff
    style Core fill:#1b4332,color:#fff
    style Mdoc fill:#2a6478,color:#fff
    style ATCore fill:#7b2d8e,color:#fff

Quick Examples

Basic SD-JWT

using SdJwt.Net.Issuer;

// Create issuer
var issuer = new SdIssuer(signingKey, SecurityAlgorithms.EcdsaSha256);

// Issue with selective disclosure
var credential = issuer.Issue(claims, new SdIssuanceOptions
{
    DisclosureStructure = new { email = true, address = new { city = true } }
});

// Holder creates presentation
var holder = new SdJwtHolder(credential.Issuance);
var presentation = holder.CreatePresentation(
    disclosure => disclosure.ClaimName == "email");

HAIP-Compliant Verifiable Credentials

using SdJwt.Net.Vc.Issuer;
using SdJwt.Net.HAIP;

// Government issuer with Level 3 compliance
var haipValidator = new HaipCryptoValidator(HaipLevel.Level3_Sovereign, logger);
var keyValidation = haipValidator.ValidateKeyCompliance(signingKey, "ES512");

if (keyValidation.IsCompliant)
{
    var vcIssuer = new SdJwtVcIssuer(issuerKey, algorithm);
    var credential = vcIssuer.Issue("https://gov.example/national-id", vcPayload, options);
}

Status Management

using SdJwt.Net.StatusList.Issuer;

// Create status list
var statusManager = new StatusListManager(statusKey, algorithm);
var statusValues = new byte[] { 0, 1, 2 }; // valid, invalid, suspended
var statusList = await statusManager.CreateStatusListTokenAsync(
    statusListUrl, statusValues, bits: 2);

// Check credential status
var statusVerifier = new StatusListVerifier(httpClient);
var statusResult = await statusVerifier.CheckStatusAsync(statusClaim, keyResolver);
var isValid = statusResult.IsValid;

// Verify presentation with expected nonce
var result = await verifier.VerifyAsync(presentation, validationParams, kbParams, "expected-nonce");

Security Features

Cryptographic Security

• Approved: SHA-256, SHA-384, SHA-512, ECDSA P-256/384/521
• Blocked: MD5, SHA-1 (automatically rejected)
• Enforced: Constant-time operations, secure random generation

HAIP Compliance Levels

• Level 1 (High): ES256+, PS256+, proof of possession
• Level 2 (Very High): ES384+, PS384+, wallet attestation, DPoP
• Level 3 (Sovereign): ES512+, PS512+, HSM backing, qualified signatures

Attack Prevention

• Signature Tampering: Cryptographic detection and prevention
• Replay Attacks: Nonce and timestamp validation
• Timing Attacks: Constant-time comparison operations
• Key Confusion: Strong key binding validation

Privacy Protection

• Selective Disclosure: Granular claim-level privacy control
• Zero-Knowledge Patterns: Prove properties without revealing data
• Context Isolation: Audience-specific presentations
• Correlation Resistance: Multiple unlinkable presentations

Platform Support

Supported Frameworks

• .NET 8.0 - Full support
• .NET 9.0 - Full support
• .NET 10.0 - Full support
• .NET Standard 2.1 - Backward compatibility for legacy systems

Supported Platforms

• Windows (x64, x86, ARM64)
• Linux (x64, ARM64)
• macOS (x64, Apple Silicon)
• Container Ready (Docker, Kubernetes)
• Cloud Native (Azure, AWS, GCP)

Performance Benchmarks

Performance is measured with a real BenchmarkDotNet harness in benchmarks/SdJwt.Net.Benchmarks.

Run benchmarks locally:

dotnet run --configuration Release --project benchmarks/SdJwt.Net.Benchmarks/SdJwt.Net.Benchmarks.csproj -- --job short --warmupCount 1 --iterationCount 3 --exporters markdown json

Benchmark results are generated in:

• benchmarks/SdJwt.Net.Benchmarks/BenchmarkDotNet.Artifacts/results/

The CI performance-benchmarks job executes the same harness and uploads result artifacts for each run.

Documentation

Getting Started

• Documentation Portal - Main entry point to all documentation
• 15-Minute Quickstart - Tutorial to get up and running quickly
• Ecosystem Architecture - Deep dive into system architecture
• Interactive Samples - 19 tutorials with interactive CLI (Beginner to Advanced)
• Package Documentation - Core package API reference

Standards Implementation

• Verifiable Credentials - SD-JWT VC specification
• Status Lists - Credential lifecycle management
• OpenID4VCI - Credential issuance protocols
• OpenID4VP - Presentation protocols
• mdoc/mDL - ISO 18013-5 mobile documents

Advanced Features

• OpenID Federation - Trust chain management
• Presentation Exchange - Credential selection
• HAIP Compliance - High assurance security profiles
• Agent Trust Core - Capability token minting and verification
• Agent Trust Policy - Rule and delegation engine
• Agent Trust ASP.NET Core - Inbound token verification middleware
• Agent Trust MAF - Outbound token propagation for tool calls
• Agent Trust OpenTelemetry - Metrics and telemetry
• Agent Trust OPA - External policy engine via OPA
• Agent Trust MCP - MCP trust interceptor and guard
• Agent Trust A2A - Agent-to-agent delegation chains
• Agent Trust Guide - End-to-end integration walkthrough
• Agent Trust Concepts - Architecture and flow model

Enterprise Planning

• Enterprise Roadmap - Strategic roadmap with ISO mDL/mdoc, DC API, eIDAS 2.0

Installation

Core Package

dotnet add package SdJwt.Net

Full Ecosystem

# Verifiable credential stack
dotnet add package SdJwt.Net
dotnet add package SdJwt.Net.Vc
dotnet add package SdJwt.Net.StatusList

# OpenID protocols
dotnet add package SdJwt.Net.Oid4Vci
dotnet add package SdJwt.Net.Oid4Vp

# Advanced features
dotnet add package SdJwt.Net.OidFederation
dotnet add package SdJwt.Net.PresentationExchange
dotnet add package SdJwt.Net.HAIP

# ISO credential formats
dotnet add package SdJwt.Net.Mdoc

# Agent trust kits
dotnet add package SdJwt.Net.AgentTrust.Core
dotnet add package SdJwt.Net.AgentTrust.Policy
dotnet add package SdJwt.Net.AgentTrust.AspNetCore
dotnet add package SdJwt.Net.AgentTrust.Maf
dotnet add package SdJwt.Net.AgentTrust.OpenTelemetry
dotnet add package SdJwt.Net.AgentTrust.Policy.Opa
dotnet add package SdJwt.Net.AgentTrust.Mcp
dotnet add package SdJwt.Net.AgentTrust.A2A

# Wallet infrastructure
dotnet add package SdJwt.Net.Wallet
dotnet add package SdJwt.Net.Eudiw

Try the Examples

git clone https://github.com/openwallet-foundation-labs/sd-jwt-dotnet.git
cd sd-jwt-dotnet/samples/SdJwt.Net.Samples
dotnet run

Contributing

We welcome contributions! Please see the CONTRIBUTING.md file for detailed guidelines and instructions.

Community & Support

Getting Help

• Documentation: docs/ - Guides and API reference
• Discussions: GitHub Discussions for community questions
• Issues: GitHub Issues for bug reports
• Security: Report security issues to tldinteractive@gmail.com or see SECURITY.md

Community

• Open Wallet Foundation: Part of the OpenWallet Foundation ecosystem
• Standards Participation: Active in IETF OAuth WG, OpenID Foundation, DIF

License

Licensed under the Apache License 2.0 - see the LICENSE file for details.

This permissive license allows commercial use, modification, distribution, and private use while providing license and copyright notice requirements.

Acknowledgments

This project builds on work from the identity standards community:

• IETF OAuth Working Group - SD-JWT and Status List specifications
• OpenID Foundation - OpenID4VCI, OpenID4VP, Federation, and HAIP standards
• DIF - Presentation Exchange specification
• W3C - Verifiable Credentials data model
• Open Wallet Foundation - Digital identity standards advancement

Special Thanks

• All specification editors and contributors
• Early adopters and feedback providers
• Security researchers and auditors
• The broader .NET and identity communities