{"schema":"orbis-open-rail-conformance/1","setVersion":"1.0.0","mintedAt":"2026-08-05T05:19:53.024Z","digest":"IZlpaBB26upaxcU6mrV_iVB80aCywMBXopOjove10Q8","about":"ORBIS Open Rail conformance vectors. Point any verifier, in any language, at these and prove it correct — no ORBIS account, no ORBIS code and no ORBIS permission required. Using @orbis-id/verifier is OPTIONAL; THIS SET is the contract. Every artifact is inert data: verify it offline, with the network switched off.","failureCodes":{"malformed_presentation":"The presentation is not a parseable SD-JWT VC with a key-binding JWT.","malformed_did_document":"The DID document is not a usable did:web document (no assertion method, or a malformed / private key).","issuer_did_mismatch":"The DID document's own `id` is not the DID the credential names — the key is not bound to the identifier.","issuer_key_not_found":"No assertion key in the DID document verifies this credential.","issuer_signature_invalid":"The issuer JWT signature does not verify under any published assertion key.","unsupported_disclosure_structure":"The credential uses a disclosure structure this implementation does not check (nested or array-element `_sd`). Refused rather than partially verified.","disclosure_not_covered":"A presented disclosure's digest is absent from the signed `_sd` array — the holder is asserting a claim the issuer did not sign.","disclosure_conflicts_with_signed_claim":"A disclosure would redefine a member the issuer already signed (`cnf`, `status`, `vct`, …). Overwriting `cnf` would break holder binding; overwriting `status` would break revocation.","required_claim_missing":"A claim the relying party required was not disclosed.","credential_type_mismatch":"The credential's `vct` is not the type the relying party expected.","credential_expired":"The credential's `exp` is at or before the evaluation instant.","credential_not_yet_valid":"The credential's `nbf` is after the evaluation instant.","holder_binding_missing":"The presentation carries no key-binding JWT, or the credential carries no `cnf.jwk`.","holder_binding_invalid":"The key-binding JWT does not verify under the credential's bound holder key.","audience_mismatch":"The key-binding JWT is bound to a different verifier — this presentation was not meant for you.","nonce_mismatch":"The key-binding JWT echoes a different nonce — a replay of an older presentation.","key_binding_digest_mismatch":"The key-binding JWT's `sd_hash` does not cover exactly these disclosures — the disclosure set was altered after the holder signed.","status_unavailable":"Revocation could not be checked: the credential either names a status list that was not supplied, or carries no `status` claim at all. NOT a rejection — an unanswerable question, and the absence of a revocation mechanism is never read as clearance.","status_list_malformed":"The status list token is not a parseable `statuslist+jwt` with a compressed bitstring.","status_list_signature_invalid":"The status list token does not verify under the issuer's published key.","status_list_issuer_mismatch":"The status list token was signed by a different issuer than the credential names.","status_list_subject_mismatch":"The status list token's `sub` is not the list URI the credential points at.","status_list_expired":"The status list token's `exp` is at or before the evaluation instant — the revocation answer is stale.","status_index_out_of_range":"The credential's status index lies outside the published bitstring.","credential_revoked":"The credential's bit is set in the signed status list.","verifier_error":"The verifier itself failed. NOT a rejection — a credential must never be refused because the code checking it broke."},"conformanceLevels":{"level1":"The verdict matches (accept | reject | indeterminate). This is the BINDING contract and says nothing about your error vocabulary.","level2":"The verdict AND the `failure` code match, and on accept the disclosed claims match exactly. Recommended — a shared reason code is what lets two systems debug an interop failure — but never required: forcing an implementer to adopt ORBIS enum names would be the chokepoint this program exists to prevent."},"vectors":[{"id":"valid","about":"A genuine credential, presented to the stated challenge, whose status bit is clear.","proves":"The whole chain is walked and accepted, exactly the disclosed claims are readable, and the withheld claim never appears.","input":{"didDocument":{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"],"id":"did:web:issuer.example","verificationMethod":[{"id":"did:web:issuer.example#key-1","type":"JsonWebKey2020","controller":"did:web:issuer.example","publicKeyJwk":{"kty":"EC","x":"j8WT02UZ4lyNpjj4bOp1mHXMVNjHREWJmKvgvip36g4","y":"HxbiemvogCSfOh92HzIVQQQ-HJKuX6igbt2C-CSi8kI","crv":"P-256"}}],"assertionMethod":["did:web:issuer.example#key-1"]},"statusList":{"uri":"https://issuer.example/status/1","token":"eyJhbGciOiJFUzI1NiIsInR5cCI6InN0YXR1c2xpc3Qrand0In0.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwic3ViIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9zdGF0dXMvMSIsImlhdCI6MTc2NzIyNTYwMCwic3RhdHVzX2xpc3QiOnsiYml0cyI6MSwibHN0IjoiZUp4alloZ0ZJeGtBQUFZQUFBTSJ9fQ.h0LEKGUHLprfDTfL8-vLglA1QQ7FcFGNbltVP2kHE5bJqLi6raKQBJ0WXJ-SppwKJf6swf0NDB6zZ6mbR0GiIA"},"audience":"https://verifier.example/open-rail-conformance","nonce":"open-rail-conformance-nonce-one","expectedIssuer":"did:web:issuer.example","expectedVct":"https://issuer.example/credentials/open-rail-conformance","requiredClaims":["organization","membership_tier"],"now":1767229200,"presentation":"eyJ0eXAiOiJkYytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9jcmVkZW50aWFscy9vcGVuLXJhaWwtY29uZm9ybWFuY2UiLCJpYXQiOjE3NjcyMjU2MDAsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJ4IjoiTHNzd1dhZWt4emlUa0dUWUhkV3M2THE0WmZiVF9HbnphYV9FWkVuOVpkayIsInkiOiJSb0Npd1JOVjVGNS1GdEtlMWpBQkpUdFVUU2hyaWJ0Q21sQlhMYXRneUJNIiwiY3J2IjoiUC0yNTYifX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJpZHgiOjAsInVyaSI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUvc3RhdHVzLzEifX0sIl9zZCI6WyJBMTl5Y0FZZmpXYkdvWS13R1phZmdSdVE0N0RCVFh3cWVYYmNUSDcxOFBRIiwiQWkwVnpaLTM0YzluWnBON2tPanluSUloRHE0LWZ2WmJCTVR1S1g4blRIMCIsIktvRGpNb3lPa3lFY1VhdGpiMTVyb2o4UkN5WTIzLVlVcVNXbWQzNzNsMGciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.CD-0lHauduQn2TwJl7Lii4kN2WODKAvndouhuLA2uo6p7tGJBs5qgZllh7Va08A6w3hAbP08nhS5GuY25qZBqw~WyJGTk4wQlMyOURLemFNOHlUVVlUS2ZRIiwib3JnYW5pemF0aW9uIiwiT3BlbiBSYWlsIENvbmZvcm1hbmNlIEZpeHR1cmUiXQ~WyJ0ZWFneUNVcXNKR09XcHBpOGlEeV9nIiwibWVtYmVyc2hpcF90aWVyIiwiZml4dHVyZSJd~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUvb3Blbi1yYWlsLWNvbmZvcm1hbmNlIiwibm9uY2UiOiJvcGVuLXJhaWwtY29uZm9ybWFuY2Utbm9uY2Utb25lIiwiaWF0IjoxNzY3MjI1NjAwLCJzZF9oYXNoIjoiZkJWMGVUazZzZThSVklvS2Q2d3I1T211Yjl0cVlhSnJnX1Z5c2IweWREbyJ9.IZkET8yK3Wr3f76hBsmrdWViAj_r6o9gLcLAUHyy8Fa6YllQ3E5rasQfrgwlOIxEtuhuT4HEetY9WusA5Ru2fg"},"expect":{"verdict":"accept","failure":null,"claims":{"organization":"Open Rail Conformance Fixture","membership_tier":"fixture"},"withheld":["subject_kind"]}},{"id":"revoked","about":"The same issuer and the same signed status list, but this credential's bit has been set.","proves":"Revocation is actually read from the signed list. Signature and holder binding are still sound, so an implementation that skips the status step accepts this and is caught.","input":{"didDocument":{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"],"id":"did:web:issuer.example","verificationMethod":[{"id":"did:web:issuer.example#key-1","type":"JsonWebKey2020","controller":"did:web:issuer.example","publicKeyJwk":{"kty":"EC","x":"j8WT02UZ4lyNpjj4bOp1mHXMVNjHREWJmKvgvip36g4","y":"HxbiemvogCSfOh92HzIVQQQ-HJKuX6igbt2C-CSi8kI","crv":"P-256"}}],"assertionMethod":["did:web:issuer.example#key-1"]},"statusList":{"uri":"https://issuer.example/status/1","token":"eyJhbGciOiJFUzI1NiIsInR5cCI6InN0YXR1c2xpc3Qrand0In0.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwic3ViIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9zdGF0dXMvMSIsImlhdCI6MTc2NzIyNTYwMCwic3RhdHVzX2xpc3QiOnsiYml0cyI6MSwibHN0IjoiZUp4alloZ0ZJeGtBQUFZQUFBTSJ9fQ.h0LEKGUHLprfDTfL8-vLglA1QQ7FcFGNbltVP2kHE5bJqLi6raKQBJ0WXJ-SppwKJf6swf0NDB6zZ6mbR0GiIA"},"audience":"https://verifier.example/open-rail-conformance","nonce":"open-rail-conformance-nonce-one","expectedIssuer":"did:web:issuer.example","expectedVct":"https://issuer.example/credentials/open-rail-conformance","requiredClaims":["organization","membership_tier"],"now":1767229200,"presentation":"eyJ0eXAiOiJkYytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9jcmVkZW50aWFscy9vcGVuLXJhaWwtY29uZm9ybWFuY2UiLCJpYXQiOjE3NjcyMjU2MDAsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJ4IjoiaG1HRXp0OURlanpPWGhrTzVqMkZoYmU2VjJjdHhFcHEteGFGdldDNnZpTSIsInkiOiJUMWo1eDN5V011ZGxZUkllSUcyVTEwdUYtVG1hOUdlSW54cnFXNHVqdVA0IiwiY3J2IjoiUC0yNTYifX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJpZHgiOjEsInVyaSI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUvc3RhdHVzLzEifX0sIl9zZCI6WyJCa2JMMFlyTFdjbFdKTlFKd1ZZYTE3ZEZPREF2ci1xSUdpTmZYMVlzbllNIiwiSGxBMmlxVjgxNDR3N2pERlZqeFB3VURnT3JFWFpZUVBjMWE3RE91bVZ6OCIsIng0X2dPQXI2b2l0TnQtYllZNlVtc3ZfN3VmOG1oTTVWODEwM01xT0RnWnMiXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.x9rqPagEGGhbzqq8N3xkMZrgr8ReKwVgXc31BplVl6AcHqGMwf2zczlEOb1K5R-toW0BF4LupoKZCYekgSagfw~WyJJdnBtcXY2ZEp2SUxaU2RwX2ZfdzBnIiwib3JnYW5pemF0aW9uIiwiT3BlbiBSYWlsIENvbmZvcm1hbmNlIEZpeHR1cmUiXQ~WyJNbTJQM1E0SzFfdVFiMzd6T2JyT3ZnIiwibWVtYmVyc2hpcF90aWVyIiwiZml4dHVyZSJd~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUvb3Blbi1yYWlsLWNvbmZvcm1hbmNlIiwibm9uY2UiOiJvcGVuLXJhaWwtY29uZm9ybWFuY2Utbm9uY2Utb25lIiwiaWF0IjoxNzY3MjI1NjAwLCJzZF9oYXNoIjoiU080cFB2anpsN0gteV9mb0k5aUY2MnJTQjZjTl9iS2Nzc1FicXhxN1BGQSJ9.wVDR4nZvqYm-cKWVi4AlO_3angipuQpvKAL9l434BgA1hPNHCdor4Iqb0cHbbBRY5njL13gdLSplX62cZ4SQMQ"},"expect":{"verdict":"reject","failure":"credential_revoked","claims":null,"withheld":["subject_kind"]}},{"id":"status-list-withheld","about":"The valid credential, with NO status list supplied — the position a verifier is in when the issuer is unreachable.","proves":"An unanswerable question is answered `indeterminate`, never `accept`. This is the vector that catches a verifier which fails open when it cannot reach the revocation list.","input":{"didDocument":{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"],"id":"did:web:issuer.example","verificationMethod":[{"id":"did:web:issuer.example#key-1","type":"JsonWebKey2020","controller":"did:web:issuer.example","publicKeyJwk":{"kty":"EC","x":"j8WT02UZ4lyNpjj4bOp1mHXMVNjHREWJmKvgvip36g4","y":"HxbiemvogCSfOh92HzIVQQQ-HJKuX6igbt2C-CSi8kI","crv":"P-256"}}],"assertionMethod":["did:web:issuer.example#key-1"]},"statusList":null,"audience":"https://verifier.example/open-rail-conformance","nonce":"open-rail-conformance-nonce-one","expectedIssuer":"did:web:issuer.example","expectedVct":"https://issuer.example/credentials/open-rail-conformance","requiredClaims":["organization","membership_tier"],"now":1767229200,"presentation":"eyJ0eXAiOiJkYytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9jcmVkZW50aWFscy9vcGVuLXJhaWwtY29uZm9ybWFuY2UiLCJpYXQiOjE3NjcyMjU2MDAsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJ4IjoiTHNzd1dhZWt4emlUa0dUWUhkV3M2THE0WmZiVF9HbnphYV9FWkVuOVpkayIsInkiOiJSb0Npd1JOVjVGNS1GdEtlMWpBQkpUdFVUU2hyaWJ0Q21sQlhMYXRneUJNIiwiY3J2IjoiUC0yNTYifX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJpZHgiOjAsInVyaSI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUvc3RhdHVzLzEifX0sIl9zZCI6WyJBMTl5Y0FZZmpXYkdvWS13R1phZmdSdVE0N0RCVFh3cWVYYmNUSDcxOFBRIiwiQWkwVnpaLTM0YzluWnBON2tPanluSUloRHE0LWZ2WmJCTVR1S1g4blRIMCIsIktvRGpNb3lPa3lFY1VhdGpiMTVyb2o4UkN5WTIzLVlVcVNXbWQzNzNsMGciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.CD-0lHauduQn2TwJl7Lii4kN2WODKAvndouhuLA2uo6p7tGJBs5qgZllh7Va08A6w3hAbP08nhS5GuY25qZBqw~WyJGTk4wQlMyOURLemFNOHlUVVlUS2ZRIiwib3JnYW5pemF0aW9uIiwiT3BlbiBSYWlsIENvbmZvcm1hbmNlIEZpeHR1cmUiXQ~WyJ0ZWFneUNVcXNKR09XcHBpOGlEeV9nIiwibWVtYmVyc2hpcF90aWVyIiwiZml4dHVyZSJd~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUvb3Blbi1yYWlsLWNvbmZvcm1hbmNlIiwibm9uY2UiOiJvcGVuLXJhaWwtY29uZm9ybWFuY2Utbm9uY2Utb25lIiwiaWF0IjoxNzY3MjI1NjAwLCJzZF9oYXNoIjoiZkJWMGVUazZzZThSVklvS2Q2d3I1T211Yjl0cVlhSnJnX1Z5c2IweWREbyJ9.IZkET8yK3Wr3f76hBsmrdWViAj_r6o9gLcLAUHyy8Fa6YllQ3E5rasQfrgwlOIxEtuhuT4HEetY9WusA5Ru2fg"},"expect":{"verdict":"indeterminate","failure":"status_unavailable","claims":null,"withheld":["subject_kind"]}},{"id":"tampered-issuer-signature","about":"The valid credential with one bit flipped in the issuer JWT signature, and the key-binding JWT re-signed over the tampered bytes so nothing else is out of place.","proves":"The issuer signature is VERIFIED, not merely parsed. Because the key binding was re-signed, no other check can catch this by accident — an implementation that decodes the payload and trusts it accepts this and fails at level 1.","input":{"didDocument":{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"],"id":"did:web:issuer.example","verificationMethod":[{"id":"did:web:issuer.example#key-1","type":"JsonWebKey2020","controller":"did:web:issuer.example","publicKeyJwk":{"kty":"EC","x":"j8WT02UZ4lyNpjj4bOp1mHXMVNjHREWJmKvgvip36g4","y":"HxbiemvogCSfOh92HzIVQQQ-HJKuX6igbt2C-CSi8kI","crv":"P-256"}}],"assertionMethod":["did:web:issuer.example#key-1"]},"statusList":{"uri":"https://issuer.example/status/1","token":"eyJhbGciOiJFUzI1NiIsInR5cCI6InN0YXR1c2xpc3Qrand0In0.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwic3ViIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9zdGF0dXMvMSIsImlhdCI6MTc2NzIyNTYwMCwic3RhdHVzX2xpc3QiOnsiYml0cyI6MSwibHN0IjoiZUp4alloZ0ZJeGtBQUFZQUFBTSJ9fQ.h0LEKGUHLprfDTfL8-vLglA1QQ7FcFGNbltVP2kHE5bJqLi6raKQBJ0WXJ-SppwKJf6swf0NDB6zZ6mbR0GiIA"},"audience":"https://verifier.example/open-rail-conformance","nonce":"open-rail-conformance-nonce-one","expectedIssuer":"did:web:issuer.example","expectedVct":"https://issuer.example/credentials/open-rail-conformance","requiredClaims":["organization","membership_tier"],"now":1767229200,"presentation":"eyJ0eXAiOiJkYytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9jcmVkZW50aWFscy9vcGVuLXJhaWwtY29uZm9ybWFuY2UiLCJpYXQiOjE3NjcyMjU2MDAsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJ4IjoiTHNzd1dhZWt4emlUa0dUWUhkV3M2THE0WmZiVF9HbnphYV9FWkVuOVpkayIsInkiOiJSb0Npd1JOVjVGNS1GdEtlMWpBQkpUdFVUU2hyaWJ0Q21sQlhMYXRneUJNIiwiY3J2IjoiUC0yNTYifX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJpZHgiOjAsInVyaSI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUvc3RhdHVzLzEifX0sIl9zZCI6WyJBMTl5Y0FZZmpXYkdvWS13R1phZmdSdVE0N0RCVFh3cWVYYmNUSDcxOFBRIiwiQWkwVnpaLTM0YzluWnBON2tPanluSUloRHE0LWZ2WmJCTVR1S1g4blRIMCIsIktvRGpNb3lPa3lFY1VhdGpiMTVyb2o4UkN5WTIzLVlVcVNXbWQzNzNsMGciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.CT-0lHauduQn2TwJl7Lii4kN2WODKAvndouhuLA2uo6p7tGJBs5qgZllh7Va08A6w3hAbP08nhS5GuY25qZBqw~WyJGTk4wQlMyOURLemFNOHlUVVlUS2ZRIiwib3JnYW5pemF0aW9uIiwiT3BlbiBSYWlsIENvbmZvcm1hbmNlIEZpeHR1cmUiXQ~WyJ0ZWFneUNVcXNKR09XcHBpOGlEeV9nIiwibWVtYmVyc2hpcF90aWVyIiwiZml4dHVyZSJd~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUvb3Blbi1yYWlsLWNvbmZvcm1hbmNlIiwibm9uY2UiOiJvcGVuLXJhaWwtY29uZm9ybWFuY2Utbm9uY2Utb25lIiwiaWF0IjoxNzY3MjI1NjAwLCJzZF9oYXNoIjoiQ2Nxd2lxVGpWelI2OFBQVUQ2cTJQSy1YMUwwT3VDQ3dLRGF1azY2bktKMCJ9.jYu0mHoyAu1Z1jtLu0TX-dZL9UBhmR7aMEPIX130Qcj5AEOaOzeGJC-bTX8gYfZxImAuJrl2s9g6Ot6f4rS5ew"},"expect":{"verdict":"reject","failure":"issuer_signature_invalid","claims":null,"withheld":["subject_kind"]}},{"id":"wrong-issuer-key","about":"A perfectly well-formed DID document for the right DID publishing a different issuer's valid P-256 key — with a status list signed by that same wrong key, so the bundle is internally consistent.","proves":"The key is bound to the credential by the SIGNATURE, not by the identifier. Every incidental catch is removed: an implementation that stops at \"the document says it is the right DID\" accepts this and fails at level 1.","input":{"didDocument":{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"],"id":"did:web:issuer.example","verificationMethod":[{"id":"did:web:issuer.example#key-1","type":"JsonWebKey2020","controller":"did:web:issuer.example","publicKeyJwk":{"kty":"EC","x":"Mu7GNbY-j2vWb5_Te_cSkoA2poLy2_tRWoNCQCXKRQU","y":"pW-KxEpbYBgi-324_DGnWwbd9MIccADGPU9hkiv95eQ","crv":"P-256"}}],"assertionMethod":["did:web:issuer.example#key-1"]},"statusList":{"uri":"https://issuer.example/status/1","token":"eyJhbGciOiJFUzI1NiIsInR5cCI6InN0YXR1c2xpc3Qrand0In0.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwic3ViIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9zdGF0dXMvMSIsImlhdCI6MTc2NzIyNTYwMCwic3RhdHVzX2xpc3QiOnsiYml0cyI6MSwibHN0IjoiZUp4allCZ0ZJeGtBQUFJQUFBRSJ9fQ.pTjTnyvIMv9Ql-tBItqu6fv9dkksBBLAUp8q95mMUA4mldoBGKlbEgrsEtPvS1OMt6kjREmBjIvhPAqyukzNPw"},"audience":"https://verifier.example/open-rail-conformance","nonce":"open-rail-conformance-nonce-one","expectedIssuer":"did:web:issuer.example","expectedVct":"https://issuer.example/credentials/open-rail-conformance","requiredClaims":["organization","membership_tier"],"now":1767229200,"presentation":"eyJ0eXAiOiJkYytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9jcmVkZW50aWFscy9vcGVuLXJhaWwtY29uZm9ybWFuY2UiLCJpYXQiOjE3NjcyMjU2MDAsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJ4IjoiTHNzd1dhZWt4emlUa0dUWUhkV3M2THE0WmZiVF9HbnphYV9FWkVuOVpkayIsInkiOiJSb0Npd1JOVjVGNS1GdEtlMWpBQkpUdFVUU2hyaWJ0Q21sQlhMYXRneUJNIiwiY3J2IjoiUC0yNTYifX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJpZHgiOjAsInVyaSI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUvc3RhdHVzLzEifX0sIl9zZCI6WyJBMTl5Y0FZZmpXYkdvWS13R1phZmdSdVE0N0RCVFh3cWVYYmNUSDcxOFBRIiwiQWkwVnpaLTM0YzluWnBON2tPanluSUloRHE0LWZ2WmJCTVR1S1g4blRIMCIsIktvRGpNb3lPa3lFY1VhdGpiMTVyb2o4UkN5WTIzLVlVcVNXbWQzNzNsMGciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.CD-0lHauduQn2TwJl7Lii4kN2WODKAvndouhuLA2uo6p7tGJBs5qgZllh7Va08A6w3hAbP08nhS5GuY25qZBqw~WyJGTk4wQlMyOURLemFNOHlUVVlUS2ZRIiwib3JnYW5pemF0aW9uIiwiT3BlbiBSYWlsIENvbmZvcm1hbmNlIEZpeHR1cmUiXQ~WyJ0ZWFneUNVcXNKR09XcHBpOGlEeV9nIiwibWVtYmVyc2hpcF90aWVyIiwiZml4dHVyZSJd~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUvb3Blbi1yYWlsLWNvbmZvcm1hbmNlIiwibm9uY2UiOiJvcGVuLXJhaWwtY29uZm9ybWFuY2Utbm9uY2Utb25lIiwiaWF0IjoxNzY3MjI1NjAwLCJzZF9oYXNoIjoiZkJWMGVUazZzZThSVklvS2Q2d3I1T211Yjl0cVlhSnJnX1Z5c2IweWREbyJ9.IZkET8yK3Wr3f76hBsmrdWViAj_r6o9gLcLAUHyy8Fa6YllQ3E5rasQfrgwlOIxEtuhuT4HEetY9WusA5Ru2fg"},"expect":{"verdict":"reject","failure":"issuer_signature_invalid","claims":null,"withheld":["subject_kind"]}},{"id":"stolen-credential","about":"A genuine, untouched presentation whose key-binding JWT was signed by a different holder key. Audience, nonce and `sd_hash` are all correct.","proves":"Holder binding is enforced. Without this check a credential works for whoever copies it, and `cnf` is decoration.","input":{"didDocument":{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"],"id":"did:web:issuer.example","verificationMethod":[{"id":"did:web:issuer.example#key-1","type":"JsonWebKey2020","controller":"did:web:issuer.example","publicKeyJwk":{"kty":"EC","x":"j8WT02UZ4lyNpjj4bOp1mHXMVNjHREWJmKvgvip36g4","y":"HxbiemvogCSfOh92HzIVQQQ-HJKuX6igbt2C-CSi8kI","crv":"P-256"}}],"assertionMethod":["did:web:issuer.example#key-1"]},"statusList":{"uri":"https://issuer.example/status/1","token":"eyJhbGciOiJFUzI1NiIsInR5cCI6InN0YXR1c2xpc3Qrand0In0.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwic3ViIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9zdGF0dXMvMSIsImlhdCI6MTc2NzIyNTYwMCwic3RhdHVzX2xpc3QiOnsiYml0cyI6MSwibHN0IjoiZUp4alloZ0ZJeGtBQUFZQUFBTSJ9fQ.h0LEKGUHLprfDTfL8-vLglA1QQ7FcFGNbltVP2kHE5bJqLi6raKQBJ0WXJ-SppwKJf6swf0NDB6zZ6mbR0GiIA"},"audience":"https://verifier.example/open-rail-conformance","nonce":"open-rail-conformance-nonce-one","expectedIssuer":"did:web:issuer.example","expectedVct":"https://issuer.example/credentials/open-rail-conformance","requiredClaims":["organization","membership_tier"],"now":1767229200,"presentation":"eyJ0eXAiOiJkYytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9jcmVkZW50aWFscy9vcGVuLXJhaWwtY29uZm9ybWFuY2UiLCJpYXQiOjE3NjcyMjU2MDAsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJ4IjoiTHNzd1dhZWt4emlUa0dUWUhkV3M2THE0WmZiVF9HbnphYV9FWkVuOVpkayIsInkiOiJSb0Npd1JOVjVGNS1GdEtlMWpBQkpUdFVUU2hyaWJ0Q21sQlhMYXRneUJNIiwiY3J2IjoiUC0yNTYifX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJpZHgiOjAsInVyaSI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUvc3RhdHVzLzEifX0sIl9zZCI6WyJBMTl5Y0FZZmpXYkdvWS13R1phZmdSdVE0N0RCVFh3cWVYYmNUSDcxOFBRIiwiQWkwVnpaLTM0YzluWnBON2tPanluSUloRHE0LWZ2WmJCTVR1S1g4blRIMCIsIktvRGpNb3lPa3lFY1VhdGpiMTVyb2o4UkN5WTIzLVlVcVNXbWQzNzNsMGciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.CD-0lHauduQn2TwJl7Lii4kN2WODKAvndouhuLA2uo6p7tGJBs5qgZllh7Va08A6w3hAbP08nhS5GuY25qZBqw~WyJGTk4wQlMyOURLemFNOHlUVVlUS2ZRIiwib3JnYW5pemF0aW9uIiwiT3BlbiBSYWlsIENvbmZvcm1hbmNlIEZpeHR1cmUiXQ~WyJ0ZWFneUNVcXNKR09XcHBpOGlEeV9nIiwibWVtYmVyc2hpcF90aWVyIiwiZml4dHVyZSJd~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUvb3Blbi1yYWlsLWNvbmZvcm1hbmNlIiwibm9uY2UiOiJvcGVuLXJhaWwtY29uZm9ybWFuY2Utbm9uY2Utb25lIiwiaWF0IjoxNzY3MjI1NjAwLCJzZF9oYXNoIjoiZkJWMGVUazZzZThSVklvS2Q2d3I1T211Yjl0cVlhSnJnX1Z5c2IweWREbyJ9.0XqVB-X4-jl_aAeWDIdQpbVlc9ES-_G-14cWSw2KTH9WKQP5XWBF3CdQl4sEfs-k4hDEjJJCwjsvLPkyXh6rew"},"expect":{"verdict":"reject","failure":"holder_binding_invalid","claims":null,"withheld":["subject_kind"]}},{"id":"wrong-credential-type","about":"The valid credential, presented to a relying party that asked for a different `vct`.","proves":"The credential type the relying party demanded is actually compared. A verifier that ignores `vct` will accept a parking permit where a licence was required.","input":{"didDocument":{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"],"id":"did:web:issuer.example","verificationMethod":[{"id":"did:web:issuer.example#key-1","type":"JsonWebKey2020","controller":"did:web:issuer.example","publicKeyJwk":{"kty":"EC","x":"j8WT02UZ4lyNpjj4bOp1mHXMVNjHREWJmKvgvip36g4","y":"HxbiemvogCSfOh92HzIVQQQ-HJKuX6igbt2C-CSi8kI","crv":"P-256"}}],"assertionMethod":["did:web:issuer.example#key-1"]},"statusList":{"uri":"https://issuer.example/status/1","token":"eyJhbGciOiJFUzI1NiIsInR5cCI6InN0YXR1c2xpc3Qrand0In0.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwic3ViIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9zdGF0dXMvMSIsImlhdCI6MTc2NzIyNTYwMCwic3RhdHVzX2xpc3QiOnsiYml0cyI6MSwibHN0IjoiZUp4alloZ0ZJeGtBQUFZQUFBTSJ9fQ.h0LEKGUHLprfDTfL8-vLglA1QQ7FcFGNbltVP2kHE5bJqLi6raKQBJ0WXJ-SppwKJf6swf0NDB6zZ6mbR0GiIA"},"audience":"https://verifier.example/open-rail-conformance","nonce":"open-rail-conformance-nonce-one","expectedIssuer":"did:web:issuer.example","expectedVct":"https://issuer.example/credentials/something-else","requiredClaims":["organization","membership_tier"],"now":1767229200,"presentation":"eyJ0eXAiOiJkYytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9jcmVkZW50aWFscy9vcGVuLXJhaWwtY29uZm9ybWFuY2UiLCJpYXQiOjE3NjcyMjU2MDAsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJ4IjoiTHNzd1dhZWt4emlUa0dUWUhkV3M2THE0WmZiVF9HbnphYV9FWkVuOVpkayIsInkiOiJSb0Npd1JOVjVGNS1GdEtlMWpBQkpUdFVUU2hyaWJ0Q21sQlhMYXRneUJNIiwiY3J2IjoiUC0yNTYifX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJpZHgiOjAsInVyaSI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUvc3RhdHVzLzEifX0sIl9zZCI6WyJBMTl5Y0FZZmpXYkdvWS13R1phZmdSdVE0N0RCVFh3cWVYYmNUSDcxOFBRIiwiQWkwVnpaLTM0YzluWnBON2tPanluSUloRHE0LWZ2WmJCTVR1S1g4blRIMCIsIktvRGpNb3lPa3lFY1VhdGpiMTVyb2o4UkN5WTIzLVlVcVNXbWQzNzNsMGciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.CD-0lHauduQn2TwJl7Lii4kN2WODKAvndouhuLA2uo6p7tGJBs5qgZllh7Va08A6w3hAbP08nhS5GuY25qZBqw~WyJGTk4wQlMyOURLemFNOHlUVVlUS2ZRIiwib3JnYW5pemF0aW9uIiwiT3BlbiBSYWlsIENvbmZvcm1hbmNlIEZpeHR1cmUiXQ~WyJ0ZWFneUNVcXNKR09XcHBpOGlEeV9nIiwibWVtYmVyc2hpcF90aWVyIiwiZml4dHVyZSJd~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUvb3Blbi1yYWlsLWNvbmZvcm1hbmNlIiwibm9uY2UiOiJvcGVuLXJhaWwtY29uZm9ybWFuY2Utbm9uY2Utb25lIiwiaWF0IjoxNzY3MjI1NjAwLCJzZF9oYXNoIjoiZkJWMGVUazZzZThSVklvS2Q2d3I1T211Yjl0cVlhSnJnX1Z5c2IweWREbyJ9.IZkET8yK3Wr3f76hBsmrdWViAj_r6o9gLcLAUHyy8Fa6YllQ3E5rasQfrgwlOIxEtuhuT4HEetY9WusA5Ru2fg"},"expect":{"verdict":"reject","failure":"credential_type_mismatch","claims":null,"withheld":["subject_kind"]}},{"id":"required-claim-withheld","about":"The valid credential, presented to a relying party that required a claim the holder deliberately did not disclose.","proves":"Selective disclosure is honoured in BOTH directions: a withheld claim is genuinely absent, and a verifier must say so rather than proceed as if it had the value.","input":{"didDocument":{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"],"id":"did:web:issuer.example","verificationMethod":[{"id":"did:web:issuer.example#key-1","type":"JsonWebKey2020","controller":"did:web:issuer.example","publicKeyJwk":{"kty":"EC","x":"j8WT02UZ4lyNpjj4bOp1mHXMVNjHREWJmKvgvip36g4","y":"HxbiemvogCSfOh92HzIVQQQ-HJKuX6igbt2C-CSi8kI","crv":"P-256"}}],"assertionMethod":["did:web:issuer.example#key-1"]},"statusList":{"uri":"https://issuer.example/status/1","token":"eyJhbGciOiJFUzI1NiIsInR5cCI6InN0YXR1c2xpc3Qrand0In0.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwic3ViIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9zdGF0dXMvMSIsImlhdCI6MTc2NzIyNTYwMCwic3RhdHVzX2xpc3QiOnsiYml0cyI6MSwibHN0IjoiZUp4alloZ0ZJeGtBQUFZQUFBTSJ9fQ.h0LEKGUHLprfDTfL8-vLglA1QQ7FcFGNbltVP2kHE5bJqLi6raKQBJ0WXJ-SppwKJf6swf0NDB6zZ6mbR0GiIA"},"audience":"https://verifier.example/open-rail-conformance","nonce":"open-rail-conformance-nonce-one","expectedIssuer":"did:web:issuer.example","expectedVct":"https://issuer.example/credentials/open-rail-conformance","requiredClaims":["organization","membership_tier","subject_kind"],"now":1767229200,"presentation":"eyJ0eXAiOiJkYytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9jcmVkZW50aWFscy9vcGVuLXJhaWwtY29uZm9ybWFuY2UiLCJpYXQiOjE3NjcyMjU2MDAsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJ4IjoiTHNzd1dhZWt4emlUa0dUWUhkV3M2THE0WmZiVF9HbnphYV9FWkVuOVpkayIsInkiOiJSb0Npd1JOVjVGNS1GdEtlMWpBQkpUdFVUU2hyaWJ0Q21sQlhMYXRneUJNIiwiY3J2IjoiUC0yNTYifX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJpZHgiOjAsInVyaSI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUvc3RhdHVzLzEifX0sIl9zZCI6WyJBMTl5Y0FZZmpXYkdvWS13R1phZmdSdVE0N0RCVFh3cWVYYmNUSDcxOFBRIiwiQWkwVnpaLTM0YzluWnBON2tPanluSUloRHE0LWZ2WmJCTVR1S1g4blRIMCIsIktvRGpNb3lPa3lFY1VhdGpiMTVyb2o4UkN5WTIzLVlVcVNXbWQzNzNsMGciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.CD-0lHauduQn2TwJl7Lii4kN2WODKAvndouhuLA2uo6p7tGJBs5qgZllh7Va08A6w3hAbP08nhS5GuY25qZBqw~WyJGTk4wQlMyOURLemFNOHlUVVlUS2ZRIiwib3JnYW5pemF0aW9uIiwiT3BlbiBSYWlsIENvbmZvcm1hbmNlIEZpeHR1cmUiXQ~WyJ0ZWFneUNVcXNKR09XcHBpOGlEeV9nIiwibWVtYmVyc2hpcF90aWVyIiwiZml4dHVyZSJd~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUvb3Blbi1yYWlsLWNvbmZvcm1hbmNlIiwibm9uY2UiOiJvcGVuLXJhaWwtY29uZm9ybWFuY2Utbm9uY2Utb25lIiwiaWF0IjoxNzY3MjI1NjAwLCJzZF9oYXNoIjoiZkJWMGVUazZzZThSVklvS2Q2d3I1T211Yjl0cVlhSnJnX1Z5c2IweWREbyJ9.IZkET8yK3Wr3f76hBsmrdWViAj_r6o9gLcLAUHyy8Fa6YllQ3E5rasQfrgwlOIxEtuhuT4HEetY9WusA5Ru2fg"},"expect":{"verdict":"reject","failure":"required_claim_missing","claims":null,"withheld":["subject_kind"]}},{"id":"did-document-not-bound","about":"A valid, correctly signed DID document — for a different DID than the credential names.","proves":"The document is bound to the identifier it claims. Without this check any host could publish keys for any issuer.","input":{"didDocument":{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"],"id":"did:web:someone-else.example","verificationMethod":[{"id":"did:web:issuer.example#key-1","type":"JsonWebKey2020","controller":"did:web:issuer.example","publicKeyJwk":{"kty":"EC","x":"j8WT02UZ4lyNpjj4bOp1mHXMVNjHREWJmKvgvip36g4","y":"HxbiemvogCSfOh92HzIVQQQ-HJKuX6igbt2C-CSi8kI","crv":"P-256"}}],"assertionMethod":["did:web:issuer.example#key-1"]},"statusList":{"uri":"https://issuer.example/status/1","token":"eyJhbGciOiJFUzI1NiIsInR5cCI6InN0YXR1c2xpc3Qrand0In0.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwic3ViIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9zdGF0dXMvMSIsImlhdCI6MTc2NzIyNTYwMCwic3RhdHVzX2xpc3QiOnsiYml0cyI6MSwibHN0IjoiZUp4alloZ0ZJeGtBQUFZQUFBTSJ9fQ.h0LEKGUHLprfDTfL8-vLglA1QQ7FcFGNbltVP2kHE5bJqLi6raKQBJ0WXJ-SppwKJf6swf0NDB6zZ6mbR0GiIA"},"audience":"https://verifier.example/open-rail-conformance","nonce":"open-rail-conformance-nonce-one","expectedIssuer":"did:web:issuer.example","expectedVct":"https://issuer.example/credentials/open-rail-conformance","requiredClaims":["organization","membership_tier"],"now":1767229200,"presentation":"eyJ0eXAiOiJkYytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9jcmVkZW50aWFscy9vcGVuLXJhaWwtY29uZm9ybWFuY2UiLCJpYXQiOjE3NjcyMjU2MDAsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJ4IjoiTHNzd1dhZWt4emlUa0dUWUhkV3M2THE0WmZiVF9HbnphYV9FWkVuOVpkayIsInkiOiJSb0Npd1JOVjVGNS1GdEtlMWpBQkpUdFVUU2hyaWJ0Q21sQlhMYXRneUJNIiwiY3J2IjoiUC0yNTYifX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJpZHgiOjAsInVyaSI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUvc3RhdHVzLzEifX0sIl9zZCI6WyJBMTl5Y0FZZmpXYkdvWS13R1phZmdSdVE0N0RCVFh3cWVYYmNUSDcxOFBRIiwiQWkwVnpaLTM0YzluWnBON2tPanluSUloRHE0LWZ2WmJCTVR1S1g4blRIMCIsIktvRGpNb3lPa3lFY1VhdGpiMTVyb2o4UkN5WTIzLVlVcVNXbWQzNzNsMGciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.CD-0lHauduQn2TwJl7Lii4kN2WODKAvndouhuLA2uo6p7tGJBs5qgZllh7Va08A6w3hAbP08nhS5GuY25qZBqw~WyJGTk4wQlMyOURLemFNOHlUVVlUS2ZRIiwib3JnYW5pemF0aW9uIiwiT3BlbiBSYWlsIENvbmZvcm1hbmNlIEZpeHR1cmUiXQ~WyJ0ZWFneUNVcXNKR09XcHBpOGlEeV9nIiwibWVtYmVyc2hpcF90aWVyIiwiZml4dHVyZSJd~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUvb3Blbi1yYWlsLWNvbmZvcm1hbmNlIiwibm9uY2UiOiJvcGVuLXJhaWwtY29uZm9ybWFuY2Utbm9uY2Utb25lIiwiaWF0IjoxNzY3MjI1NjAwLCJzZF9oYXNoIjoiZkJWMGVUazZzZThSVklvS2Q2d3I1T211Yjl0cVlhSnJnX1Z5c2IweWREbyJ9.IZkET8yK3Wr3f76hBsmrdWViAj_r6o9gLcLAUHyy8Fa6YllQ3E5rasQfrgwlOIxEtuhuT4HEetY9WusA5Ru2fg"},"expect":{"verdict":"reject","failure":"issuer_did_mismatch","claims":null,"withheld":["subject_kind"]}},{"id":"forged-disclosure","about":"The holder rewrote a claim value and re-signed the key-binding JWT over the altered set, so the ONLY defect is that the disclosure digest is not in the signed `_sd`.","proves":"Selective-disclosure integrity: a holder cannot invent a claim the issuer never signed, even with a perfectly valid key binding.","input":{"didDocument":{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"],"id":"did:web:issuer.example","verificationMethod":[{"id":"did:web:issuer.example#key-1","type":"JsonWebKey2020","controller":"did:web:issuer.example","publicKeyJwk":{"kty":"EC","x":"j8WT02UZ4lyNpjj4bOp1mHXMVNjHREWJmKvgvip36g4","y":"HxbiemvogCSfOh92HzIVQQQ-HJKuX6igbt2C-CSi8kI","crv":"P-256"}}],"assertionMethod":["did:web:issuer.example#key-1"]},"statusList":{"uri":"https://issuer.example/status/1","token":"eyJhbGciOiJFUzI1NiIsInR5cCI6InN0YXR1c2xpc3Qrand0In0.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwic3ViIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9zdGF0dXMvMSIsImlhdCI6MTc2NzIyNTYwMCwic3RhdHVzX2xpc3QiOnsiYml0cyI6MSwibHN0IjoiZUp4alloZ0ZJeGtBQUFZQUFBTSJ9fQ.h0LEKGUHLprfDTfL8-vLglA1QQ7FcFGNbltVP2kHE5bJqLi6raKQBJ0WXJ-SppwKJf6swf0NDB6zZ6mbR0GiIA"},"audience":"https://verifier.example/open-rail-conformance","nonce":"open-rail-conformance-nonce-one","expectedIssuer":"did:web:issuer.example","expectedVct":"https://issuer.example/credentials/open-rail-conformance","requiredClaims":["organization","membership_tier"],"now":1767229200,"presentation":"eyJ0eXAiOiJkYytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9jcmVkZW50aWFscy9vcGVuLXJhaWwtY29uZm9ybWFuY2UiLCJpYXQiOjE3NjcyMjU2MDAsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJ4IjoiTHNzd1dhZWt4emlUa0dUWUhkV3M2THE0WmZiVF9HbnphYV9FWkVuOVpkayIsInkiOiJSb0Npd1JOVjVGNS1GdEtlMWpBQkpUdFVUU2hyaWJ0Q21sQlhMYXRneUJNIiwiY3J2IjoiUC0yNTYifX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJpZHgiOjAsInVyaSI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUvc3RhdHVzLzEifX0sIl9zZCI6WyJBMTl5Y0FZZmpXYkdvWS13R1phZmdSdVE0N0RCVFh3cWVYYmNUSDcxOFBRIiwiQWkwVnpaLTM0YzluWnBON2tPanluSUloRHE0LWZ2WmJCTVR1S1g4blRIMCIsIktvRGpNb3lPa3lFY1VhdGpiMTVyb2o4UkN5WTIzLVlVcVNXbWQzNzNsMGciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.CD-0lHauduQn2TwJl7Lii4kN2WODKAvndouhuLA2uo6p7tGJBs5qgZllh7Va08A6w3hAbP08nhS5GuY25qZBqw~WyJGTk4wQlMyOURLemFNOHlUVVlUS2ZRIiwib3JnYW5pemF0aW9uIiwiTWluaXN0cnkgb2YgRXZlcnl0aGluZyJd~WyJ0ZWFneUNVcXNKR09XcHBpOGlEeV9nIiwibWVtYmVyc2hpcF90aWVyIiwiZml4dHVyZSJd~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUvb3Blbi1yYWlsLWNvbmZvcm1hbmNlIiwibm9uY2UiOiJvcGVuLXJhaWwtY29uZm9ybWFuY2Utbm9uY2Utb25lIiwiaWF0IjoxNzY3MjI1NjAwLCJzZF9oYXNoIjoiWmhRRE5EcVI3VWplQ1ltSnBibWU3dkpQcWxwYmZidEI2UzJ3ZG1iSkJPZyJ9.xb9AKQSJyfNCbZBLond1tYg4nv6sWffhFzMGYpEMXkCA5dVsh5xrRKhj563NEh8m8I_g_7HOirRsx1Oibe6R6Q"},"expect":{"verdict":"reject","failure":"disclosure_not_covered","claims":null,"withheld":["subject_kind"]}},{"id":"disclosure-set-altered","about":"A disclosure removed after the holder signed. Every remaining disclosure is still covered by `_sd`; only `sd_hash` betrays the edit.","proves":"The key-binding JWT's `sd_hash` is checked, so the disclosure set cannot be edited in transit.","input":{"didDocument":{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"],"id":"did:web:issuer.example","verificationMethod":[{"id":"did:web:issuer.example#key-1","type":"JsonWebKey2020","controller":"did:web:issuer.example","publicKeyJwk":{"kty":"EC","x":"j8WT02UZ4lyNpjj4bOp1mHXMVNjHREWJmKvgvip36g4","y":"HxbiemvogCSfOh92HzIVQQQ-HJKuX6igbt2C-CSi8kI","crv":"P-256"}}],"assertionMethod":["did:web:issuer.example#key-1"]},"statusList":{"uri":"https://issuer.example/status/1","token":"eyJhbGciOiJFUzI1NiIsInR5cCI6InN0YXR1c2xpc3Qrand0In0.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwic3ViIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9zdGF0dXMvMSIsImlhdCI6MTc2NzIyNTYwMCwic3RhdHVzX2xpc3QiOnsiYml0cyI6MSwibHN0IjoiZUp4alloZ0ZJeGtBQUFZQUFBTSJ9fQ.h0LEKGUHLprfDTfL8-vLglA1QQ7FcFGNbltVP2kHE5bJqLi6raKQBJ0WXJ-SppwKJf6swf0NDB6zZ6mbR0GiIA"},"audience":"https://verifier.example/open-rail-conformance","nonce":"open-rail-conformance-nonce-one","expectedIssuer":"did:web:issuer.example","expectedVct":"https://issuer.example/credentials/open-rail-conformance","requiredClaims":["organization"],"now":1767229200,"presentation":"eyJ0eXAiOiJkYytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9jcmVkZW50aWFscy9vcGVuLXJhaWwtY29uZm9ybWFuY2UiLCJpYXQiOjE3NjcyMjU2MDAsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJ4IjoiTHNzd1dhZWt4emlUa0dUWUhkV3M2THE0WmZiVF9HbnphYV9FWkVuOVpkayIsInkiOiJSb0Npd1JOVjVGNS1GdEtlMWpBQkpUdFVUU2hyaWJ0Q21sQlhMYXRneUJNIiwiY3J2IjoiUC0yNTYifX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJpZHgiOjAsInVyaSI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUvc3RhdHVzLzEifX0sIl9zZCI6WyJBMTl5Y0FZZmpXYkdvWS13R1phZmdSdVE0N0RCVFh3cWVYYmNUSDcxOFBRIiwiQWkwVnpaLTM0YzluWnBON2tPanluSUloRHE0LWZ2WmJCTVR1S1g4blRIMCIsIktvRGpNb3lPa3lFY1VhdGpiMTVyb2o4UkN5WTIzLVlVcVNXbWQzNzNsMGciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.CD-0lHauduQn2TwJl7Lii4kN2WODKAvndouhuLA2uo6p7tGJBs5qgZllh7Va08A6w3hAbP08nhS5GuY25qZBqw~WyJGTk4wQlMyOURLemFNOHlUVVlUS2ZRIiwib3JnYW5pemF0aW9uIiwiT3BlbiBSYWlsIENvbmZvcm1hbmNlIEZpeHR1cmUiXQ~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUvb3Blbi1yYWlsLWNvbmZvcm1hbmNlIiwibm9uY2UiOiJvcGVuLXJhaWwtY29uZm9ybWFuY2Utbm9uY2Utb25lIiwiaWF0IjoxNzY3MjI1NjAwLCJzZF9oYXNoIjoiZkJWMGVUazZzZThSVklvS2Q2d3I1T211Yjl0cVlhSnJnX1Z5c2IweWREbyJ9.IZkET8yK3Wr3f76hBsmrdWViAj_r6o9gLcLAUHyy8Fa6YllQ3E5rasQfrgwlOIxEtuhuT4HEetY9WusA5Ru2fg"},"expect":{"verdict":"reject","failure":"key_binding_digest_mismatch","claims":null,"withheld":["subject_kind"]}},{"id":"audience-mismatch","about":"A genuine presentation of the same credential, bound to a different relying party.","proves":"A presentation captured by, or replayed from, another verifier is refused. Without this the whole point of key binding is lost.","input":{"didDocument":{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"],"id":"did:web:issuer.example","verificationMethod":[{"id":"did:web:issuer.example#key-1","type":"JsonWebKey2020","controller":"did:web:issuer.example","publicKeyJwk":{"kty":"EC","x":"j8WT02UZ4lyNpjj4bOp1mHXMVNjHREWJmKvgvip36g4","y":"HxbiemvogCSfOh92HzIVQQQ-HJKuX6igbt2C-CSi8kI","crv":"P-256"}}],"assertionMethod":["did:web:issuer.example#key-1"]},"statusList":{"uri":"https://issuer.example/status/1","token":"eyJhbGciOiJFUzI1NiIsInR5cCI6InN0YXR1c2xpc3Qrand0In0.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwic3ViIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9zdGF0dXMvMSIsImlhdCI6MTc2NzIyNTYwMCwic3RhdHVzX2xpc3QiOnsiYml0cyI6MSwibHN0IjoiZUp4alloZ0ZJeGtBQUFZQUFBTSJ9fQ.h0LEKGUHLprfDTfL8-vLglA1QQ7FcFGNbltVP2kHE5bJqLi6raKQBJ0WXJ-SppwKJf6swf0NDB6zZ6mbR0GiIA"},"audience":"https://verifier.example/open-rail-conformance","nonce":"open-rail-conformance-nonce-one","expectedIssuer":"did:web:issuer.example","expectedVct":"https://issuer.example/credentials/open-rail-conformance","requiredClaims":["organization","membership_tier"],"now":1767229200,"presentation":"eyJ0eXAiOiJkYytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9jcmVkZW50aWFscy9vcGVuLXJhaWwtY29uZm9ybWFuY2UiLCJpYXQiOjE3NjcyMjU2MDAsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJ4IjoiTHNzd1dhZWt4emlUa0dUWUhkV3M2THE0WmZiVF9HbnphYV9FWkVuOVpkayIsInkiOiJSb0Npd1JOVjVGNS1GdEtlMWpBQkpUdFVUU2hyaWJ0Q21sQlhMYXRneUJNIiwiY3J2IjoiUC0yNTYifX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJpZHgiOjAsInVyaSI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUvc3RhdHVzLzEifX0sIl9zZCI6WyJBMTl5Y0FZZmpXYkdvWS13R1phZmdSdVE0N0RCVFh3cWVYYmNUSDcxOFBRIiwiQWkwVnpaLTM0YzluWnBON2tPanluSUloRHE0LWZ2WmJCTVR1S1g4blRIMCIsIktvRGpNb3lPa3lFY1VhdGpiMTVyb2o4UkN5WTIzLVlVcVNXbWQzNzNsMGciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.CD-0lHauduQn2TwJl7Lii4kN2WODKAvndouhuLA2uo6p7tGJBs5qgZllh7Va08A6w3hAbP08nhS5GuY25qZBqw~WyJGTk4wQlMyOURLemFNOHlUVVlUS2ZRIiwib3JnYW5pemF0aW9uIiwiT3BlbiBSYWlsIENvbmZvcm1hbmNlIEZpeHR1cmUiXQ~WyJ0ZWFneUNVcXNKR09XcHBpOGlEeV9nIiwibWVtYmVyc2hpcF90aWVyIiwiZml4dHVyZSJd~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL2F0dGFja2VyLmV4YW1wbGUvY29sbGVjdG9yIiwibm9uY2UiOiJvcGVuLXJhaWwtY29uZm9ybWFuY2Utbm9uY2Utb25lIiwiaWF0IjoxNzY3MjI1NjAwLCJzZF9oYXNoIjoiZkJWMGVUazZzZThSVklvS2Q2d3I1T211Yjl0cVlhSnJnX1Z5c2IweWREbyJ9.GsM_nR2-25GFGYDGVxV2OlW4axFQY0dqR6EHeMmDUWuztTdTL21Gxa9Q__6NXMfZgNAmrl3KWZjrvF-VqZ8Asw"},"expect":{"verdict":"reject","failure":"audience_mismatch","claims":null,"withheld":["subject_kind"]}},{"id":"nonce-replay","about":"A genuine presentation to the right audience, echoing a nonce from an earlier session.","proves":"The nonce is checked, so a previously captured presentation cannot be replayed against a fresh challenge.","input":{"didDocument":{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"],"id":"did:web:issuer.example","verificationMethod":[{"id":"did:web:issuer.example#key-1","type":"JsonWebKey2020","controller":"did:web:issuer.example","publicKeyJwk":{"kty":"EC","x":"j8WT02UZ4lyNpjj4bOp1mHXMVNjHREWJmKvgvip36g4","y":"HxbiemvogCSfOh92HzIVQQQ-HJKuX6igbt2C-CSi8kI","crv":"P-256"}}],"assertionMethod":["did:web:issuer.example#key-1"]},"statusList":{"uri":"https://issuer.example/status/1","token":"eyJhbGciOiJFUzI1NiIsInR5cCI6InN0YXR1c2xpc3Qrand0In0.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwic3ViIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9zdGF0dXMvMSIsImlhdCI6MTc2NzIyNTYwMCwic3RhdHVzX2xpc3QiOnsiYml0cyI6MSwibHN0IjoiZUp4alloZ0ZJeGtBQUFZQUFBTSJ9fQ.h0LEKGUHLprfDTfL8-vLglA1QQ7FcFGNbltVP2kHE5bJqLi6raKQBJ0WXJ-SppwKJf6swf0NDB6zZ6mbR0GiIA"},"audience":"https://verifier.example/open-rail-conformance","nonce":"open-rail-conformance-nonce-one","expectedIssuer":"did:web:issuer.example","expectedVct":"https://issuer.example/credentials/open-rail-conformance","requiredClaims":["organization","membership_tier"],"now":1767229200,"presentation":"eyJ0eXAiOiJkYytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9jcmVkZW50aWFscy9vcGVuLXJhaWwtY29uZm9ybWFuY2UiLCJpYXQiOjE3NjcyMjU2MDAsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJ4IjoiTHNzd1dhZWt4emlUa0dUWUhkV3M2THE0WmZiVF9HbnphYV9FWkVuOVpkayIsInkiOiJSb0Npd1JOVjVGNS1GdEtlMWpBQkpUdFVUU2hyaWJ0Q21sQlhMYXRneUJNIiwiY3J2IjoiUC0yNTYifX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJpZHgiOjAsInVyaSI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUvc3RhdHVzLzEifX0sIl9zZCI6WyJBMTl5Y0FZZmpXYkdvWS13R1phZmdSdVE0N0RCVFh3cWVYYmNUSDcxOFBRIiwiQWkwVnpaLTM0YzluWnBON2tPanluSUloRHE0LWZ2WmJCTVR1S1g4blRIMCIsIktvRGpNb3lPa3lFY1VhdGpiMTVyb2o4UkN5WTIzLVlVcVNXbWQzNzNsMGciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.CD-0lHauduQn2TwJl7Lii4kN2WODKAvndouhuLA2uo6p7tGJBs5qgZllh7Va08A6w3hAbP08nhS5GuY25qZBqw~WyJGTk4wQlMyOURLemFNOHlUVVlUS2ZRIiwib3JnYW5pemF0aW9uIiwiT3BlbiBSYWlsIENvbmZvcm1hbmNlIEZpeHR1cmUiXQ~WyJ0ZWFneUNVcXNKR09XcHBpOGlEeV9nIiwibWVtYmVyc2hpcF90aWVyIiwiZml4dHVyZSJd~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUvb3Blbi1yYWlsLWNvbmZvcm1hbmNlIiwibm9uY2UiOiJhLW5vbmNlLWZyb20tYS1wcmV2aW91cy1zZXNzaW9uIiwiaWF0IjoxNzY3MjI1NjAwLCJzZF9oYXNoIjoiZkJWMGVUazZzZThSVklvS2Q2d3I1T211Yjl0cVlhSnJnX1Z5c2IweWREbyJ9.Kbcug3pSB6IlTwcmZHHM7s0ysSUV9JL3dQibBEqNY-auBBSw6Pal2djI_2A8Ib7EVOuhwlyyLt2Cd1dU8Ki_Ug"},"expect":{"verdict":"reject","failure":"nonce_mismatch","claims":null,"withheld":["subject_kind"]}},{"id":"expired-status-list","about":"The valid credential with a genuinely signed status list whose `exp` is before the evaluation instant.","proves":"A stale revocation answer is not an answer. An implementation that ignores `exp` will happily read a snapshot from before the revocation it was supposed to see.","input":{"didDocument":{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"],"id":"did:web:issuer.example","verificationMethod":[{"id":"did:web:issuer.example#key-1","type":"JsonWebKey2020","controller":"did:web:issuer.example","publicKeyJwk":{"kty":"EC","x":"j8WT02UZ4lyNpjj4bOp1mHXMVNjHREWJmKvgvip36g4","y":"HxbiemvogCSfOh92HzIVQQQ-HJKuX6igbt2C-CSi8kI","crv":"P-256"}}],"assertionMethod":["did:web:issuer.example#key-1"]},"statusList":{"uri":"https://issuer.example/status/1","token":"eyJhbGciOiJFUzI1NiIsInR5cCI6InN0YXR1c2xpc3Qrand0In0.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwic3ViIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9zdGF0dXMvMSIsImlhdCI6MTc2NzIyNTYwMCwiZXhwIjoxNzY3MjI1NjYwLCJzdGF0dXNfbGlzdCI6eyJiaXRzIjoxLCJsc3QiOiJlSnhqWWhnRkl4a0FBQVlBQUFNIn19.kffPolfVux-9zsiqFy9cbljwtHeqOI_ITf1ztTj1qmMPEJShZ_soz1Fd-GB3e50sROQVKECLiIOen2XkXjutYw"},"audience":"https://verifier.example/open-rail-conformance","nonce":"open-rail-conformance-nonce-one","expectedIssuer":"did:web:issuer.example","expectedVct":"https://issuer.example/credentials/open-rail-conformance","requiredClaims":["organization","membership_tier"],"now":1767229200,"presentation":"eyJ0eXAiOiJkYytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9jcmVkZW50aWFscy9vcGVuLXJhaWwtY29uZm9ybWFuY2UiLCJpYXQiOjE3NjcyMjU2MDAsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJ4IjoiTHNzd1dhZWt4emlUa0dUWUhkV3M2THE0WmZiVF9HbnphYV9FWkVuOVpkayIsInkiOiJSb0Npd1JOVjVGNS1GdEtlMWpBQkpUdFVUU2hyaWJ0Q21sQlhMYXRneUJNIiwiY3J2IjoiUC0yNTYifX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJpZHgiOjAsInVyaSI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUvc3RhdHVzLzEifX0sIl9zZCI6WyJBMTl5Y0FZZmpXYkdvWS13R1phZmdSdVE0N0RCVFh3cWVYYmNUSDcxOFBRIiwiQWkwVnpaLTM0YzluWnBON2tPanluSUloRHE0LWZ2WmJCTVR1S1g4blRIMCIsIktvRGpNb3lPa3lFY1VhdGpiMTVyb2o4UkN5WTIzLVlVcVNXbWQzNzNsMGciXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.CD-0lHauduQn2TwJl7Lii4kN2WODKAvndouhuLA2uo6p7tGJBs5qgZllh7Va08A6w3hAbP08nhS5GuY25qZBqw~WyJGTk4wQlMyOURLemFNOHlUVVlUS2ZRIiwib3JnYW5pemF0aW9uIiwiT3BlbiBSYWlsIENvbmZvcm1hbmNlIEZpeHR1cmUiXQ~WyJ0ZWFneUNVcXNKR09XcHBpOGlEeV9nIiwibWVtYmVyc2hpcF90aWVyIiwiZml4dHVyZSJd~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUvb3Blbi1yYWlsLWNvbmZvcm1hbmNlIiwibm9uY2UiOiJvcGVuLXJhaWwtY29uZm9ybWFuY2Utbm9uY2Utb25lIiwiaWF0IjoxNzY3MjI1NjAwLCJzZF9oYXNoIjoiZkJWMGVUazZzZThSVklvS2Q2d3I1T211Yjl0cVlhSnJnX1Z5c2IweWREbyJ9.IZkET8yK3Wr3f76hBsmrdWViAj_r6o9gLcLAUHyy8Fa6YllQ3E5rasQfrgwlOIxEtuhuT4HEetY9WusA5Ru2fg"},"expect":{"verdict":"reject","failure":"status_list_expired","claims":null,"withheld":["subject_kind"]}},{"id":"status-list-substituted","about":"The REVOKED credential, served the issuer's other list — genuinely signed by the same key, entirely clear, and covering a different `sub`.","proves":"The status list is bound to the URI the credential names. Checking only the signature un-revokes every credential the moment an attacker can swap which list is served.","input":{"didDocument":{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"],"id":"did:web:issuer.example","verificationMethod":[{"id":"did:web:issuer.example#key-1","type":"JsonWebKey2020","controller":"did:web:issuer.example","publicKeyJwk":{"kty":"EC","x":"j8WT02UZ4lyNpjj4bOp1mHXMVNjHREWJmKvgvip36g4","y":"HxbiemvogCSfOh92HzIVQQQ-HJKuX6igbt2C-CSi8kI","crv":"P-256"}}],"assertionMethod":["did:web:issuer.example#key-1"]},"statusList":{"uri":"https://issuer.example/status/1","token":"eyJhbGciOiJFUzI1NiIsInR5cCI6InN0YXR1c2xpc3Qrand0In0.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwic3ViIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9zdGF0dXMvMiIsImlhdCI6MTc2NzIyNTYwMCwic3RhdHVzX2xpc3QiOnsiYml0cyI6MSwibHN0IjoiZUp4allCZ0ZJeGtBQUFJQUFBRSJ9fQ.BjWUEpA3e6X0i-6tfUpLHSyzhz-r5NIhpf5he428Le3bJaDu1MQmmTLptes0V9GV6Ci1N6YaNeyJo1IEmihwGg"},"audience":"https://verifier.example/open-rail-conformance","nonce":"open-rail-conformance-nonce-one","expectedIssuer":"did:web:issuer.example","expectedVct":"https://issuer.example/credentials/open-rail-conformance","requiredClaims":["organization","membership_tier"],"now":1767229200,"presentation":"eyJ0eXAiOiJkYytzZC1qd3QiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwidmN0IjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9jcmVkZW50aWFscy9vcGVuLXJhaWwtY29uZm9ybWFuY2UiLCJpYXQiOjE3NjcyMjU2MDAsImNuZiI6eyJqd2siOnsia3R5IjoiRUMiLCJ4IjoiaG1HRXp0OURlanpPWGhrTzVqMkZoYmU2VjJjdHhFcHEteGFGdldDNnZpTSIsInkiOiJUMWo1eDN5V011ZGxZUkllSUcyVTEwdUYtVG1hOUdlSW54cnFXNHVqdVA0IiwiY3J2IjoiUC0yNTYifX0sInN0YXR1cyI6eyJzdGF0dXNfbGlzdCI6eyJpZHgiOjEsInVyaSI6Imh0dHBzOi8vaXNzdWVyLmV4YW1wbGUvc3RhdHVzLzEifX0sIl9zZCI6WyJCa2JMMFlyTFdjbFdKTlFKd1ZZYTE3ZEZPREF2ci1xSUdpTmZYMVlzbllNIiwiSGxBMmlxVjgxNDR3N2pERlZqeFB3VURnT3JFWFpZUVBjMWE3RE91bVZ6OCIsIng0X2dPQXI2b2l0TnQtYllZNlVtc3ZfN3VmOG1oTTVWODEwM01xT0RnWnMiXSwiX3NkX2FsZyI6InNoYS0yNTYifQ.x9rqPagEGGhbzqq8N3xkMZrgr8ReKwVgXc31BplVl6AcHqGMwf2zczlEOb1K5R-toW0BF4LupoKZCYekgSagfw~WyJJdnBtcXY2ZEp2SUxaU2RwX2ZfdzBnIiwib3JnYW5pemF0aW9uIiwiT3BlbiBSYWlsIENvbmZvcm1hbmNlIEZpeHR1cmUiXQ~WyJNbTJQM1E0SzFfdVFiMzd6T2JyT3ZnIiwibWVtYmVyc2hpcF90aWVyIiwiZml4dHVyZSJd~eyJ0eXAiOiJrYitqd3QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL3ZlcmlmaWVyLmV4YW1wbGUvb3Blbi1yYWlsLWNvbmZvcm1hbmNlIiwibm9uY2UiOiJvcGVuLXJhaWwtY29uZm9ybWFuY2Utbm9uY2Utb25lIiwiaWF0IjoxNzY3MjI1NjAwLCJzZF9oYXNoIjoiU080cFB2anpsN0gteV9mb0k5aUY2MnJTQjZjTl9iS2Nzc1FicXhxN1BGQSJ9.wVDR4nZvqYm-cKWVi4AlO_3angipuQpvKAL9l434BgA1hPNHCdor4Iqb0cHbbBRY5njL13gdLSplX62cZ4SQMQ"},"expect":{"verdict":"reject","failure":"status_list_subject_mismatch","claims":null,"withheld":["subject_kind"]}},{"id":"malformed-presentation","about":"A string that is not a presentation at all.","proves":"Garbage is refused with a definite verdict rather than crashing, hanging, or being coerced into a decision.","input":{"didDocument":{"@context":["https://www.w3.org/ns/did/v1","https://w3id.org/security/suites/jws-2020/v1"],"id":"did:web:issuer.example","verificationMethod":[{"id":"did:web:issuer.example#key-1","type":"JsonWebKey2020","controller":"did:web:issuer.example","publicKeyJwk":{"kty":"EC","x":"j8WT02UZ4lyNpjj4bOp1mHXMVNjHREWJmKvgvip36g4","y":"HxbiemvogCSfOh92HzIVQQQ-HJKuX6igbt2C-CSi8kI","crv":"P-256"}}],"assertionMethod":["did:web:issuer.example#key-1"]},"statusList":{"uri":"https://issuer.example/status/1","token":"eyJhbGciOiJFUzI1NiIsInR5cCI6InN0YXR1c2xpc3Qrand0In0.eyJpc3MiOiJkaWQ6d2ViOmlzc3Vlci5leGFtcGxlIiwic3ViIjoiaHR0cHM6Ly9pc3N1ZXIuZXhhbXBsZS9zdGF0dXMvMSIsImlhdCI6MTc2NzIyNTYwMCwic3RhdHVzX2xpc3QiOnsiYml0cyI6MSwibHN0IjoiZUp4alloZ0ZJeGtBQUFZQUFBTSJ9fQ.h0LEKGUHLprfDTfL8-vLglA1QQ7FcFGNbltVP2kHE5bJqLi6raKQBJ0WXJ-SppwKJf6swf0NDB6zZ6mbR0GiIA"},"audience":"https://verifier.example/open-rail-conformance","nonce":"open-rail-conformance-nonce-one","expectedIssuer":"did:web:issuer.example","expectedVct":"https://issuer.example/credentials/open-rail-conformance","requiredClaims":["organization","membership_tier"],"now":1767229200,"presentation":"this-is-not-an-sd-jwt-vc-presentation"},"expect":{"verdict":"reject","failure":"malformed_presentation","claims":null,"withheld":["subject_kind"]}}]}