openid4vp 0.1.0

data/lib/openid4vp/formats/ldp_vc.rb

@@ -0,0 +1,160 @@
+# frozen_string_literal: true
+
+require "time"
+require_relative "../formats"
+require_relative "base"
+require_relative "verified_presentation"
+require_relative "registry"
+require_relative "../errors"
+require_relative "../credential"
+
+module OpenID4VP
+  module Formats
+    # OpenID4VP Appendix B.1.3.2: the `ldp_vc` (W3C Verifiable Credential
+    # secured with a Data Integrity proof, using JSON-LD) Credential Format
+    # handler.
+    #
+    # A real deployment MUST inject the `:ldp_proof_signer` (holder-side)
+    # and `:ldp_proof_verifier` (verifier-side) `Context#trust` hooks: this
+    # gem does not implement JSON-LD normalization / Data Integrity
+    # cryptosuites itself. Without `:ldp_proof_signer`,
+    # `#build_presentation` emits a placeholder, unverifiable proof.
+    class LdpVc < Base
+      FORMAT_ID = "ldp_vc"
+      VP_CONTEXT = ["https://www.w3.org/2018/credentials/v1"].freeze
+
+      def self.format_id
+        FORMAT_ID
+      end
+
+      # Wraps an already-issued LDP VC Hash into a wallet-side
+      # `OpenID4VP::Credential`.
+      def self.credential_from(vc_hash, holder_key: nil)
+        raise OpenID4VP::PresentationInvalid, "ldp_vc: credential must be an object" unless vc_hash.is_a?(::Hash)
+
+        OpenID4VP::Credential.new(
+          format: FORMAT_ID,
+          claims: vc_hash,
+          raw: vc_hash,
+          holder_key: holder_key,
+          metadata: { "type" => vc_hash["type"], "issuer" => vc_hash["issuer"] }
+        )
+      end
+
+      # Builds a Verifiable Presentation Hash for `credential`. The Data
+      # Integrity proof comes from the `:ldp_proof_signer` trust hook
+      # (callable `(vp_without_proof, challenge:, domain:) -> proof Hash`)
+      # when configured, else a placeholder, unverifiable proof.
+      def build_presentation(credential, _claims_queries, context)
+        holder_id = credential.metadata["holder"] || holder_id_from_key(credential.holder_key)
+        vp = {
+          "@context" => VP_CONTEXT,
+          "type" => ["VerifiablePresentation"],
+          "verifiableCredential" => [credential.raw],
+          "holder" => holder_id
+        }.compact
+
+        signer = context.trust_hook(:ldp_proof_signer)
+        proof = signer&.call(vp, challenge: context.nonce, domain: context.audience) ||
+                placeholder_proof(context)
+        vp.merge("proof" => proof)
+      end
+
+      # Verifies `presentation` (a Verifiable Presentation Hash) against
+      # `context`. Raises ConfigurationError when holder binding is
+      # required but no `:ldp_proof_verifier` trust hook is configured.
+      def verify_presentation(presentation, context)
+        raise OpenID4VP::PresentationInvalid, "ldp_vc: presentation must be an object" unless presentation.is_a?(::Hash)
+
+        proof = presentation["proof"]
+        verified = verify_proof!(proof, presentation, context)
+
+        vc = single_verifiable_credential(presentation)
+
+        VerifiedPresentation.new(
+          format: FORMAT_ID,
+          claims: vc,
+          holder_bound: verified,
+          issuer: issuer_id(vc["issuer"]),
+          raw: presentation,
+          metadata: { "type" => vc["type"], "issuer" => vc["issuer"] },
+          details: { proof_type: proof.is_a?(::Hash) ? proof["type"] : nil,
+                     cryptosuite: proof.is_a?(::Hash) ? proof["cryptosuite"] : nil }
+        )
+      end
+
+      # OpenID4VP Appendix B.1.3.2.3: `proof_type_values` restricts the
+      # Data Integrity proof's `type`; `cryptosuite_values` restricts its
+      # `cryptosuite` (when present).
+      def check_vp_formats!(verified, vp_formats)
+        return if vp_formats.nil?
+
+        params = vp_formats.params_for(FORMAT_ID)
+        return if params.nil?
+
+        alg_allowed!(params["proof_type_values"], verified.details[:proof_type], "proof_type_values")
+        alg_allowed!(params["cryptosuite_values"], verified.details[:cryptosuite], "cryptosuite_values")
+      end
+
+      private
+
+      def holder_id_from_key(holder_key)
+        return nil if holder_key.nil?
+
+        "did:jwk:#{holder_key.thumbprint_b64}"
+      end
+
+      def placeholder_proof(context)
+        {
+          "type" => "DataIntegrityProof",
+          "proofPurpose" => "authentication",
+          "challenge" => context.nonce,
+          "domain" => context.audience,
+          "created" => Time.now.utc.iso8601,
+          "proofValue" => "unverified"
+        }
+      end
+
+      # Raises on a malformed/mismatched proof; returns whether the proof
+      # was cryptographically verified (bang convention, matching
+      # OpenID4VP::TransactionData::SdJwtHashes.verify!).
+      # rubocop:disable Naming/PredicateMethod -- bang convention (raise on
+      # failure, return a boolean), matching TransactionData::SdJwtHashes.verify!.
+      def verify_proof!(proof, presentation, context)
+        raise OpenID4VP::PresentationInvalid, "ldp_vc: presentation has no proof" unless proof.is_a?(::Hash)
+        raise OpenID4VP::HolderBindingInvalid, "ldp_vc: challenge mismatch" unless proof["challenge"] == context.nonce
+        raise OpenID4VP::HolderBindingInvalid, "ldp_vc: domain mismatch" unless proof["domain"] == context.audience
+
+        # Not cryptographically verified: the proof's presence/shape is
+        # confirmed above, but without :ldp_proof_verifier no Data
+        # Integrity signature has actually been checked.
+        return false unless context.require_holder_binding
+
+        verifier = context.trust_hook(:ldp_proof_verifier)
+        raise OpenID4VP::ConfigurationError, "ldp_proof_verifier trust hook required" if verifier.nil?
+
+        unless verifier.call(presentation, context)
+          raise OpenID4VP::HolderBindingInvalid, "ldp_vc: proof verification failed"
+        end
+
+        true
+      end
+      # rubocop:enable Naming/PredicateMethod
+
+      def single_verifiable_credential(presentation)
+        vcs = presentation["verifiableCredential"]
+        unless vcs.is_a?(::Array) && vcs.size == 1 && vcs.first.is_a?(::Hash)
+          raise OpenID4VP::PresentationInvalid, "ldp_vc: verifiableCredential must be an array of exactly one object"
+        end
+
+        vcs.first
+      end
+
+      def issuer_id(issuer)
+        issuer.is_a?(::Hash) ? issuer["id"] : issuer
+      end
+    end
+
+    Registry.default_handlers << LdpVc unless Registry.default_handlers.include?(LdpVc)
+  end
+end

data/lib/openid4vp/formats/mso_mdoc.rb

@@ -0,0 +1,204 @@
+# frozen_string_literal: true
+
+require_relative "../formats"
+require_relative "base"
+require_relative "verified_presentation"
+require_relative "registry"
+require_relative "../errors"
+require_relative "../credential"
+require_relative "../jose/jwk"
+require_relative "../mdoc/device_response"
+require_relative "../mdoc/verifier"
+require_relative "../mdoc/builder"
+require_relative "../mdoc/session_transcript"
+require_relative "../x509/chain_validator"
+
+module OpenID4VP
+  module Formats
+    # OpenID4VP Appendix B.2: the `mso_mdoc` (ISO/IEC 18013-5 mdoc) Credential
+    # Format handler.
+    class MsoMdoc < Base
+      FORMAT_ID = "mso_mdoc"
+
+      # OpenID4VP §B.2.2: a value in `issuerauth_alg_values`/
+      # `deviceauth_alg_values` also matches when it is the "fully specified
+      # algorithm" ([I-D.ietf-jose-fully-specified-algorithms]) equivalent of
+      # the actual COSE `alg`, for the curve of the signing key: -7 (ES256)
+      # <=> -9 on a P-256 key, -35 (ES384) <=> -51 on a P-384 key, -36
+      # (ES512) <=> -52 on a P-521 key.
+      FULLY_SPECIFIED_EQUIVALENTS = {
+        "P-256" => { -7 => -9, -9 => -7 },
+        "P-384" => { -35 => -51, -51 => -35 },
+        "P-521" => { -36 => -52, -52 => -36 }
+      }.freeze
+
+      def self.format_id
+        FORMAT_ID
+      end
+
+      # Wraps a freshly-issued IssuerSigned (e.g. from
+      # `Mdoc::Builder.issue`) into a wallet-side `OpenID4VP::Credential`.
+      def self.credential_from(issuer_signed, doc_type:, device_key:)
+        claims = issuer_signed.name_spaces.transform_values do |items|
+          items.to_h { |item| [item.element_identifier, item.element_value] }
+        end
+
+        OpenID4VP::Credential.new(
+          format: FORMAT_ID, claims: claims, raw: issuer_signed, holder_key: device_key,
+          x5chain: issuer_signed.x5chain, metadata: { "doctype" => doc_type }
+        )
+      end
+
+      # Builds a base64url-encoded DeviceResponse for `credential` (an
+      # IssuerSigned wrapped via `.credential_from`), disclosing exactly the
+      # namespace/element pairs addressed by `claims_queries` (empty/nil:
+      # discloses nothing). Requires `credential.holder_key` (the mdoc
+      # device's private key).
+      def build_presentation(credential, claims_queries, context)
+        raise OpenID4VP::HolderBindingInvalid, "credential has no holder key" if credential.holder_key.nil?
+
+        OpenID4VP::Mdoc::Builder.device_response(
+          issuer_signed: credential.raw,
+          doc_type: credential.metadata["doctype"],
+          disclose: disclose_map(claims_queries),
+          device_key: credential.holder_key,
+          session_transcript: session_transcript(context)
+        ).to_b64url
+      end
+
+      # Verifies `presentation` (a base64url-encoded DeviceResponse String,
+      # OpenID4VP §B.2.5) against `context`. Raises ConfigurationError when
+      # no `:mdoc_trust_anchors` trust hook is configured.
+      def verify_presentation(presentation, context)
+        unless presentation.is_a?(::String)
+          raise OpenID4VP::PresentationInvalid, "mso_mdoc: presentation must be a string"
+        end
+
+        document = single_document(parse_device_response(presentation))
+        result = verify_document(document, context)
+
+        VerifiedPresentation.new(
+          format: FORMAT_ID,
+          claims: result.claims,
+          holder_bound: true,
+          issuer: result.issuer_certs.first.subject.to_s,
+          raw: presentation,
+          x5chain: result.issuer_certs,
+          metadata: { "doctype" => result.doc_type },
+          details: { issuer_alg: result.issuer_alg, device_alg: result.device_alg, device_key: result.device_key }
+        )
+      end
+
+      # OpenID4VP §B.2.2: `issuerauth_alg_values` restricts the IssuerAuth
+      # COSE_Sign1's `alg`; `deviceauth_alg_values` restricts the
+      # DeviceSignature COSE_Sign1's `alg`. Both also accept the alg's fully
+      # specified equivalent for the actual signing key's curve.
+      def check_vp_formats!(verified, vp_formats)
+        return if vp_formats.nil?
+
+        params = vp_formats.params_for(FORMAT_ID)
+        return if params.nil?
+
+        check_alg!(params["issuerauth_alg_values"], verified.details[:issuer_alg], issuer_curve(verified),
+                   "issuerauth_alg_values")
+        check_alg!(params["deviceauth_alg_values"], verified.details[:device_alg], device_curve(verified),
+                   "deviceauth_alg_values")
+      end
+
+      private
+
+      def disclose_map(claims_queries)
+        (claims_queries || []).each_with_object({}) do |claims_query, disclose|
+          namespace, element = claims_query.path.mdoc_components
+          (disclose[namespace] ||= []) << element
+        end
+      end
+
+      # OpenID4VP §B.2.6: the SessionTranscript array binding the
+      # DeviceResponse to this OpenID4VP exchange -- OpenID4VPHandover for a
+      # redirect-based request, OpenID4VPDCAPIHandover for a Digital
+      # Credentials API request.
+      def session_transcript(context)
+        if context.dc_api
+          if context.origin.nil?
+            raise OpenID4VP::ConfigurationError, "mso_mdoc: origin is required for dc_api presentations"
+          end
+
+          OpenID4VP::Mdoc::SessionTranscript.for_dc_api(
+            origin: context.origin, nonce: context.nonce, encryption_jwk: context.encryption_jwk
+          )
+        else
+          if context.client_id.nil? || context.response_uri.nil?
+            raise OpenID4VP::ConfigurationError,
+                  "mso_mdoc: client_id and response_uri are required for redirect-based presentations"
+          end
+
+          OpenID4VP::Mdoc::SessionTranscript.for_request(
+            client_id: context.client_id.to_s, nonce: context.nonce, response_uri: context.response_uri,
+            encryption_jwk: context.encryption_jwk
+          )
+        end
+      end
+
+      def parse_device_response(presentation)
+        OpenID4VP::Mdoc::DeviceResponse.parse_b64url(presentation)
+      rescue OpenID4VP::InvalidRequest, OpenID4VP::InvalidResponse => e
+        raise OpenID4VP::PresentationInvalid, "mso_mdoc: #{e.message}"
+      end
+
+      def single_document(device_response)
+        documents = device_response.documents
+        if documents.size != 1
+          raise OpenID4VP::PresentationInvalid,
+                "mso_mdoc: DeviceResponse must contain exactly one document, got #{documents.size}"
+        end
+
+        documents.first
+      end
+
+      def verify_document(document, context)
+        trust_anchors = context.trust_hook(:mdoc_trust_anchors)
+        if trust_anchors.nil? || Array(trust_anchors).empty?
+          raise OpenID4VP::ConfigurationError, "mdoc_trust_anchors trust hook required"
+        end
+
+        validator = lambda do |chain|
+          OpenID4VP::X509::ChainValidator.new(trust_anchors: trust_anchors, time: context.now).validate!(chain)
+        end
+
+        # Mdoc::Verifier.verify itself raises correctly-typed
+        # OpenID4VP::PresentationInvalid / OpenID4VP::HolderBindingInvalid
+        # for every Credential-side/Holder Binding failure -- nothing to map
+        # here.
+        OpenID4VP::Mdoc::Verifier.verify(
+          document, session_transcript: session_transcript(context), issuer_cert_validator: validator,
+                    now: context.now
+        )
+      end
+
+      # Substitutes `alg`'s fully specified equivalent (for `curve`) when
+      # `values` does not already include `alg` directly, then delegates to
+      # `Base#alg_allowed!` for the actual restriction check/error.
+      def check_alg!(values, alg, curve, param_name)
+        return if values.nil? || alg.nil?
+
+        candidate = values.include?(alg) ? alg : (FULLY_SPECIFIED_EQUIVALENTS.dig(curve, alg) || alg)
+        alg_allowed!(values, candidate, param_name)
+      end
+
+      def issuer_curve(verified)
+        leaf = verified.x5chain.first
+        return nil if leaf.nil?
+
+        OpenID4VP::JOSE::JWK.from_openssl(leaf.public_key).crv
+      end
+
+      def device_curve(verified)
+        verified.details[:device_key]&.crv
+      end
+    end
+
+    OpenID4VP::Formats::Registry.default_handlers << OpenID4VP::Formats::MsoMdoc unless
+      OpenID4VP::Formats::Registry.default_handlers.include?(OpenID4VP::Formats::MsoMdoc)
+  end
+end

data/lib/openid4vp/formats/registry.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require_relative "../formats"
+require_relative "../errors"
+
+module OpenID4VP
+  module Formats
+    # A collection of `Base` handler instances, keyed by Credential Format
+    # Identifier (`#format_id`).
+    class Registry
+      # Handler CLASSES (not instances) registered by `.default`. Each
+      # format handler's own file appends itself here at load time; a
+      # caller assembling a custom Registry may also append/remove entries
+      # before calling `.default`.
+      def self.default_handlers
+        @default_handlers ||= []
+      end
+
+      # A new Registry with one instance of each of `default_handlers`
+      # registered.
+      def self.default
+        registry = new
+        default_handlers.each { |handler_class| registry.register(handler_class.new) }
+        registry
+      end
+
+      def initialize
+        @handlers = {}
+      end
+
+      def register(handler)
+        @handlers[handler.format_id] = handler
+        self
+      end
+
+      # The handler for `format` (a Credential Format Identifier String).
+      # Raises VpFormatsNotSupported when none is registered.
+      def for(format)
+        @handlers.fetch(format) do
+          raise OpenID4VP::VpFormatsNotSupported, "unsupported credential format: #{format}"
+        end
+      end
+
+      def supports?(format)
+        @handlers.key?(format)
+      end
+
+      def formats
+        @handlers.keys
+      end
+    end
+  end
+end

data/lib/openid4vp/formats/sd_jwt_vc.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+require_relative "../formats"
+require_relative "base"
+require_relative "verified_presentation"
+require_relative "registry"
+require_relative "../errors"
+require_relative "../credential"
+require_relative "../x509"
+require_relative "../jose/jws"
+require_relative "../sd_jwt/presentation"
+require_relative "../sd_jwt/parser"
+require_relative "../sd_jwt/reconstruct"
+
+module OpenID4VP
+  module Formats
+    # OpenID4VP Appendix B.3: the `dc+sd-jwt` (IETF SD-JWT VC) Credential
+    # Format handler.
+    class SdJwtVc < Base
+      FORMAT_ID = "dc+sd-jwt"
+
+      def self.format_id
+        FORMAT_ID
+      end
+
+      # Parses+reconstructs the FULL (unverified) claims of an issued SD-JWT
+      # (Issuer + all disclosures, no signature/holder-binding check) into a
+      # wallet-side `OpenID4VP::Credential`, e.g. right after issuance.
+      def self.credential_from(sd_jwt_string, holder_key: nil)
+        parsed = OpenID4VP::SdJwt::Parser.parse(sd_jwt_string)
+        peeked = OpenID4VP::JOSE::JWS.peek(parsed.issuer_jwt)
+        payload = peeked.payload
+        raise OpenID4VP::PresentationInvalid, "sd-jwt: payload is not a JSON object" unless payload.is_a?(::Hash)
+
+        sd_alg = payload["_sd_alg"] || "sha-256"
+        claims, = OpenID4VP::SdJwt::Reconstruct.claims(payload, parsed.disclosures, sd_alg)
+
+        OpenID4VP::Credential.new(
+          format: FORMAT_ID,
+          claims: claims,
+          raw: sd_jwt_string,
+          holder_key: holder_key,
+          x5chain: x5chain_from_header(peeked.header),
+          metadata: { "vct" => payload["vct"], "issuer" => payload["iss"] }
+        )
+      end
+
+      def self.x5chain_from_header(header)
+        x5c = header["x5c"]
+        return [] unless x5c.is_a?(::Array)
+
+        OpenID4VP::X509.certs_from_x5c(x5c)
+      end
+      private_class_method :x5chain_from_header
+
+      # Verifies `presentation` (a `"<issuer-jwt>~<disclosures>~[<kb-jwt>]"`
+      # String) against `context`. Raises ConfigurationError when no
+      # `:sd_jwt_issuer_keys` trust hook is configured.
+      def verify_presentation(presentation, context)
+        unless presentation.is_a?(::String)
+          raise OpenID4VP::PresentationInvalid, "dc+sd-jwt: presentation must be a string"
+        end
+
+        resolver = context.trust_hook(:sd_jwt_issuer_keys)
+        raise OpenID4VP::ConfigurationError, "sd_jwt_issuer_keys trust hook required" if resolver.nil?
+
+        result = OpenID4VP::SdJwt::Presentation.verify(
+          presentation,
+          issuer_key_resolver: resolver,
+          expected_nonce: context.nonce,
+          expected_aud: context.audience,
+          require_kb: context.require_holder_binding,
+          now: context.now,
+          leeway: context.leeway,
+          transaction_data: context.transaction_data
+        )
+
+        VerifiedPresentation.new(
+          format: FORMAT_ID,
+          claims: result.claims,
+          holder_bound: !result.kb_payload.nil?,
+          issuer: result.issuer,
+          raw: presentation,
+          x5chain: result.x5chain || [],
+          metadata: { "vct" => result.vct },
+          details: { alg: result.alg, kb_alg: result.kb_alg, kb_payload: result.kb_payload }
+        )
+      end
+
+      # OpenID4VP Appendix B.3.4: `sd-jwt_alg_values` restricts the
+      # Issuer-signed JWT's `alg`; `kb-jwt_alg_values` restricts the Key
+      # Binding JWT's `alg` (only enforced when the Presentation is holder
+      # bound).
+      def check_vp_formats!(verified, vp_formats)
+        return if vp_formats.nil?
+
+        params = vp_formats.params_for(FORMAT_ID)
+        return if params.nil?
+
+        alg_allowed!(params["sd-jwt_alg_values"], verified.details[:alg], "sd-jwt_alg_values")
+        return unless verified.holder_bound
+
+        alg_allowed!(params["kb-jwt_alg_values"], verified.details[:kb_alg], "kb-jwt_alg_values")
+      end
+
+      # Builds a Presentation for `credential` disclosing the claims
+      # addressed by `claims_queries` (may be empty/nil: only mandatory,
+      # always-disclosed claims are revealed). Binds with a Key Binding JWT
+      # whenever `credential.holder_key` is available (regardless of
+      # `context.require_holder_binding` -- binding when possible is always
+      # at least as strong as not binding); otherwise falls back to a plain
+      # (unbound) Presentation when `context.require_holder_binding` is
+      # false, or raises `HolderBindingInvalid` when it is true.
+      def build_presentation(credential, claims_queries, context)
+        paths = (claims_queries || []).map(&:path)
+
+        if credential.holder_key
+          OpenID4VP::SdJwt::Presentation.present(
+            credential.raw, paths: paths, holder_key: credential.holder_key, aud: context.audience,
+                            nonce: context.nonce, transaction_data: context.transaction_data
+          )
+        elsif !context.require_holder_binding
+          OpenID4VP::SdJwt::Presentation.select(credential.raw, paths: paths)
+        else
+          raise OpenID4VP::HolderBindingInvalid, "credential has no holder key"
+        end
+      end
+    end
+
+    Registry.default_handlers << SdJwtVc unless Registry.default_handlers.include?(SdJwtVc)
+  end
+end

data/lib/openid4vp/formats/verified_presentation.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require_relative "../formats"
+require_relative "../credential"
+
+module OpenID4VP
+  module Formats
+    # The result of `Base#verify_presentation`: a single Presentation's
+    # verified content, format-agnostic enough for `DCQL::Evaluator` (via
+    # `#to_credential`) and for the Verifier's response handling. Immutable.
+    class VerifiedPresentation
+      attr_reader :format, :claims, :holder_bound, :issuer, :raw, :x5chain, :metadata, :details
+
+      # format: the Credential Format Identifier, e.g. "dc+sd-jwt".
+      # claims: JSON-like Hash of the Credential's (disclosed) claims; for
+      #   mso_mdoc, {namespace => {element => value}}.
+      # holder_bound: whether this Presentation carried a verified proof of
+      #   Holder Binding (a Key Binding JWT, a Data Integrity proof, ...).
+      # raw: the exact Presentation that was verified.
+      # x5chain: Array of OpenSSL::X509::Certificate, leaf first.
+      # metadata: format-specific descriptors, e.g. {"vct"=>...}.
+      # details: format-specific extras later tasks read, e.g. {alg:,
+      #   kb_alg:, kb_payload:} for dc+sd-jwt.
+      def initialize(format:, claims:, holder_bound:, raw:, issuer: nil, x5chain: [], metadata: {}, details: {})
+        @format = format
+        @claims = claims
+        @holder_bound = holder_bound
+        @issuer = issuer
+        @raw = raw
+        @x5chain = x5chain.dup.freeze
+        @metadata = metadata.dup.freeze
+        @details = details.dup.freeze
+        freeze
+      end
+
+      def holder_bound?
+        holder_bound
+      end
+
+      def to_credential
+        OpenID4VP::Credential.new(format: format, claims: claims, raw: raw, x5chain: x5chain, metadata: metadata)
+      end
+    end
+  end
+end

data/lib/openid4vp/formats.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module OpenID4VP
+  # The pluggable layer between the OpenID4VP protocol (Verifier/Wallet) and
+  # each Credential Format (`dc+sd-jwt`, `jwt_vc_json`, `ldp_vc`,
+  # `mso_mdoc`, ...): a `Registry` of `Base` subclass instances, one per
+  # supported Credential Format Identifier, each translating a raw
+  # Presentation into a `VerifiedPresentation` / `OpenID4VP::Credential` (or
+  # the reverse, when building one).
+  module Formats
+  end
+end

data/lib/openid4vp/jose/algorithms.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require_relative "../jose"
+require_relative "../errors"
+
+module OpenID4VP
+  module JOSE
+    # JWS algorithm helpers: default alg selection per key and alg/key
+    # compatibility checks.
+    module Algorithms
+      SIGNING = %w[ES256 ES384 ES512 RS256 PS256 EdDSA].freeze
+
+      KEY_MANAGEMENT = %w[ECDH-ES ECDH-ES+A128KW ECDH-ES+A256KW].freeze
+
+      CONTENT_ENCRYPTION = %w[A128GCM A256GCM A128CBC-HS256].freeze
+
+      EC_ALG_FOR_CRV = { "P-256" => "ES256", "P-384" => "ES384", "P-521" => "ES512" }.freeze
+
+      module_function
+
+      # The default JWS `alg` to use for signing with `jwk`.
+      def for_key(jwk)
+        case jwk.kty
+        when "EC" then EC_ALG_FOR_CRV.fetch(jwk.crv) { raise OpenID4VP::InvalidRequest, "unsupported EC curve #{jwk.crv}" }
+        when "OKP" then "EdDSA"
+        when "RSA" then "RS256"
+        else raise OpenID4VP::InvalidRequest, "jose: unsupported kty #{jwk.kty.inspect} for signing"
+        end
+      end
+
+      # Whether `alg` is a JWS algorithm that can be used with `jwk`.
+      def key_matches?(alg, jwk)
+        case alg
+        when "ES256", "ES384", "ES512"
+          jwk.kty == "EC" && EC_ALG_FOR_CRV[jwk.crv] == alg
+        when "RS256", "PS256"
+          jwk.kty == "RSA"
+        when "EdDSA"
+          jwk.kty == "OKP" && jwk.crv == "Ed25519"
+        else
+          false
+        end
+      end
+    end
+  end
+end