@coordination-network/circuits 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ethereum Foundation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/Nargo.toml

@@ -0,0 +1,12 @@
+[package]
+name = "credential"
+type = "bin"
+authors = ["Coordination Network"]
+
+[dependencies]
+poseidon = { git = "https://github.com/noir-lang/poseidon", tag = "v0.3.0" }
+# ponytail: floating on master — the latest tag (v0.1.3) still uses the removed `ec` stdlib
+# module, and nargo git deps only accept `tag`/branch, no commit pinning. Pin once upstream tags.
+eddsa = { git = "https://github.com/noir-lang/eddsa", tag = "master" }
+binary_merkle_root = { git = "https://github.com/zk-kit/zk-kit.noir", tag = "binary-merkle-root-v0.0.2", directory = "packages/binary-merkle-root" }
+lean_imt_plus = { git = "https://github.com/zk-kit/zk-kit.noir", tag = "lean-imt-plus-v0.0.1", directory = "packages/lean-imt-plus" }

package/README.md

@@ -0,0 +1,134 @@
+# Credential circuit
+
+The circuit proves that an anonymous approved issuer signed a private,
+version-one credential; the credential is valid for the required programme and
+country; the presenter controls its bound hardware, holder and revocation keys;
+and its revocation commitment is absent from a LeanIMT+ root returned by the
+proof.
+
+## Signed body
+
+The credential is the private `Credential` type in `src/types.nr`. The issuer
+signs its fixed, versioned commitment:
+
+```text
+policy = Poseidon4(
+  programme_hash,
+  country_code,
+  not_before,
+  expires_at
+)
+
+keys = Poseidon3(
+  device_key_commitment,
+  holder_key_commitment,
+  revocation_commitment
+)
+
+Poseidon3(
+  credential_domain,
+  policy,
+  keys
+)
+```
+
+The circuit reconstructs this commitment and verifies the issuer's Baby Jubjub
+EdDSA signature. It hashes the same private issuer key into a private binary
+Merkle path with ZK-Kit's `binary-merkle-root` package and returns the resulting
+root publicly, so the verifier can check it against the trusted on-chain
+approved-issuer registry without learning which issuer signed.
+
+The hardware P-256 key, Baby Jubjub holder key and separate Baby Jubjub
+revocation key all sign the private session message:
+
+```text
+Poseidon4(presentation_domain, challenge, audience, credential_commitment)
+```
+
+The P-256 signature consumes the canonical 32-byte big-endian encoding of that
+field element as its message digest. It is encoded as compact `r || s` with
+low-`s` normalization, as Noir's P-256 verifier requires. Its public key is
+private and opens the signed `device_key_commitment`, so it does not become a
+presentation identifier.
+
+Public inputs are current time, challenge, audience, required programme and
+required country. The circuit returns the proven approved-issuer and revocation
+roots as public outputs. After proof verification, the application must check
+both roots against their trusted on-chain registries.
+
+## Constraints
+
+1. Verify issuer EdDSA over the reconstructed credential commitment.
+2. Prove the same private issuer key belongs to the approved-issuer root returned publicly, over a private depth witness capped at the circuit's maximum tree depth.
+3. Check `not_before <= current_time <= expires_at`.
+4. Check the private programme and country equal the public requirements.
+5. Open the device-key commitment and verify its private P-256 session signature.
+6. Open the holder-key commitment and verify its private EdDSA session signature.
+7. Open the revocation commitment and verify its private EdDSA session signature.
+8. Prove that commitment is absent from a private LeanIMT+ witness and return
+   the resulting root publicly.
+
+The canonical empty revocation root is zero and requires a zeroed depth-zero
+witness.
+
+## Toolchain
+
+The native toolchain is pinned, and the two halves must match: a circuit
+compiled by one Noir release and proved by a barretenberg built for another
+fails inside bb's deserializer with `Length is too large`.
+
+```sh
+noirup -v 1.0.0-beta.22
+bbup -v 5.0.0
+```
+
+## Running
+
+```sh
+yarn fixtures
+yarn test
+yarn execute
+yarn test:constraints
+bb prove -b target/credential.json -w target/credential.gz -o target/proof --write_vk --verify
+```
+
+`generate-fixtures.ts` builds the deterministic circuit fixture directly. The
+credential SDK reproduces the same commitments and builds this ABI through
+`buildZkPresentationInputs`; the issuer-service end-to-end test proves and
+verifies the resulting witness.
+
+## What the npm package is for
+
+This package publishes the Noir sources so the circuit behind a published proof
+can be read, audited and rebuilt from the same inputs. It is not a Noir
+dependency: the package is a `bin` crate, and nargo rejects a dependency on one.
+
+## Published artifacts
+
+`nargo compile` writes to `target/`, which is not published. The compiled
+circuit and its verification key ship separately, in
+[`@coordination-network/zk-artifacts`](../zk-artifacts). Regenerate them from
+this circuit, and commit the result, with:
+
+```sh
+yarn sync:zk-artifacts
+```
+
+## Runtime proofs
+
+The credential package exposes `ZkCredentialProofSystem`, plus one-shot
+`generateZkPresentationProof` and `verifyZkPresentationProof` helpers. Callers
+provide the trusted compiled circuit artifact, which
+`@coordination-network/zk-artifacts` publishes as
+`credential/circuit.json`. The verifier checks the proof, independently binds
+all five public parameters to its expected time, challenge, audience, programme
+and country, and returns both proven roots to the application for its on-chain
+registry checks.
+
+The JavaScript runtime versions are pinned to the native toolchain:
+`@noir-lang/noir_js@1.0.0-beta.22` and `@aztec/bb.js@5.0.0`. A circuit upgrade
+must update these versions and regenerate the artifacts together.
+
+Nargo 1.0.0-beta.22 reports a Brillig coverage warning in `noir-edwards`
+`dbl_internal`. The dependency constrains both returned coordinates, so this is
+a compiler false positive in `noir-edwards` v0.2.5.

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@coordination-network/circuits",
+  "version": "0.0.1",
+  "description": "The coordination network's Noir circuits: the credential presentation circuit proving an approved issuer's signature, the credential policy, holder, device and revocation key possession, and revocation non-membership.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/zk-kit/coordination-network.git",
+    "directory": "packages/circuits"
+  },
+  "homepage": "https://github.com/zk-kit/coordination-network/tree/main/packages/circuits",
+  "bugs": "https://github.com/zk-kit/coordination-network/issues",
+  "files": [
+    "Nargo.toml",
+    "src/",
+    "README.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "noir",
+    "nargo",
+    "barretenberg",
+    "ultrahonk",
+    "zero-knowledge",
+    "circuit",
+    "verifiable-credentials",
+    "revocation",
+    "non-membership-proof"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "compile": "nargo compile",
+    "execute": "nargo execute",
+    "fixtures": "tsx scripts/generate-fixtures.ts",
+    "test": "nargo test",
+    "test:constraints": "tsx scripts/test-constraints.ts"
+  },
+  "devDependencies": {
+    "@noble/curves": "^1.9.7",
+    "@noble/hashes": "^1.8.0",
+    "@semaphore-protocol/identity": "^4.14.3",
+    "poseidon-lite": "0.3.0",
+    "tsx": "^4.23.0",
+    "typescript": "^6.0.3",
+    "viem": "^2.55.11"
+  }
+}

package/src/credential.nr

@@ -0,0 +1,44 @@
+use crate::types::Credential;
+use poseidon::poseidon::bn254::{hash_3, hash_4, hash_5};
+
+// keccak256(utf8("urn:cn:credential:v1")) >> 8
+global CREDENTIAL_DOMAIN: Field =
+    363566488821926773809509531830640889725124777157045803797738936823559174026;
+// Domain separator for Poseidon5(device public-key limbs).
+global DEVICE_KEY_DOMAIN: Field =
+    320507632879070882430325612169297945123468706597652794395401074724051126576;
+
+pub(crate) fn commitment(credential: Credential) -> Field {
+    let policy = hash_4([
+        credential.programme_hash,
+        credential.country_code,
+        credential.not_before as Field,
+        credential.expires_at as Field,
+    ]);
+    let keys = hash_3([
+        credential.device_key_commitment,
+        credential.holder_key_commitment,
+        credential.revocation_commitment,
+    ]);
+
+    hash_3([CREDENTIAL_DOMAIN, policy, keys])
+}
+
+pub(crate) fn device_key_commitment(public_key_x: [u8; 32], public_key_y: [u8; 32]) -> Field {
+    let x = coordinate_limbs(public_key_x);
+    let y = coordinate_limbs(public_key_y);
+
+    hash_5([DEVICE_KEY_DOMAIN, x[0], x[1], y[0], y[1]])
+}
+
+fn coordinate_limbs(coordinate: [u8; 32]) -> [Field; 2] {
+    let mut high: [u8; 16] = [0; 16];
+    let mut low: [u8; 16] = [0; 16];
+
+    for i in 0..16 {
+        high[i] = coordinate[i];
+        low[i] = coordinate[i + 16];
+    }
+
+    [Field::from_be_bytes(high), Field::from_be_bytes(low)]
+}

package/src/issuer.nr

@@ -0,0 +1,156 @@
+use binary_merkle_root::binary_merkle_root;
+use poseidon::poseidon::bn254::{hash_2, hash_3};
+
+pub(crate) global MAX_DEPTH: u32 = 20;
+
+// Domain separator for Poseidon3(issuer public key).
+global LEAF_DOMAIN: Field =
+    185404551131306766954100762329350135288498146007932686448214248919067924295;
+
+pub(crate) fn root(
+    public_key_x: Field,
+    public_key_y: Field,
+    depth: u32,
+    indices: [bool; MAX_DEPTH],
+    siblings: [Field; MAX_DEPTH],
+) -> Field {
+    assert(depth <= MAX_DEPTH, "issuer path depth exceeds the circuit maximum");
+    let leaf = hash_3([LEAF_DOMAIN, public_key_x, public_key_y]);
+    binary_merkle_root(hash_2, leaf, depth, indices, siblings)
+}
+
+// Pinned cross-language: the same leaves, roots and witnesses `packages/issuer-set/tests/cross-language.test.ts`
+// and `packages/contracts/test/integration/IssuerSetCrossLanguageRoot.t.sol` pin, computed three
+// independent ways before being copied here.
+mod tests {
+    use super::{root, MAX_DEPTH};
+    use poseidon::poseidon::bn254::hash_2;
+
+    // `k * Base8` on Baby Jubjub, for k = 1, 2, 5.
+    global KEY_1_X: Field =
+        5299619240641551281634865583518297030282874472190772894086521144482721001553;
+    global KEY_1_Y: Field =
+        16950150798460657717958625567821834550301663161624707787222815936182638968203;
+    global KEY_2_X: Field =
+        10031262171927540148667355526369034398030886437092045105752248699557385197826;
+    global KEY_2_Y: Field =
+        633281375905621697187330766174974863687049529291089048651929454608812697683;
+    global KEY_5_X: Field =
+        11480966271046430430613841218147196773252373073876138147006741179837832100836;
+    global KEY_5_Y: Field =
+        15148236048131954717802795400425086368006776860859772698778589175317365693546;
+
+    global LEAF_OF_KEY_1: Field =
+        2493720610778676091149258492386261697559719708118160248500693563612404203088;
+    global LEAF_OF_KEY_2: Field =
+        15278273562238927018842798161288898682472598529198791544673021966310311323458;
+    global LEAF_OF_KEY_3: Field =
+        20980331097734099105425623618460522669974741732319895218846623662978431137317;
+
+    global ROOT_OF_KEYS_1_TO_2: Field =
+        15680708859485847685012924683010191875504585065894243099617821723863156328943;
+    global ROOT_OF_KEYS_1_2_3: Field =
+        11334223563046274794300795549267186709638286758254539923752495560734019145426;
+    global ROOT_OF_KEYS_1_TO_4: Field =
+        1012468898015973113393162930052218519362020364191895474978289263522471748684;
+    global ROOT_OF_KEYS_1_TO_5: Field =
+        1509212439766155221370997401451147889947558708210956682611194460683115030117;
+
+    #[test]
+    fn one_key_root_is_the_leaf() {
+        let indices: [bool; MAX_DEPTH] = [false; MAX_DEPTH];
+        let siblings: [Field; MAX_DEPTH] = [0; MAX_DEPTH];
+
+        assert(root(KEY_1_X, KEY_1_Y, 0, indices, siblings) == LEAF_OF_KEY_1);
+    }
+
+    #[test]
+    fn two_keys_hash_once() {
+        let indices: [bool; MAX_DEPTH] = [false; MAX_DEPTH];
+        let mut siblings: [Field; MAX_DEPTH] = [0; MAX_DEPTH];
+        siblings[0] = LEAF_OF_KEY_2;
+
+        assert(root(KEY_1_X, KEY_1_Y, 1, indices, siblings) == ROOT_OF_KEYS_1_TO_2);
+    }
+
+    #[test]
+    fn key_2_opens_root_of_keys_1_2_3() {
+        let mut indices: [bool; MAX_DEPTH] = [false; MAX_DEPTH];
+        let mut siblings: [Field; MAX_DEPTH] = [0; MAX_DEPTH];
+        indices[0] = true;
+        siblings[0] = LEAF_OF_KEY_1;
+        siblings[1] = LEAF_OF_KEY_3;
+
+        assert(root(KEY_2_X, KEY_2_Y, 2, indices, siblings) == ROOT_OF_KEYS_1_2_3);
+    }
+
+    // Slot 4 of a five-slot set: levels 0 and 1 are promoted (no sibling), so the witness holds
+    // only the one sibling at the level that does have one.
+    #[test]
+    fn promoted_levels_are_absent_from_the_witness() {
+        let mut indices: [bool; MAX_DEPTH] = [false; MAX_DEPTH];
+        let mut siblings: [Field; MAX_DEPTH] = [0; MAX_DEPTH];
+        indices[0] = true;
+        siblings[0] = ROOT_OF_KEYS_1_TO_4;
+
+        assert(root(KEY_5_X, KEY_5_Y, 1, indices, siblings) == ROOT_OF_KEYS_1_TO_5);
+    }
+
+    #[test]
+    fn padding_tail_is_ignored() {
+        let mut indices: [bool; MAX_DEPTH] = [false; MAX_DEPTH];
+        let mut siblings: [Field; MAX_DEPTH] = [0; MAX_DEPTH];
+        siblings[0] = LEAF_OF_KEY_2;
+        // Garbage past `depth`: binary_merkle_root only folds the first `depth` levels.
+        indices[7] = true;
+        siblings[3] = 999;
+
+        assert(root(KEY_1_X, KEY_1_Y, 1, indices, siblings) == ROOT_OF_KEYS_1_TO_2);
+    }
+
+    #[test]
+    fn depth_off_by_one_changes_root() {
+        let mut indices: [bool; MAX_DEPTH] = [false; MAX_DEPTH];
+        let mut siblings: [Field; MAX_DEPTH] = [0; MAX_DEPTH];
+        indices[0] = true;
+        siblings[0] = LEAF_OF_KEY_1;
+        siblings[1] = LEAF_OF_KEY_3;
+
+        // The true witness needs depth 2; stopping one level short must not silently agree.
+        assert(root(KEY_2_X, KEY_2_Y, 1, indices, siblings) != ROOT_OF_KEYS_1_2_3);
+    }
+
+    #[test(should_fail_with = "issuer path depth exceeds the circuit maximum")]
+    fn rejects_depth_above_max() {
+        let indices: [bool; MAX_DEPTH] = [false; MAX_DEPTH];
+        let siblings: [Field; MAX_DEPTH] = [0; MAX_DEPTH];
+
+        let _ = root(KEY_1_X, KEY_1_Y, MAX_DEPTH + 1, indices, siblings);
+    }
+
+    #[test]
+    fn accepts_depth_at_max() {
+        let indices: [bool; MAX_DEPTH] = [false; MAX_DEPTH];
+        let siblings: [Field; MAX_DEPTH] = [0; MAX_DEPTH];
+
+        let mut expected = LEAF_OF_KEY_1;
+        for _ in 0..MAX_DEPTH {
+            expected = hash_2([expected, 0]);
+        }
+
+        assert(root(KEY_1_X, KEY_1_Y, MAX_DEPTH, indices, siblings) == expected);
+    }
+
+    // key_2_opens_root_of_keys_1_2_3's own witness is only valid at depth 2; running it one level
+    // too deep must not silently still agree with ROOT_OF_KEYS_1_2_3.
+    #[test]
+    fn depth_above_the_true_one_changes_root() {
+        let mut indices: [bool; MAX_DEPTH] = [false; MAX_DEPTH];
+        let mut siblings: [Field; MAX_DEPTH] = [0; MAX_DEPTH];
+        indices[0] = true;
+        siblings[0] = LEAF_OF_KEY_1;
+        siblings[1] = LEAF_OF_KEY_3;
+
+        assert(root(KEY_2_X, KEY_2_Y, 3, indices, siblings) != ROOT_OF_KEYS_1_2_3);
+    }
+}

package/src/main.nr

@@ -0,0 +1,159 @@
+mod credential;
+mod issuer;
+mod types;
+
+use eddsa::eddsa_verify;
+use issuer::MAX_DEPTH as ISSUER_SET_MAX_DEPTH;
+use lean_imt_plus::lean_imt_plus_root;
+use poseidon::poseidon::bn254::{hash_2, hash_3, hash_4};
+use poseidon::poseidon::PoseidonHasher;
+use types::Credential;
+
+global REVOCATION_MAX_DEPTH: u32 = 20;
+// keccak256(utf8("urn:cn:presentation:v1")) >> 8
+global PRESENTATION_DOMAIN: Field =
+    47717037732995119958831198142288202228464361330145547649000821135537239485;
+
+fn main(
+    current_time: pub u64,
+    challenge: pub Field,
+    audience: pub Field,
+    required_programme_hash: pub Field,
+    required_country_code: pub Field,
+    credential: Credential,
+    issuer_pub_x: Field,
+    issuer_pub_y: Field,
+    issuer_sig_r8_x: Field,
+    issuer_sig_r8_y: Field,
+    issuer_sig_s: Field,
+    issuer_depth: u32,
+    issuer_indices: [bool; ISSUER_SET_MAX_DEPTH],
+    issuer_siblings: [Field; ISSUER_SET_MAX_DEPTH],
+    device_pub_x: [u8; 32],
+    device_pub_y: [u8; 32],
+    device_signature: [u8; 64],
+    identity_pub_x: Field,
+    identity_pub_y: Field,
+    identity_sig_r8_x: Field,
+    identity_sig_r8_y: Field,
+    identity_sig_s: Field,
+    revocation_pub_x: Field,
+    revocation_pub_y: Field,
+    revocation_sig_r8_x: Field,
+    revocation_sig_r8_y: Field,
+    revocation_sig_s: Field,
+    revocation_low_leaf_value: Field,
+    revocation_low_leaf_next: Field,
+    revocation_depth: u32,
+    revocation_indices: [bool; REVOCATION_MAX_DEPTH],
+    revocation_siblings: [Field; REVOCATION_MAX_DEPTH],
+) -> pub (Field, Field) {
+    let credential_message = credential::commitment(credential);
+
+    assert(
+        eddsa_verify::<PoseidonHasher>(
+            issuer_pub_x,
+            issuer_pub_y,
+            issuer_sig_s,
+            issuer_sig_r8_x,
+            issuer_sig_r8_y,
+            credential_message,
+        ),
+        "invalid issuer signature",
+    );
+    let approved_issuer_root =
+        issuer::root(issuer_pub_x, issuer_pub_y, issuer_depth, issuer_indices, issuer_siblings);
+
+    assert(credential.not_before <= current_time, "credential is not yet valid");
+    assert(current_time <= credential.expires_at, "credential has expired");
+    assert_eq(credential.programme_hash, required_programme_hash, "programme does not match");
+    assert_eq(credential.country_code, required_country_code, "country does not match");
+
+    let session_message = hash_4(
+        [PRESENTATION_DOMAIN, challenge, audience, credential_message],
+    );
+    let session_message_bytes: [u8; 32] = session_message.to_be_bytes();
+    assert_eq(
+        credential::device_key_commitment(device_pub_x, device_pub_y),
+        credential.device_key_commitment,
+        "device key does not open the credential commitment",
+    );
+    assert(
+        std::ecdsa_secp256r1::verify_signature(
+            device_pub_x,
+            device_pub_y,
+            device_signature,
+            session_message_bytes,
+        ),
+        "invalid device signature",
+    );
+
+    assert_eq(
+        hash_2([identity_pub_x, identity_pub_y]),
+        credential.holder_key_commitment,
+        "identity key does not open the credential commitment",
+    );
+    assert(
+        eddsa_verify::<PoseidonHasher>(
+            identity_pub_x,
+            identity_pub_y,
+            identity_sig_s,
+            identity_sig_r8_x,
+            identity_sig_r8_y,
+            session_message,
+        ),
+        "invalid identity signature",
+    );
+
+    assert_eq(
+        hash_2([revocation_pub_x, revocation_pub_y]),
+        credential.revocation_commitment,
+        "revocation key does not open the credential commitment",
+    );
+    assert(
+        eddsa_verify::<PoseidonHasher>(
+            revocation_pub_x,
+            revocation_pub_y,
+            revocation_sig_s,
+            revocation_sig_r8_x,
+            revocation_sig_r8_y,
+            session_message,
+        ),
+        "invalid revocation-key signature",
+    );
+
+    let revocation_root = lean_imt_plus_root(
+        hash_3,
+        hash_2,
+        true,
+        credential.revocation_commitment,
+        revocation_low_leaf_value,
+        revocation_low_leaf_next,
+        revocation_depth,
+        revocation_indices,
+        revocation_siblings,
+    );
+    let empty_registry = revocation_depth == 0;
+    assert(!empty_registry | (revocation_low_leaf_value == 0), "invalid empty revocation witness");
+    assert(!empty_registry | (revocation_low_leaf_next == 0), "invalid empty revocation witness");
+    for i in 0..REVOCATION_MAX_DEPTH {
+        assert(!empty_registry | !revocation_indices[i], "invalid empty revocation witness");
+        assert(!empty_registry | (revocation_siblings[i] == 0), "invalid empty revocation witness");
+    }
+
+    let canonical_revocation_root = if empty_registry { 0 } else { revocation_root };
+
+    (approved_issuer_root, canonical_revocation_root)
+}
+
+#[test]
+fn accepts_zk_kit_vector() {
+    let pub_x = 17145850796026918084964381264224969058280635207741849259441085610619323268793;
+    let pub_y = 12739136082614649000971099828843750903333050161922102230327542411762042864532;
+    let r8_x = 15524625270731079305966391574257085402945890677596245735016312557711871251745;
+    let r8_y = 21851585646035144628054782655502377976073920894610191532514047740161645049816;
+    let s = 546000471566828313746526008704952611728577210855060032957183501675256683918;
+
+    assert(eddsa_verify::<PoseidonHasher>(pub_x, pub_y, s, r8_x, r8_y, 42));
+    assert(!eddsa_verify::<PoseidonHasher>(pub_x, pub_y, s, r8_x, r8_y, 43));
+}

package/src/types.nr

@@ -0,0 +1,9 @@
+pub struct Credential {
+    pub(crate) programme_hash: Field,
+    pub(crate) country_code: Field,
+    pub(crate) not_before: u64,
+    pub(crate) expires_at: u64,
+    pub(crate) device_key_commitment: Field,
+    pub(crate) holder_key_commitment: Field,
+    pub(crate) revocation_commitment: Field,
+}