5. Verifiable Presentation compatibility¶

A Verifiable Presentation is data derived from one or more Verifiable Credentials, packaged by a holder in a way that allows the authorship of the data to be verified.

As with Verifiable Credential compatibility, these criteria apply to any Verifiable Presentation. They do not assume a Gaia-X ecosystem, the Gaia-X Ontology, SHACL, or a registry.

Verifiable Presentation compatibility reuses the applicable Verifiable Credential compatibility checks for the presentation envelope and adds requirements for holder binding and contained Verifiable Credentials.

A Verifiable Presentation is technically compatible only if it satisfies all applicable criteria in this chapter and every Verifiable Credential contained within it satisfies all applicable criteria of the Verifiable Credential compatibility chapter.

The verification method for every criterion in this chapter is Automated: conformity can be established entirely by a conformant software agent (validator, compliance engine or test suite), based on the artefact under assessment (here: the verifiable presentation) and the resources to which it resolves.

Because the criteria are ecosystem-neutral, the primary source cited for each criterion is the open standard that defines the relevant requirement. Where a Gaia-X deliverable adopts or further constrains the corresponding requirement, it is cited after the standard:

1. Architecture Document 3.1
2. ICAM Document 25.11
3. Data Exchange Document 25.07

5.1 VP-1 Presentation envelope¶

The presentation envelope is verified using the corresponding signature and identity-resolution checks defined in VC-1 and VC-2, with the holder taking the role corresponding to the issuer.

5.1.1 VP-1.1 VC-JWT encoding of the presentation¶

Presentation encoding shall use VC-JWT, with the cryptographic proof constructed using JSON Web Signature (JWS), such that payload, header and signature can be verified for authenticity and integrity.

5.1.2 VP-1.2 Signature algorithm declaration¶

The alg property of the presentation shall be specified and its value shall comply with IETF RFC 7518 (JSON Web Algorithms).

5.1.3 VP-1.3 Holder identity resolution¶

The identifier specified for the holder in the presentation shall use the did:web method and shall resolve over HTTPS to a well-formed DID document publishing a publicKeyJwk parameter or a jwks_uri resolving to a JSON Web Key Set (JWKS).

5.1.4 VP-1.4 Presentation signature verification¶

The JWS signature of the presentation shall verify against the key material resolved from the holder’s identity record, and the verification method used shall be listed in the resolved DID document.

5.1.5 VP-1.5 Token validity period¶

Where the exp (expiration date) claim is present in the presentation, its value shall represent a time later than the time of verification; where the claim is absent, the check shall be skipped.

5.1.6 VP-1.6 Unique identifier¶

Each Verifiable Presentation shall carry a unique identifier.

5.2 VP-2 Holder binding¶

5.2.1 VP-2.1 Single keypair binding in self-sovereign identity deployments¶

In self-sovereign identity (SSI)-enabled ecosystems, all claims shall be bound to a single keypair.

The criterion applies where the holder identifier of the presentation also appears as the credentialSubject identifier of at least one contained credential. Otherwise, the criterion shall be reported as not applicable, and it shall not cause the presentation to fail.

Where the criterion applies, every contained credential whose credentialSubject identifies the holder shall carry exactly the holder identifier of the presentation envelope; that identifier shall resolve to a DID document designating a single authentication verification method; and that verification method shall be the one used to sign the presentation.

5.3 VP-3 Contained Verifiable Credentials¶

5.3.1 VP-3.1 Compatibility of every contained credential¶

Every Verifiable Credential contained in the presentation shall satisfy all applicable criteria of the Verifiable Credential compatibility chapter, namely VC-1.1 to VC-6.3.

The VP-3.1 criterion shall be reported as pass only if every contained credential is reported as pass. The compatibility report shall list the per-credential result keyed by the credential id.

5.4 Summary of criteria¶

A presentation that satisfies all applicable criteria in this chapter is eligible for a Proof of Compatibility issued under the conformity assessment scheme Gaia-X Verifiable Presentation Compatibility, as described in Proof of compatibility.